Hey, it's Cindy 🌱 This is the twenty-point audit from the reel turned into a safe workflow.
btw the waitlist for AI System Club is now open! If you're keen on using AI to automate your content, video editing, job search, business or build AI agents, feel free to sign up (only if you want to hehe). Ps. the waitlist gets first dibs:)
the outcome
What you get
A 20-control security report with file-and-line evidence, severity, exploit path, recommended fix, and a retest for every real finding.
Use the guide in order. Gather the real inputs, run the prompts against those inputs, inspect the evidence, then make one reviewable change at a time.
start here
Set it up step by step
Create a branch and connect Claude Code to the repository. Use a local or staging environment with test accounts and test payment keys.
Paste the audit prompt. Require evidence for every pass and failure. Unknown is allowed; guessing is not.
Review the highest-severity findings first: authorization, secrets, database policy, injection, file upload, webhooks, and admin access.
Approve one fix group at a time. Re-run the specific exploit test after every patch.
Finish with dependency updates, production error handling, security headers, and a second full audit.
copy these
The prompts
Run the complete 20-point audit
📋 copy this
Audit this repository against exactly these twenty controls: 1 Row Level Security, 2 unpredictable object IDs plus server-side ownership checks, 3 parameterized database queries, 4 allowlisted update fields instead of mass assignment, 5 server-side input validation, 6 safe output encoding and sanitized intentional HTML, 7 validated file uploads, 8 verified webhook signatures and idempotency, 9 modern password hashing through the auth provider, 10 password strength and breached-password defence, 11 secure HttpOnly SameSite session cookies rather than long-lived tokens in localStorage, 12 email verification where identity matters, 13 rate limits on expensive and sensitive endpoints, 14 authenticated and authorized admin routes, 15 server-side permission checks, 16 narrow CORS origins, 17 no secret keys in client bundles, 18 no committed environment files or secrets in git history, 19 generic production errors with private structured logs, 20 supported dependencies with an update policy. Return a table with control, pass/fail/unknown, severity, exact file and line, exploit path, smallest fix, and retest. Do not edit until I approve a finding.
check the work
Quality gate before you trust it
1 Every finding has repository evidence. A homepage, package name, or guess is not evidence.
2 Authorization tests use two real test users and try cross-account access.
3 Secret scanning covers shipped bundles and git history, then exposed keys are rotated.
4 Security controls are enforced server-side even if the client UI hides the action.
5 A clean report includes unknown items rather than silently marking inaccessible systems as safe.
6 Save the source links, as-of date, and final evidence beside the output so another person can reproduce the check.
Guardrail. A prompt cannot certify an application as secure. High-risk findings need a qualified security review, especially auth, payments, personal data, public file uploads, and production infrastructure. Never test against systems or data you do not own.
keep it useful
Save the evidence with the workflow
Save the prompt with the source links and the date you verified them. When the tool, policy, price, interface, or documentation changes, update the guide before you reuse the workflow. Keep the inputs and outputs beside the project so the next run can be checked instead of reconstructed from memory.
the waitlist is now open
AI System Club is launching soon
Build AI systems with me through recorded lessons you can follow at your own pace. Join the waitlist for first access and the founding price.
btw this list gets first dibs the moment doors open :)