Skip to contentLockpick
How it worksPricingDocs

Read

  • BlogPlain answers to common security questions
  • GuidesStep by step fixes for common setups
  • Security checksEvery check we run, explained

Learn

  • Learn with PickTwo-minute lessons on how sites get attacked
  • Lockpick for ClaudeCheck sites from Claude and other assistants
  • GlossaryThe words we use, in plain words

Company

  • ChangelogWhat changed, newest first
  • StatusWhether scans are running right now
  • Security and trustHow we check and what we never do
Sign inCheck it
Guides

Fix it with your AI, prompts for Lovable, Bolt, Replit, v0, Cursor and Claude Code

By Mark KashefPublished October 8, 2026

The fastest fix for most security findings is the tool that wrote the code. Give it one finding, the evidence and what a good fix looks like, then check the live site again. Atlas, our example app at atlas.example, has a secret key in its bundle in every example below.

Where do the prompts come from?

In a Lockpick report, open the issue and choose Copy fix prompt, or Copy prompt to fix all to hand over every issue at once. The prompts tell the assistant to work on a new branch and not to deploy, push or change your DNS on its own. The examples here are shorter versions of the same idea.

Fix prompt for Lovable
The published site at atlas.example sends a secret API key in its JavaScript bundle. Move every call that uses this key into an Edge Function, read the key from Secrets, and remove it from all frontend code. Do not publish yet. List the files you changed.
Fix prompt for Bolt
The live site at atlas.example includes a secret API key in a script the browser downloads. Move the call that needs it into a server function, store the key in Secrets and remove it from the frontend. Show me the diff before publishing.
Fix prompt for Replit
Our app at atlas.example exposes a secret key in client-side JavaScript. Move the call to a server route, read the key from Replit Secrets as an environment variable and delete it from the client code. Do not deploy.
Fix prompt for v0
atlas.example ships a secret key in the browser bundle through a `NEXT_PUBLIC_` variable. Rename it without the prefix, move the call into a Route Handler and update the client to call that route. Do not deploy.
Fix prompt for Cursor
Work on a new branch. The deployed site at atlas.example includes a secret API key in its bundle. Find where it is read, move the call to server code that reads the key from an environment variable, and remove it from client code. Do not push.
Fix prompt for Claude Code
Work on a new branch and do not deploy or push. The live site at atlas.example sends a secret API key to every visitor. Move the call that uses it to server code, read the key from the environment, remove it from the frontend and tell me which files changed.

Curious what your site shows from outside? The quick check is free and needs no account.

Check it

What to do around the prompt

  1. Replace the leaked key with the service that issued it before you paste anything. Never paste secrets into the chat, and replace a leaked key yourself with the service that issued it.
  2. Paste one prompt, for one finding, and read the change it makes.
  3. Publish, then check again.

A fix counts when the scan looks again and no longer sees the problem. An AI saying it fixed something does not prove the live site changed, so the check after publishing is the part that matters.

Questions people ask

Can I give my AI every finding at once?

You can, and Lockpick has a prompt to fix all. One finding at a time is easier to review, so start there if the changes are large.

Should I paste my API key into the chat so the AI can move it?

No. Replace the key with the service that issued it, then let the AI change the code that reads it from your secrets.

See what your site shows from outside

A quick check reads your homepage the way a visitor would and gives you a score. No account needed.

Check your site

Related pages

  • API keys in your JavaScript bundle, how they get there and what to do
  • Lovable security checklist for a live app
  • Cursor security checklist for the app you ship

Sources

  1. Fix what we found Lockpick docs, read on October 6, 2026
  2. Letting your AI fix things safely Lockpick docs, read on October 6, 2026

About the author

Mark Kashef, Founder of Lockpick

I'm Mark, and I build Lockpick. I write these pages, and each one is checked against its sources before it goes live. The Updated date changes only when the page itself does.

Lockpick
PricingMethodologyDocsBlogGuidesSecurity checksLearn with PickSecurity and trustLockpick for ClaudeChangelogStatusFacts for AI assistants

Lockpick is a security scanner for vibe-coded apps. It checks what your live site exposes and what a GitHub repo or AI skill would do before you install it, then gives you a fix prompt for Lovable, Bolt, Replit, Cursor or Claude Code.

Lockpick assesses public pages you are authorized to test, and public GitHub code it never runs.

© 2026 LockpickTermsPrivacyContactSign in