Prompt library
Free · 15 prompts · 5 stages · Works in any AI tool
Good vibe coding prompts do three things: they limit the change to one feature, they say what must not happen, and they ask the AI to explain before it acts. These prompts cover every stage, from planning to launch. Fill in the blanks once and they flow into every prompt, then copy one into Lovable, Bolt, Cursor, Claude Code or any AI tool.
Plan
Plan the app before building
At the very start, before the AI writes anything.
I want to build a booking app for dog groomers. Before writing any code, give me a short plan: the pages, the data tables with their columns, who can see and change each table, the outside services needed (payments, email, AI), and what you'd build first. Point out anything that will need a secret key or costs money per use. Wait for my OK before starting.
Plan
Find the smallest version
When the plan feels too big to finish.
Here's my idea: a booking app for dog groomers. What is the smallest version a real person would use and pay for? List three features at most, and the features to leave for later. Explain each choice in one line.
Build
Add one feature, with limits
Every time you add something.
Add a contact form for signed-in customers. It uses name, email and message. Change only the files this needs, and don't refactor anything else. Check permissions on the server, not only in the browser. When you're done, list every file you changed and why, in one line each.
Build
Create a table safely
When the AI adds a new database table.
Create the orders table. Turn on Row Level Security in the same migration, and add policies so each user can only read and change their own rows. Show me the SQL and explain each policy in plain English before applying it.
Build
Add Stripe payments
When you're ready to charge.
Add Stripe Checkout for a contact form. Set the price on the server from a price id, never from the browser. Grant access only from a verified Stripe webhook (check the signature on the raw body), and make the webhook safe to receive twice. Keep the secret key and webhook secret in server-only environment variables.
Fix
Explain the error before fixing
When something breaks. Always first.
This error happens on the profile page, after signing in: Cannot read properties of null (reading 'email'). Don't change any code yet. Tell me in plain English what it means, the first line in our own code where it happens, what value is empty or wrong there, and the two most likely causes. Then suggest how to confirm which one it is.
Fix
Break a fix loop
When the AI has said 'Fixed!' three times and it isn't.
Stop. We've tried several fixes for Cannot read properties of null (reading 'email') and none worked. Undo the changes from those attempts. List what we know for certain, what we've assumed, and what we haven't checked. Add logging to test the assumptions one at a time, and tell me what to look for. No new fixes until we know the cause.
Fix
Find what broke it
When it worked earlier and now it doesn't.
It worked earlier today and now the profile page, after signing in is broken. Using git, list the commits and uncommitted changes since then, summarise each in one line, and tell me which change most likely caused it and why. Don't change anything yet.
Check
Review your own change
After the AI finishes a feature, before you accept it.
Review the change you just made as a strict senior developer. Did you remove or weaken any check, test, permission or error handling? Did you change anything I didn't ask for? Could any user reach data or actions that aren't theirs? Answer each question with yes or no, and show the lines.
Check
Check who can see what
Before showing the app to anyone.
Without changing anything, list every page, API route and database table. For each, tell me who can read it and who can change it: anyone, any signed-in user, or only the owner. Flag anything where a signed-in user could reach another user's data by changing an id.
Check
Find exposed secrets
Before every deploy that adds a service.
Without changing anything, list every API key and secret this project uses, where each is read, and whether it could end up in browser code (NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_ or a 'use client' file). Check that no .env file is tracked by git.
Check
Lock it in with tests
After you've checked a feature by hand.
Write tests for a contact form: the normal case, empty and invalid input, and a user trying to reach someone else's data. Don't change the feature's code to make tests pass. If a test fails, tell me why instead.
Launch
Pre-launch safety check
The day before real users arrive.
We launch soon. Without changing anything, check and report on: secret keys outside browser code, Row Level Security on every table, permission checks in every API route, rate limits on sign-up, AI and SMS endpoints, spending limits on paid services, backups and how to restore them, and error tracking. Mark each as done, missing or unsure.
Launch
Find what could run up a bill
Before launch, and after adding any paid API.
Without changing anything, list every place this app calls a service that charges per use (AI, SMS, email, maps, database reads). For each, tell me who can trigger it, whether it needs sign-in, whether it's rate limited, and the worst case if a bot called it 10,000 times overnight.
Launch
Prove the backup works
Before you have data you can't lose.
Explain how this project's database is backed up: how often, how far back, and where. Then write step-by-step instructions to restore yesterday's data into a separate test project, without touching production, so I can try it once.
Questions
- What makes a good vibe coding prompt?
- It names one change, who it's for and what data it touches, says what must not happen, and states when it's done. Asking the AI to explain its plan or the cause of a bug before changing code prevents most wasted rounds.
- Do these prompts work in Lovable, Cursor and Claude Code?
- Yes. They're plain language and don't depend on a tool. In app builders, paste them into the chat; in Cursor or Claude Code, paste them into the agent chat with your project open.
- Why do so many prompts say 'without changing anything'?
- Because AI tools are eager to edit. Asking for a report first lets you see the problem and decide, instead of getting an unreviewed fix that may remove a safety check.
New to building with AI? Start with the visual beginner's guide, or give your AI standing rules with a rules file.