AI Skills · 5 min read
10 Security Orders to Give Claude Code Before You Launch
Claude built your app. It did not secure it, because nobody told it to. These are the ten orders to give Claude Code before launch, plus the one prompt that runs all ten on your repo.
"Key Takeaways"
- AI-built apps ship without hardening because the builder never asked for it. Claude does what you tell it; security is a set of orders you have to give.
- The ten orders cover the classics: row-level security, rate limits, server-side prices, webhook verification, and the daily backup everyone skips.
- One prompt (included below) makes Claude Code apply all ten to your repo and report what changed.
- This is part 2. Part 1 is the 12-hole audit that finds what is already broken.
Summarize this article with
Claude built your app in a weekend. It did not secure it, and that is not a model failure: you never asked. Security is not a feature Claude adds by default, it is a set of orders you give before launch.
Here are the ten orders, then the prompt that runs all of them in one go. Each order is one line you could paste into Claude Code on its own.
The 10 orders
- Turn on row-level security in your database. Supabase and Firebase both ship with rules you have to write per table. Without them, your demo works because the database accepts everyone, including strangers.
- Add rate limits to every endpoint, strictest on auth. One script can brute-force your login or drain your paid API quota overnight; a few lines of middleware stop it.
- Recalculate every price on the server. If the client sends the amount, someone will send you a price of zero. The browser proposes, the server decides.
- Verify webhook signatures before processing them. An unverified webhook endpoint means anyone can tell your app a payment succeeded.
- Validate every upload's type and size server-side. An upload field that accepts anything is a free file host for attackers, or worse.
- Lock accounts after repeated failed logins. Password guessing is a volume game; lockouts and delays take the volume away.
- Set cookies to Secure, HttpOnly, and SameSite. One line per cookie, and it closes a whole class of session-theft attacks.
- Cap AI spend per user. Vibe-coded apps often proxy an AI API; without per-user caps, one user's script becomes your credit card bill.
- Log every login attempt and auth failure. When something goes wrong, the log is the difference between knowing and guessing.
- Set up an automated daily database backup, and test one restore. This is the order everyone skips, and the one that saves you at 2 AM when production goes down.
The ten-order prompt
Open Claude Code in your project folder and paste this:
Harden this codebase before launch. Do these 10 things, and for each one show me what you changed or what was already fine: 1) enable row-level security on every database table (Supabase/Firebase rules per table) 2) add rate limiting to every API endpoint, strictest on auth 3) recalculate all prices server-side, never trust the client's numbers 4) verify webhook signatures before processing them 5) validate every upload's file type and size server-side 6) lock accounts after repeated failed logins 7) set all cookies to Secure, HttpOnly, SameSite 8) add per-user spend caps on AI/API usage 9) log every login attempt and auth failure 10) set up an automated daily database backup and tell me where it lands. Finish with anything risky you noticed that I did not ask about.
Two honest notes
Review the diff before you accept the fixes, the same as any code change.
A backup you have never restored is a hope, not a backup. Run one test restore after Claude sets it up; it takes ten minutes and turns the order into an actual safety net.
Audit first, then harden
These ten orders add protections. Finding what is already broken is a different job: that is the 12-point audit from part 1, which checks your repo for exposed keys, open database rules, client-only auth and nine more holes, with a PASS or FAIL per item.
Run the audit first, fix what it finds, then apply these ten. The pair covers both directions: what leaked already, and what stops the next leak.
Quick questions
Does this need any paid security tool?
No. Everything here runs inside Claude Code on the plan you already have, including the built-in /security-review command for the audit side.
Which order matters most?
If you only do one: the backup, tested once. Every other item protects you from attackers; the backup protects you from everything, including your own migrations.
My app has no payments. Do orders 3 and 4 apply?
Skip webhook verification if you truly have no webhooks, but keep server-side recalculation in mind for anything the client sends that you act on: quantities, roles, plan tiers. The rule is the same: the browser proposes, the server decides.
The Chai Takeaway
Claude will secure your app with the same energy it built it. It is just waiting for the order. Paste the prompt before your next deploy, review the diff, and test one restore: the whole thing costs you an evening chai, not a security hire.
Explore More AI Skills