Copy, paste, check
Prompt library
24 prompts for your Base44 AI chat. Most only look. Run those first.
Start here: a five-check review
One prompt that walks the AI through your pre-publish review, tables, functions, keys and access, one at a time. It changes nothing.
1. Paste into your app's AI chat. Replace anything in [BRACKETS] first.
2. Read before you accept. The AI can miss things or change more than you meant.
3. Finish with the scan. Run Base44's security scan after any fix.
Browse by job
24 prompts
- Looks onlyData and tables
Audit every table
A first look at who can do what with your data.
List every table in my app. For each one, tell me who can create, read, update and delete its records. Flag any table that holds personal data where Read is set to All Users. Do not change anything yet.
- Looks onlyData and tables
Find the tables with personal data
You are not sure which tables matter most.
Find every table that probably holds personal data, such as names, emails, addresses, phone numbers, messages, orders or payments. For each one, show its current Read, Create, Update and Delete rules and tell me whether a stranger who never signed in could read it. Do not change anything yet.
- Changes your appData and tables
Lock a table to its creator
Orders, messages, notes: records that belong to one person.
On the [TABLE] table, set Read, Update and Delete to Creator Only, keep Create open to signed-in users, and keep an admin override using a User Property Check on User Role = Admin. Show me the rules before and after.
- Changes your appData and tables
Make a table admin-only
Staff-only data such as internal notes or reports.
Make the [TABLE] table admin-only for Create, Read, Update and Delete using a User Property Check on User Role = Admin. Then list everyone who currently has the Admin role.
- Looks onlyData and tables
Plan a two-user permission test
Before you trust a rule you just changed.
Write me a short test plan for the [TABLE] table using Test Permissions in preview with two sample users. For each person, say what they should see and what they should not, and what to look for. Remind me to use sample users, not real customers, because changes made while testing are saved to that person's data.
- Looks onlyData and tables
Preview recommendations before you apply
Base44 suggests permission fixes. Applying them replaces your current rules.
Show me each permission recommendation as a before and after for the rule it would replace. Wait for me to say which ones to apply.
- Looks onlyBackend functions
Audit every function
A function can hand out data a table rule would have blocked.
Review every backend function in my app. For each one, tell me whether it checks who is calling, whether it runs as the service role, and whether it returns data without limiting it to the caller. List the ones that do not.
- Changes your appBackend functions
Make a function check its caller
The scan says “Anyone can run this function”.
Update the backend function [FUNCTION NAME] so it requires a signed-in user and only returns records that belong to that user. If it has to stay public, explain why and add a check on the caller inside the function. Tell me which pages or integrations might break.
- Looks onlyBackend functions
Find every service-role read
The service role skips table rules, so each use needs its own checks.
Find every place my backend functions use the service role. For each one, explain what data it can reach and whether it limits the results to the person calling it. Do not change anything yet.
- Looks onlyBackend functions
Check how webhooks are verified
Webhooks have to be public, so the check moves inside the function.
List my webhook endpoints. For each one, tell me how the caller is verified (a provider signature or a shared secret) and what happens if that check is missing. Do not change anything yet.
- Looks onlyKeys and secrets
Find keys in the browser code
Anything in front-end code is sent to every visitor.
Search my app's front-end code for API keys, tokens or passwords. List each one with the file it is in and the service it belongs to. Do not change anything yet, and do not print the secret values.
- Changes your appKeys and secrets
Move a key into secrets
You found a key in the front end.
Move the key in [FILE] into secrets and change the code so the third-party call happens in a backend function that requires a signed-in user. Do not print the key in the chat.
- Looks onlyKeys and secrets
Plan a key replacement
A key has been in public code, so treat it as leaked.
I think the [SERVICE] key was exposed in my front-end code. Give me a checklist to replace it: where to create a new key with that provider, how to add it as a secret, which function should read it, how to retire the old key, and what to test afterwards.
- Looks onlyWho can get in
Review who can get in
New collaborators start as Admin, so check the list.
Tell me my app's visibility setting and list everyone invited, with their role. Point out anyone who has the Admin role and does not need it.
- Looks onlyWho can get in
Explain my visibility setting
You are not sure whether the app is open to everyone.
Tell me what my app's visibility is set to and explain in one paragraph who can open it today, including anyone who has the link. Say whether that suits an app that holds personal data.
- Looks onlyCredits
Find every credit-spending feature
AI, image and email features cost credits a stranger could burn.
List every feature in my app that spends credits, such as AI, image generation, email or other integrations. For each one, say whether it runs from the front end or from a backend function, and who can trigger it.
- Changes your appCredits
Move credit calls to the backend
The scan says “Prevent unauthorized credit usage”.
Move the credit-spending calls into backend functions that require a signed-in user, and add a simple per-user limit. Explain the limit you chose and which pages are affected.
- Looks onlyForms and payments
Audit public forms
Forms shown to signed-out visitors write data a stranger might read.
List every form that is shown to people who are not signed in. For each one, tell me which table it writes to, whether a stranger could read other people's submissions, and whether it could write to an admin-only table.
- Looks onlyForms and payments
Audit payments and refunds
Money actions should run on the server and be tightly limited.
List every place my app handles payments, refunds or cancellations. For each one, say whether it runs server-side, who can trigger it, which table stores the record and who can read that table.
- Looks onlyBefore you publish
Pre-publish security review
The last pass before you press publish.
Act as a security reviewer before I publish. Check my tables, backend functions, secrets, app visibility, collaborators and browser security settings (iFrame embedding, camera and location). Give me a pass or fail for each with the evidence, and do not change anything.
- Looks onlyBefore you publish
Decide my browser security settings
Settings > Browser Security: iFrame embedding, camera and location.
Does my app need to be embedded on other websites, or use the camera, microphone or location? Based on that, tell me which iFrame embedding option and which camera and location setting I should choose in Browser Security, and why.
- Looks onlyFix a scan finding
Explain a finding in plain English
Paste one finding from the security scan.
Explain this security scan finding in plain English: what could a stranger do with it, and what is the smallest fix? Do not change anything yet. [PASTE THE FINDING]
- Changes your appFix a scan finding
Fix a finding with the smallest change
You have read the finding and want it fixed.
Fix this security scan finding with the smallest change that works. Then list every page, function or integration that could be affected so I can test them. [PASTE THE FINDING]
- Looks onlyFix a scan finding
What to test before you rescan
You fixed something and want to be sure before the rescan.
I just fixed the finding below. Tell me what to test as a stranger, as a signed-in user and as an admin before I rescan. [PASTE THE FINDING]
These are Leak Hunt's own suggestions, not Base44's. If your chat has a Discuss mode, use it for the "looks only" prompts. Never paste real keys, passwords or customer data into a prompt.