Packs

On salev0.1.0

AI Security Review Pack

Review and fix AI-written code: leaked secrets, open databases, unsafe auth, IDOR, injection and more.

  • 12 prompts
  • ZIP of plain files
  • Single-user license

What's inside

  1. 01Find leaked secrets in code and git historyFind hardcoded keys in the working tree and history, and plan containment.In free sample
  2. 02Stop secrets leaking into client bundlesMake sure nothing secret ships to the browser through env prefixes or build output.
  3. 03Lock down Supabase with Row Level SecurityMake sure every exposed table has RLS and correct policies, and no secret key ships to clients.In free sample
  4. 04Fix open Firebase security rulesReplace open or test-mode rules with rules tied to request.auth.
  5. 05Close exposed MongoDB and Postgres accessMake sure self-hosted databases require auth and are not reachable from the internet.
  6. 06Review authentication, sessions and JWTsFind weak login, session and token handling and fix it.
  7. 07Fix IDOR and broken access controlMake every object lookup check that the caller may access it.In free sample
  8. 08Find and fix injectionReplace string-built queries and commands with safe APIs.
  9. 09Fix SSRF and unsafe file uploadsStop the server fetching attacker-chosen URLs and accepting dangerous files.
  10. 10Tighten CORS and Content Security PolicyLock down cross-origin access and add a CSP that blocks injected scripts.
  11. 11Review dependency risk, rate limits and PII in logsCover the ops-side risks: vulnerable packages, abuse and leaky logs.
  12. 12Write the final security triage reportTurn all findings into a ranked, honest report with owners and next steps.

Who it's for

Who it's for: builders shipping AI-written web apps on Supabase, Firebase or their own backend who want to review and fix their own code before launch.

What this is not

  • Attacking or scanning systems you don't own. The prompts refuse this.
  • Mobile app binaries, cloud IAM in depth, network and infrastructure pentesting.
  • Compliance certifications (SOC 2, HIPAA, PCI).

Try 3 prompts free

The free sample is a ZIP with 3 prompts from this pack. No email or account needed.

Download the free sample

License summary

Single user. Use, copy and modify the prompts for personal and commercial development work, including in your own projects. Don't resell, redistribute or publish the pack itself, or share your copy. If you get a refund, the license ends. Full license: LICENSE.txt in the download; summary in our terms.

Refunds

All sales are final, except where the law requires a refund. Try the 3 free sample prompts before you buy. If your download is faulty or never arrives, email [email protected] with your order or receipt number. See the full terms.

OWASP, Supabase, Firebase, Google, GitHub, MongoDB, PostgreSQL, Vite and Next.js are named for identification only. ShipWithAI is not affiliated with or endorsed by them.

This is a ShipWithAI product. It doesn't affect our tool rankings.

FAQ

What's in the pack?

12 review-and-fix prompt loops for code you own: leaked secrets in your repo and its history, secrets in client bundles, Supabase RLS, Firebase rules, MongoDB and PostgreSQL exposure, auth, sessions and JWTs, IDOR and access control, injection, SSRF and file uploads, CORS, CSP and headers, dependencies, rate limits and logging, and a final triage report.

Is this a security audit?

No. These prompts help you review your own code. They are not a penetration test or a security audit, and output from your AI tool can be wrong or miss things. Review every diff, and get a professional review for apps that handle money, health or other sensitive data.

Was it checked?

Every guideline, config key and API named in the prompts was looked up in the official docs listed in DOCS-CHECKED.md on the date shown. This is a documentation check only.

What isn't covered?

Attacking or scanning systems you don't own (the prompts refuse this); mobile app binaries, cloud IAM in depth, network and infrastructure pentesting; compliance certifications (SOC 2, HIPAA, PCI).

Can I try it first?

Yes. The free sample has prompts 01 (leaked secrets in repo and history), 03 (Supabase RLS review) and 07 (IDOR and access control). All sales are final, except where the law requires a refund, so try the free sample first: 3 prompts, no email or account needed.

Related packs

All packs