Advanced

Security Basics Review

The essential security pass for AI-built apps: secrets, auth enforcement, input handling, and data exposure.

5 steps15 verify checks60-90 minutesWorks with: emergent · chatgpt · claude · cursor

Start Guided Walkthrough

#security #auth #secrets #validation #exposure

The Route

0/5 verified

Hunt exposed secrets

The most common AI-build failure: keys where users can read them.

3 checks 02

Attack the auth enforcement

Prove every private endpoint rejects you - by trying.

3 checks 03

Harden input handling

Every input is hostile until validated - on the server.

3 checks 04

Audit API exposure

APIs should return the minimum - check what they actually say.

3 checks 05

Final security re-test

Re-run every attack after fixes - and write down what remains.

3 checks

Every step ends at a Verify Gate. Do not continue until every check passes.

Context Pack

Paste this first. It briefs the AI on requirements, constraints, and the Definition of Done before your first build prompt.

Context Pack

PROJECT CONTEXT:
My AI-built app is going in front of users and I need to catch the common security mistakes AI builders make.

GOAL:
Find and fix the high-impact basics: exposed secrets, unenforced auth, injection-prone input, and leaking APIs.

REQUIREMENTS:
- Secrets audit (frontend bundle, repo, logs)
- Auth enforcement audit on every private endpoint
- Input validation and injection checks
- API response audit for over-exposure
- Fixes verified by re-testing the attack

CONSTRAINTS:
- Test enforcement by attacking, not by reading code
- Never commit real secrets while fixing

DEFINITION OF DONE:
- No secrets in frontend code or public artifacts
- Every private endpoint rejects unauthenticated/unauthorized calls
- Hostile input is rejected without breaking the app
- API responses expose only necessary fields

COMMON FAILURES TO AVOID:
- API keys sitting in frontend env or bundle
- Backend routes trusting the UI to gate access
- Password hashes or emails returned in API responses
- IDs guessable and records readable across users

Paste this into your AI builder first. It teaches the AI what you want before you give it the build prompt.