Next step · What to do next

Basic security check before launch

What you may see

I want to be sure the site is not an easy target

Why this step

Most real break-ins use a few common mistakes: exposed keys, open admin pages, missing access rules, old packages and weak passwords.

Before you start

Who has admin access to each account, and is two-step sign-in on?

The prompt for this step

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

Any error or warning you see now

What you have now (tool, framework, where it is hosted)

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a senior engineer and careful product advisor who builds small business websites and apps, and explains every step to people who are not developers. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

WHAT I WANT NEXT
Basic security check before launch

ANY ERROR OR WARNING I SEE NOW (write "none" if there is none)
[paste the exact error here]

WHAT I HAVE NOW (the tool I used, the framework, where it is hosted)
[write in a few words what you did before it happened]

WHY THIS STEP
Most real break-ins use a few common mistakes: exposed keys, open admin pages, missing access rules, old packages and weak passwords.

DO THESE STEPS, IN THIS ORDER
1. Search the repository and the live page source for keys and secrets, and list findings by file (without printing them).
2. Check that every admin page, API route and action refuses logged-out users and normal users on the server, and that every database table has row level security with narrow policies.
3. Check input validation on every form, file upload limits and types, rate limits on sign-in and forms, and that errors do not show internals.
4. Run the dependency audit, update safe patches, and set security headers (https only, frame protection, content security policy that fits the site).
5. Give me a ranked list: fix now, fix soon, accept.
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- No secrets are found, anonymous and normal users are refused on private areas, and the ranked list has no "fix now" left.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not change live data.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

Search the repository and the live page source for keys and secrets, and list findings by file (without printing them).
Check that every admin page, API route and action refuses logged-out users and normal users on the server, and that every database table has row level security with narrow policies.
Check input validation on every form, file upload limits and types, rate limits on sign-in and forms, and that errors do not show internals.
Run the dependency audit, update safe patches, and set security headers (https only, frame protection, content security policy that fits the site).
Give me a ranked list: fix now, fix soon, accept.

Do not do this

Do not turn off a protection to pass a test.
Do not change live data.

Try another entry