Trazo · 32 prompts · First edition

Your AI built the app.
It did not secure it.

32 prompts you paste into whatever built your project — each with a check you do yourself, in a dashboard, in ten seconds.

Get the pack — $49 See a card Launch price · goes to $99
Claude CodeCodexCursorWindsurf CopilotLovableBoltv0Replit

The problem

An unprotected app works perfectly.

There is no error state for “working, and also public.” Which is why the same seven holes turn up in almost every AI-built project:

  1. The database is public
  2. Keys shipped to the browser
  3. Routes with no lock
  4. Change one number, see someone else’s data
  5. No rate limits anywhere
  6. Errors that confess
  7. Backups nobody has ever restored

None of them are hard to fix. All of them are invisible until somebody finds them.

Free · no purchase

Which of those seven do you have?

The Twelve-Point Triage: twelve questions about the project in front of you, one page, ten minutes, and an honest count of what is open right now. If nothing comes back red, close the tab with my blessing.

One email with the PDF. No sequence unless you ask for one.

One of the 32

One job. One page. One thing to check.

08

Lock every table

Severe risk About 15 minutes
Why this matters

Supabase and Firebase put your database on the public internet with its own address. The only thing between a stranger and your users table is a rule you have to write yourself — and it is off by default.

Paste this into your AI 
Look at my database. For every table, tell me whether Row Level
Security is ON or OFF. Show it as a list.

Then, for each table where it is OFF, turn it on and write the
policies that table actually needs, based on how my app uses it.

— rest of the prompt, and 31 more cards, in the pack

Check it worked
  • Supabase → Table Editor: no table shows an “Unrestricted” badge
  • Your app still works when you are logged in
Get all 32 — $49

Every card is built the same way: why it matters, the prompt, the check, and the follow-up line if your AI says it’s done and it isn’t.

The 32 cards

Ordered worst-first, so you can stop whenever you run out of time.

01–03The five-minute check3 cards
04–07Your keys4 cards
08–13Your database6 cards
14–18Logins and permissions5 cards
19–24Your app6 cards
25–28Your perimeter4 cards
29–32After launch4 cards

What you get

Two PDFs. One you use, one you keep.

The product · 45 pages

The Security Prompt Pack

32 cards, one page each, plus a printable emergency card for the day something goes wrong.

Bonus · 98 pages

The Vibecoder’s Security Manual

The full reference behind the prompts — including contract clauses, an incident runbook, and a 60-point pre-launch audit you can hand a client.

The offer

One leaked key costs more than this.

Both options are the same two PDFs. The only difference is how many people are allowed to use them.

Most people

For one person

$49one time

Launch price · $99 after the first 100

  • Both PDFs, instant download
  • Yours to use on every project you take on
  • Free updates for a year
Get the pack

Card or Apple Pay. Download links land in your inbox in seconds.

For a whole team · 5 seats

$199one time

Works out to $40 a seat

  • The same two PDFs — nothing extra, nothing held back
  • Hand the files to four teammates without breaking the terms
  • Everyone who touches client work runs the same checklist
  • One invoice to expense instead of five
Get 5 seats

Take this one if more than one person ships your client work. Working alone? The $49 option is the same files.

If it is not useful, reply to your receipt and I will refund you. No form, no questions. You keep the files.

Questions

Before you buy

Do I need to know how to code?
No. Every card gives you the exact words to paste into whichever AI tool built your app, then a check you perform by looking at a dashboard or your own site in a browser. No terminal, no reading code.
Which AI tools does this work with?
All of them. The prompts are tool-agnostic, and there is a reference table showing exactly where to paste them in Claude Code, Codex, Cursor, Windsurf, Copilot, Lovable, Bolt, v0, Replit Agent, and plain ChatGPT or Claude in a browser.
Can’t I just ask ChatGPT this myself?
You can — if you know what to ask. That is the entire product: the questions, in the right order, worst first, each with a way to verify the answer. One card even installs the rules into your project so your AI stops producing the problem in the first place.
Which one do I need — $49 or $199?
Both contain exactly the same two PDFs. The only difference is how many people can use them. $49 is for one person. $199 covers five people at one company, so you can hand the files to your team without breaking the terms, and it is one invoice instead of five. Working alone: take the $49.
My app is small. Am I really a target?
Nobody targets you specifically. Automated scanners sweep every address and every new public repository continuously, and they find you because you exist, not because you matter. That is the threat this pack is built around — not spies, bots.

Your app is either locked or it isn’t.

An hour with the first four cards removes most of the risk a small AI-built app carries.

Get the pack — $49
Launch price
$49
Get the pack