Replit Prompts: Build Secure Apps Fast

Build a full-stack web app for [PURPOSE]:

FEATURES:
- User authentication (signup, login, logout)
- Protected dashboard showing user data
- CRUD operations for [RESOURCE]
- Responsive design with Tailwind

SECURITY REQUIREMENTS:
- Use Replit Secrets for all API keys and credentials
- Hash passwords before storing (use bcrypt)
- Validate all user input on the server with Zod
- Use parameterized queries for all database operations
- Check authentication on every protected route
- Use httpOnly cookies for sessions

STACK:
- Next.js or Express backend
- Replit PostgreSQL for database
- Tailwind CSS for styling

Generate secure code following these patterns.

Create a REST API with authentication:

ENDPOINTS:
- POST /api/auth/register - Create account
- POST /api/auth/login - Get session
- GET /api/me - Get current user (protected)
- GET /api/[resource] - List resources (protected)
- POST /api/[resource] - Create resource (protected)
- PUT /api/[resource]/:id - Update resource (protected)
- DELETE /api/[resource]/:id - Delete resource (protected)

SECURITY:
- Create auth middleware that runs on ALL protected routes
- Verify session token validity
- Check resource ownership before update/delete (prevent IDOR)
- Use parameterized queries with Replit PostgreSQL
- Validate request body with Zod schemas
- Rate limit auth endpoints (5 per minute)
- Store secrets in Replit Secrets, never in code

Return proper HTTP status codes (401 unauthorized, 403 forbidden, 404 not found).

Build a contact form with full security:

FORM FIELDS:
- Name (required, 2-100 characters)
- Email (required, valid email format)
- Message (required, 10-2000 characters)
- Honeypot field (hidden, must be empty)

SECURITY FEATURES:
- Client-side validation for UX feedback
- Server-side validation (never trust client)
- Sanitize all input before storing
- Rate limit: 3 submissions per minute per IP
- CSRF token validation
- No sensitive data in error messages

STACK:
- React with form handling
- Express API route
- Zod for validation
- Store submissions in Replit Database

Include both validation layers.

Create a file upload feature with security:

ALLOWED FILES:
- Images: jpg, png, gif, webp (max 5MB)
- Documents: pdf (max 10MB)

SECURITY REQUIREMENTS:
- Validate file type by magic bytes, not just extension
- Reject files larger than limits on both client and server
- Generate random filenames (UUID), never use user input
- Store outside public directory or use signed URLs
- Scan uploaded content for common attack patterns
- No path traversal - sanitize all file paths
- Log all upload attempts

IMPLEMENTATION:
- Multer or similar for handling multipart
- Store in Replit Object Storage or external S3
- Return signed URLs for download

Validate properly, not just by extension.

Build a real-time chat application:

FEATURES:
- User authentication required to chat
- Multiple chat rooms
- Real-time message delivery
- Message history (last 100 messages)

SECURITY:
- Authenticate WebSocket connections
- Validate message content (max 1000 chars)
- Sanitize messages before broadcasting (prevent XSS)
- Rate limit messages (10 per minute per user)
- Store messages with parameterized queries
- Don't expose user data in room lists

STACK:
- Socket.io or ws for WebSocket
- Express for auth endpoints
- Replit PostgreSQL for storage
- React frontend

Validate all messages server-side.