Ask the agent to walk through what someone with no account can read, change or delete — and tell it to be pessimistic. AI-built apps routinely ship with database tables that have no protection at all, or with a policy that permits everything while looking like it does something. This is the one check that decides whether you can launch.
The prompt
Walk me through exactly what a stranger with no account can read, change or delete in this database. Be specific and pessimistic.
| When to use it | Before anyone but you can open the app. Then again after every change that touches data or login. |
|---|---|
| Why it is worded that way | "Stranger with no account" is the right threat model for almost every small app — not a targeted attacker, just anyone who opens the developer tools and finds the public key sitting in the browser, where it is supposed to be. "Read, change or delete" forces three separate answers, because apps are frequently safe to read and wide open to write. "Pessimistic" is the word that matters: asked neutrally, an agent will summarise the intent of the code; asked pessimistically, it looks for the gap. |
Why this keeps happening
A builder or an agent creates a table so the app works. Row-level protection is a separate step that makes the app appear broken until the policies are right, so it gets deferred and then forgotten. The result is a documented vulnerability class in AI-built applications, with its own CVE — the mechanism is always either no protection at all, or a policy written to permit everything.
The follow-up that finds the fake lock
If the answer is reassuring, do not stop. Ask: "For every table, show me the exact policies. For each policy, tell me whether it compares the logged-in user to the owner of the row, or whether it permits everything." A policy without that comparison is decoration, and it is the most common AI-generated pattern because it makes the app work immediately.
The other half: values the browser decides
Data exposure is one door; the other is trusting the browser. Ask: "For every important value — prices, quantities, discounts, roles, permissions — tell me whether it is decided on the server or accepted from the browser." A price accepted from the browser is a price your customer can set to zero.
When to run it
Before launch, and on a calendar afterwards. Every feature that adds a table adds a door, and the agent will not remind you.
The Operator Prompt Pack
This is one of 60 prompts, from the phase "Verify like you did not write it". The pack has the rest, each with the same reasoning underneath, plus the research they are built on and a house-rules file you paste in once.
Tools this applies to
| Tool | What it does | Price |
|---|---|---|
| Supabase | Database, accounts and file storage in one, with no backend work. | Free tier |
| Lovable | Builds complete apps from a prompt. The most finished output of the group. | Free tier, then ~$25/mo |
| Claude Code | An AI agent in your terminal that reads your files, edits them, runs commands and deploys. | ~€17–20/mo |
Every tool has its own page with what it costs and who should skip it. Some links are affiliate links.
More prompts like this
The prompt that catches a package your AI invented
How do you check whether an AI coding agent invented a package that does not exist?
The prompt that makes an AI agent prove its code works
How do you verify that code written by an AI agent actually works?