Ask it to list every key and secret in the project and say, for each one, whether the browser downloads it. Anything the browser runs is public, including keys inside it. This is the second most common hole in generated apps and it takes two minutes to find.
The prompt
List every API key, token and secret this project uses. For each one, say whether it is sent to the browser or stays on the server, and which file it is in. Then tell me which ones a visitor could read.
| When to use it | Before anyone but you can open the app, and again after adding any integration. |
|---|---|
| Why it is worded that way | The confusion is structural: the code you write and the code that runs on a visitor's laptop look identical in the editor. Builders make it easy to put a key in either place and do not warn you which one you chose. Asking for the split as a list makes an invisible property visible. |
Check it yourself as well
Open the site, open your browser's developer tools, and search the downloaded code for the first few characters of your key. This takes a minute and does not depend on the agent being right about its own work.
If you find one, rotate it
Removing the key from the code does not un-publish it. Assume it has been read, issue a new one, and disable the old one at the provider.
Which keys are meant to be public
Some are — a public API key for a database or a payment form is designed to be visible, and its safety comes from the rules behind it rather than from secrecy. That is exactly why the access rules matter so much; see the companion check below.
The Build Prompt Pack
This is one of 57 prompts, from the phase "Security: the six doors, closed". The pack has the rest, each with the same reasoning underneath, plus the research they are built on and a house-rules file you paste in once.
Tools this applies to
| Tool | What it does | Price |
|---|---|---|
| Lovable | Builds complete apps from a prompt. The most finished output of the group. | Free tier, then ~$25/mo |
| Bolt | Fast full-stack prototypes, entirely in the browser. | Free tier, Pro ~$25/mo |
| Supabase | Database, accounts and file storage in one, with no backend work. | Free tier |
| Vercel | Hosting. Puts a project live on a real address with one command. | Free tier |
| Stripe | Payments and subscriptions. The standard, and integrating it is a matter of asking. | Free, percentage per sale |
Every tool has its own page with what it costs and who should skip it. Some links are affiliate links.
More prompts like this
The prompt to run before any app with a database goes live
How do you check whether your database is exposed before launching an app?
The prompt that stops a builder making the wrong app
How do you describe an app to an AI builder so it builds what you actually wanted?
The prompt for adding payments safely
How do you add payments to an app without handling card details yourself?