One prompt that makes your AI audit your app.

I want a security review of this project before real users rely on it. It was built with Lovable and Supabase. Work through the checks below one at a time. For each one, tell me what you found, the exact files and lines, and whether it is a real problem (yes, no or unsure). Do not change any code until I have read the whole report. 1. Records only their owner may see List every API route, server action and page in this project that loads or changes a record by an id from the URL, the body or a form. For each one, show me the exact line that checks the record belongs to the signed-in user. If a route has no such check, say so plainly. Do not change any code yet. (Why this matters: https://www.logictrail.app/trails/who-may-see-what/invoice-105) 2. Secret keys in the browser code Search this project for every environment variable with a public prefix (NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_, PUBLIC_) and every API key or token string in the code. For each, tell me whether it is safe to be public. Flag any secret key that ends up in browser code. (Why this matters: https://www.logictrail.app/trails/money-and-secrets/the-key-in-the-bundle) 3. Supabase tables without Row Level Security Connect to my Supabase schema and list every table in the public schema. For each one tell me: is RLS enabled, what policies exist for select, insert, update and delete, and which roles they apply to. Flag any table with RLS off, any policy using (true), and any column a user could update to give themselves more access. Do not change anything yet. (Why this matters: https://www.logictrail.app/trails/who-may-see-what/the-table-anyone-can-read) 4. Lists that silently stop at 1,000 rows Find every place this project loads a list of records and then counts, sums or shows 'all' of them. For each, tell me whether it could be silently capped by a row limit, and whether it uses a stable order when paginating. Do not change code. (Why this matters: https://www.logictrail.app/trails/data-you-can-lose/exactly-1000-orders) 5. Pages and routes that check sign-in Find every place this project checks whether a user is signed in or allowed to see something. Tell me whether protected pages and API routes would still be protected if middleware did not run at all. Also tell me which framework version we use and whether it has known security patches. Do not change code. (Why this matters: https://www.logictrail.app/trails/who-may-see-what/the-redirect-that-let-them-in) 6. Login codes that can be guessed Without changing anything, find every place this project checks a login code, magic link, password or reset token. For each, tell me whether wrong attempts are limited, whether the code or token expires and after how long, and whether it can be used more than once. (Why this matters: https://www.logictrail.app/trails/accounts-and-privacy/six-digits-endless-guesses) 7. Password reset links that never expire Without changing anything, explain how password reset works in this project. Who creates the reset link, how long it stays valid, whether it can be used twice, whether requesting a new one cancels the old one, and what happens to other sessions after the password changes. (Why this matters: https://www.logictrail.app/trails/accounts-and-privacy/the-immortal-reset-link) 8. Who can create an account Tell me who can create an account in this app: is signup open to anyone, restricted to invites or an email domain, and where is that enforced on the server? List any ids or keys visible in the browser that the app treats as if they were secret. Do not change anything. (Why this matters: https://www.logictrail.app/trails/who-may-see-what/the-app-id-is-not-a-password) 9. Errors that never reach you Without changing anything, list every try/catch and .catch() in this project. For each one, tell me what happens to the error: is it shown to the user, logged on the server, sent to an error tracker, or dropped? Also tell me whether this project has any error tracking set up for the browser and for the server. (Why this matters: https://www.logictrail.app/trails/keeping-it-running/the-error-nobody-saw) Finish with a short list of the real problems, most serious first, and the fix you would make for each.