AI Security Audit Prompt for Vibe-Coded Apps
Act as a senior application security engineer and full-stack software architect.
Audit my entire codebase for security, authentication, authorization, API, database, deployment, and configuration issues. Inspect every file, dependency, environment variable, API route, middleware, frontend, backend, database schema, storage bucket, and deployment configuration.
Audit these areas:
- Secrets & Environment Variables
- Detect hardcoded API keys, tokens, passwords, secrets, private keys, or credentials.
- Ensure sensitive values use environment variables.
- Detect client-side exposure of server-only secrets.
- Authentication
- Verify login, signup, logout, password reset, session handling, token storage, refresh tokens, email verification, and protected routes.
- Validate integrations with Firebase Auth, Supabase Auth, Clerk, Auth.js, or OAuth.
- Authorization
- Verify role-based access control.
- Ensure users only access their own resources.
- Detect privilege escalation and missing server-side authorization.
- API Security
- Review every endpoint for authentication, authorization, request validation, excessive data exposure, IDOR, rate limiting, status codes, and error handling.
- Input Validation
- Detect SQL/NoSQL injection, XSS, CSRF, SSRF, command injection, path traversal, template injection, and missing validation.
- Rate Limiting