Securityadvanced
Audit My Project for Security Problems
A structured security review covering keys, access rules, roles and server-side checks.
When to use it
Pre-launch
Lovable Prompt
Audit this project for security problems and report findings by severity before changing anything. Check: 1. Are any secret keys or service credentials reachable from frontend code? 2. Does every table holding real data have row level security enabled with policies that are not simply "true"? 3. Can one user read or modify another user rows anywhere? 4. Are role checks performed server-side on every privileged action, not only in the interface? 5. Is user input validated on the server before being stored or passed to another service? 6. Are public endpoints — webhooks and public APIs — verifying their caller? 7. Does any error message leak internal details to users? For each finding give the severity, the exact location and the fix. Then fix the critical ones.
Why it works
It enumerates the specific classes of failure common to AI-built projects instead of asking generally whether the app is secure.
Was this prompt helpful?
You might also need
- GuideHow to Secure Your Database with Row Level SecurityWhat row level security actually does, how to write policies that work, and how to prove your data is not exposed.
- GuideHow to Store API Keys SecurelyWhich keys are safe in code, which must be secrets, and how to tell the difference.
- AnswerHow do I protect API keys?Never put API keys in front-end code — store them as secrets used only inside server functions (Edge Functions), where the browser never sees them.
- AnswerCan users access my database?Only through the access rules you (or your row-level security policies) allow — Lovable Cloud's database isn't publicly browsable, but a table without RLS enabled is effectively open to anyone with your app's public key.
Guides that use this prompt
TutorialSecurity
How to Secure Your Database with Row Level Security
What row level security actually does, how to write policies that work, and how to prove your data is not exposed.
advanced 12 minChecked 24 Aug 2026
ChecklistSecurity
How to Store API Keys Securely
Which keys are safe in code, which must be secrets, and how to tell the difference.
beginner 6 minChecked 24 Aug 2026
