Ch07 Security And Tests

# Chapter 7 prompts — Security, Testing, and Not Getting Sued

**Hour block: hours 29-34** of the book's 48-hour build.

> **Access requirement:** every prompt below is pasted into an interactive Claude
> Code terminal session, and Claude Code requires Pro or higher — the free plan
> does not include it (ch03:31). This repository never runs any of these prompts,
> and neither does its CI. They are documentation, not executable code.

**The full pack, with every prompt transcribed verbatim: [`prompts/ch07-security-and-tests.md`](../../prompts/ch07-security-and-tests.md)**
The pack is the source of truth for exact prompt text; this page is the guide to
navigating it.

> ⚠ **This chapter's checklist is a FLOOR, NOT A CERTIFICATION.** A clean 20-point
> audit does not mean an app is secure. See [`../../DISCLAIMER.md`](../../DISCLAIMER.md).
> Before you take payments or store health data, pay a security professional to
> review it.

## What this chapter's prompts do

Claude Code writes functional code, not secure code, by default — it will store
passwords in plain text, skip input validation, or leave an endpoint open unless
you specify otherwise. This chapter's prompts close the five places AI-generated
code most commonly leaks data (broken auth, missing input validation, unparameterized
queries and IDOR, secrets that never left the source tree, and vulnerable
dependencies), then have Claude write integration and unit tests, run a 20-point
security audit, and add the unglamorous pre-launch basics (error pages, rate
limiting, backups, a privacy policy, account deletion). It closes with a manual XSS
test you run with your own hands rather than trusting Claude's word.

## When you use them

Hours 29-34, after the core features and visual polish are in place (Chapters 3-4)
and the token habits from Chapter 5 are running in the background. Nothing new
needs to be built first — this chapter hardens the same Task Tracker project.
Before running the 20-point audit prompt, have the app's auth, task CRUD, and
`.env.local` already in place, since the audit checks all of them.

## Index of every prompt in the pack

| # | Prompt | Cite | What it does |
|---|---|---|---|
| 1 | Review authentication | ch07:35 | Checks httpOnly cookies, a real `NEXTAUTH_SECRET`, and adds login rate limiting |
| 2 | Add input validation | ch07:43 | Sanitizes HTML from task fields, caps lengths, returns clear errors — after you manually confirm an XSS payload doesn't fire |
| 3 | Search for raw SQL | ch07:49 | Finds and converts any raw SQL queries to parameterized Prisma queries |
| 4 | The IDOR check | ch07:53 | Verifies every task-fetching query also checks `userId`, and adds the check where it's missing |
| 5 | Move secrets to env vars | ch07:59-78 | Fixes any hardcoded secrets found by the three local greps, and adds `.env*` to `.gitignore` |
| 6 | Fix `npm audit` findings | ch07:80-104 | Runs `npm audit` and fixes vulnerabilities, explaining any that can't be auto-fixed |
| 7 | Add CORS headers | ch07:112 | Locks API routes to the production domain and localhost only |
| 8 | Integration tests for CRUD | ch07:130 | Tests create/read/update/delete against a real test database, success and error paths |
| 9 | Unit tests for complex logic | ch07:136 | Tests utility functions on edge cases: empty, null, past dates, negative numbers |
| 10 | Configure Jest | ch07:150 | Sets up Jest for the Next.js TypeScript project with a resetting test database |
| 11 | Run the tests | ch07:152 | Runs the suite, reports results, fixes any failures |
| 12 | Fix a Jest config that won't start | ch07:170 | Repairs Jest when it fails to start rather than failing a test |
| 13 | Test the edge cases Claude misses | ch07:224 | Adds five specific edge-case tests Claude doesn't write unprompted |
| 14 | One behavior per test | ch07:218 | Asks Claude to make each test verify one behavior with a descriptive name |
| 15 | ⭐ The 20-point security audit | ch07:239-289 | Runs the full checklist, marking PASS/FAIL/N/A per point, fixing every FAIL |
| 16 | Custom error pages | ch07:276 | Adds friendly 404/500 pages instead of stack traces |
| 17 | Rate limiting everywhere | ch07:281 | Extends rate limiting to all endpoints, not just login |
| 18 | Database backup script | ch07:286 | Adds a daily cron job exporting all data to JSON |
| 19 | Privacy policy page | ch07:291 | Creates a simple privacy policy describing what data is collected |
| 20 | Account deletion | ch07:296 | Adds a password-confirmed "Delete Account" button (a GDPR requirement) |

20 prompts.

## The signature prompts

### ⭐ The 20-point security audit (ch07:271-287)