Bolt.new Prompts: Templates for Secure AI Apps

Build a Next.js app with user authentication:

REQUIREMENTS:
- Email/password signup and login
- Protected dashboard route (redirect if not authenticated)
- Session management with secure cookies
- Password hashing (never store plain text)

SECURITY RULES:
- Use environment variables for all secrets
- Validate email format and password strength on server
- Rate limit auth endpoints (5 attempts per minute)
- Hash passwords with bcrypt before storing
- Use httpOnly cookies for session tokens

STACK: Next.js 14, Tailwind CSS, better-auth or lucia

Generate the complete authentication flow with proper security.

Create a REST API for a todo app with database:

ENDPOINTS:
- GET /api/todos - List user's todos
- POST /api/todos - Create todo (title, completed)
- PUT /api/todos/:id - Update todo
- DELETE /api/todos/:id - Delete todo

SECURITY REQUIREMENTS:
- Authenticate every endpoint (check session/token)
- Use parameterized queries, NEVER string concatenation
- Validate input: title max 200 chars, completed is boolean
- Check ownership before update/delete (user can only access their own todos)
- Return 401 for unauthenticated, 403 for unauthorized

STACK: Next.js API routes, Prisma ORM, PostgreSQL

Use parameterized queries and proper auth on every route.

Build a contact form component with security:

FORM FIELDS:
- Name (required, 1-100 characters)
- Email (required, valid format)
- Message (required, 10-1000 characters)

SECURITY FEATURES:
- Client-side validation for UX
- Server-side validation (never trust client)
- Sanitize message content before storing
- Rate limit submissions (3 per minute per IP)
- CSRF token validation

STACK: React, Tailwind CSS, Zod for validation

Include both client and server validation.

Create an admin dashboard with role-based access:

PAGES:
- /dashboard - All authenticated users
- /dashboard/users - Admin only (manage users)
- /dashboard/settings - Admin only

ROLES: user, admin

SECURITY REQUIREMENTS:
- Check authentication on every page
- Check role permissions before rendering admin pages
- Server-side role verification (not just UI hiding)
- Audit log for admin actions
- Session timeout after 30 minutes of inactivity

STACK: Next.js App Router, middleware for auth

Implement proper RBAC with server-side checks.

Build a file upload feature with security:

ALLOWED FILES:
- Images: jpg, png, webp (max 5MB)
- Documents: pdf (max 10MB)

SECURITY REQUIREMENTS:
- Validate file type by magic bytes, not just extension
- Limit file size on both client and server
- Generate unique filenames (UUID, not user input)
- Store files outside web root or use signed URLs
- Scan for malware if possible
- No path traversal (sanitize all paths)

STACK: Next.js, AWS S3 or local storage

Validate file types properly, not just by extension.