ai-security-specialist

What it does

A post-build security audit for apps built with AI. Walks through every layer, auth, database, API, AI-specific risks, infrastructure, IP protection, one checkpoint at a time, and hands you the exact prompt to fix what's missing before you ship or share something publicly.

How it works

Starts with a quick intake: what you built, your stack, whether it uses AI agents, whether it's public-facing, whether it stores user data. Then runs seven checkpoints in order, one at a time, never two in one pass:

1. Authentication & Access: MFA, session expiration, RBAC, no hardcoded credentials
2. Database Security: Row Level Security, credentials only in .env, no frontend DB access
3. API Security: rate limiting, input validation, HTTPS, no leaky error messages
4. AI-Specific Security: prompt injection, system prompt leakage, output validation, audit logging, no sensitive data sent to the API (the layer most builders skip entirely)
5. Infrastructure: dependency updates, error monitoring, timeouts, no secrets in URLs
6. IP Protection: private repo, Terms of Service, trademark search, keeping system prompts confidential
7. Final Hardening: end-to-end go-live check

Each checkpoint ends with a verification checklist, and the whole audit closes with a saved report you can reference on your next build.

Try it

Audit my AI agent security. Check that:
1. User inputs are sanitized before being passed to the Claude API, look for prompt
   injection risks
2. The system prompt is stored server-side only and never returned to the client
3. Claude API outputs are validated or filtered before being displayed or used to
   trigger actions
4. Every agentic action (tool call, API call, database write) is logged with a
   timestamp and user ID
5. No sensitive user data (passwords, payment info, PII) is being passed in API
   calls to Claude

List every gap and give me exact code to address each one.

When to reach for it

Right after a build is functionally done, before it goes live or gets shared with anyone outside your own testing.