Copy-Paste Fix Prompts

1. Add security headers to my Vercel Next.js app

Use when: Your scan (or DevTools) shows missing headers like X-Content-Type-Options or HSTS.

Add security headers to this Next.js app using the headers() function in next.config.js (or next.config.mjs), applied to all routes ("/(.*)").
Add exactly these:
- Strict-Transport-Security: max-age=31536000; includeSubDomains
- X-Frame-Options: SAMEORIGIN
- X-Content-Type-Options: nosniff
- Referrer-Policy: strict-origin-when-cross-origin
- Permissions-Policy: camera=(), microphone=(), geolocation=()
- Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self' https:; frame-ancestors 'self'
Keep any existing config. Use Report-Only for CSP so nothing breaks yet. Don't change anything else. Show me the final file.

This is a generic starting point. For a fix prompt written from your site's actual findings, get the $12 Deep Scan.

2. Move my OpenAI call to a server route

Use when: Your OpenAI (or Anthropic, Gemini, etc.) key is used in browser code or has a NEXT_PUBLIC_ / VITE_ prefix.

My app calls the OpenAI API from client-side code, which exposes my API key in the browser bundle. Fix this:
1. Create a server-side route (e.g. app/api/chat/route.ts for Next.js, or a serverless/edge function for my stack) that calls OpenAI using process.env.OPENAI_API_KEY.
2. Rename any NEXT_PUBLIC_OPENAI_API_KEY / VITE_OPENAI_API_KEY to OPENAI_API_KEY so it is never bundled.
3. Update the frontend to call my new route with fetch instead of calling OpenAI directly.
4. Validate the request body and cap max tokens on the server so nobody can abuse the route.
5. Remove the openai package import from all client components.
List every file you changed. Remind me to rotate the old key, since it was already public.

This is a generic starting point. For a fix prompt written from your site's actual findings, get the $12 Deep Scan.

3. Add sitemap and robots to my Vite app

Use when: /sitemap.xml or /robots.txt returns 404 or your index.html.

This is a Vite + React app. Add SEO basics:
1. Create public/robots.txt that allows all crawlers and points to https://MYDOMAIN.com/sitemap.xml.
2. Create public/sitemap.xml listing every public route in my router (skip auth-only/dashboard pages), using https://MYDOMAIN.com as the base.
3. Make sure my host config (vercel.json / netlify _redirects) doesn't rewrite /robots.txt and /sitemap.xml to index.html.
Replace MYDOMAIN.com with my real domain if you can find it in the project; otherwise leave a clear TODO.

This is a generic starting point. For a fix prompt written from your site's actual findings, get the $12 Deep Scan.

4. Lock down my Supabase tables with RLS

Use when: You use Supabase from the browser and aren't sure Row Level Security is on.

Review every table in my Supabase schema that the frontend reads or writes. For each one:
1. Enable Row Level Security.
2. Write policies so users can only select/insert/update/delete their own rows (match on auth.uid() = user_id or the equivalent owner column).
3. For truly public read-only data, add a select-only policy and nothing else.
Give me the SQL as a single migration I can run in the Supabase SQL editor. Also check that the service_role key is never used in client code; if it is, move that logic to a server/edge function.

This is a generic starting point. For a fix prompt written from your site's actual findings, get the $12 Deep Scan.

5. Find and remove secrets from my frontend

Use when: You suspect keys ended up in your JavaScript bundle.

Search this whole project for API keys, secrets and tokens that end up in client-side code: anything with NEXT_PUBLIC_, VITE_, REACT_APP_ prefixes, hard-coded strings that look like sk-, sk_live_, service_role, AKIA, ghp_, or private keys.
For each one, tell me: the file, whether it is safe to be public (e.g. a Supabase anon key or Stripe publishable key is fine), and if not, how to move it server-side.
Then make the changes for the unsafe ones. Don't delete anything without telling me. Give me a list of keys I should rotate.

This is a generic starting point. For a fix prompt written from your site's actual findings, get the $12 Deep Scan.

6. Add proper title, description and social preview tags

Use when: Your link previews look blank, or every page has the same title.

Add SEO and social meta tags to every public page of this app:
- A unique <title> (under 60 chars) and meta description (under 160 chars) per page, written from the page content.
- og:title, og:description, og:image, og:url and twitter:card=summary_large_image.
- A canonical URL per page.
Use my framework's native way (Next.js metadata export, react-helmet-async for Vite/React, etc.). If there's no og image, create a simple 1200x630 placeholder and tell me where to replace it.

This is a generic starting point. For a fix prompt written from your site's actual findings, get the $12 Deep Scan.

7. Force HTTPS and fix mixed content

Use when: Your site loads over http:// or the browser warns about insecure content.

Make sure this site is HTTPS-only:
1. Find any http:// URLs for scripts, images, fonts, iframes or API calls and switch them to https:// (or protocol-relative where it makes sense).
2. Add a redirect from http to https in my host config if the host doesn't already do it.
3. Add Strict-Transport-Security: max-age=31536000; includeSubDomains once everything loads over HTTPS.
List every URL you changed.

This is a generic starting point. For a fix prompt written from your site's actual findings, get the $12 Deep Scan.

8. Rate-limit my API routes

Use when: You have public API routes (AI calls, signups, contact forms) that anyone could hammer.

Add basic rate limiting to every public API route in this project, especially ones that call paid APIs (OpenAI, email, SMS) or create accounts.
Use a simple approach that works on my host (e.g. Upstash Ratelimit on Vercel, or an in-memory limiter for a single-server Express app). Limit by IP, something like 10 requests per minute per route, and return a 429 with a friendly message when exceeded.
Don't change the routes' behavior otherwise. Tell me which env vars I need to set.

This is a generic starting point. For a fix prompt written from your site's actual findings, get the $12 Deep Scan.

9. Make my images lighter and my page faster

Use when: Your page feels slow, or a tool like PageSpeed Insights flags large images. (ChillScan measures response time, page weight and JavaScript size, not individual images.)

Improve load speed on my main landing page without changing how it looks:
1. Convert large PNG/JPG images to WebP or AVIF and resize them to the largest size they're actually shown at.
2. Add width/height (or aspect-ratio) to images to avoid layout shift, and loading="lazy" to anything below the fold.
3. Use my framework's image component if there is one (next/image, etc.).
4. Defer non-critical third-party scripts.
Show me before/after file sizes for the images you changed.

This is a generic starting point. For a fix prompt written from your site's actual findings, get the $12 Deep Scan.

10. Add a custom 404 page and stop leaking errors

Use when: Broken links show a blank page or a stack trace.

1. Add a friendly custom 404 page that links back to the homepage, using my framework's convention.
2. Make sure production errors show a generic message to users, not stack traces, file paths or env values. Log details server-side only.
3. Check that source maps aren't publicly served in production unless I explicitly want them.
Tell me what you changed.

This is a generic starting point. For a fix prompt written from your site's actual findings, get the $12 Deep Scan.

Want more context first?

For what each header actually does (and why CSP starts in report-only), see security headers, explained chill. For the whole pre-launch rundown, grab the launch checklist.