# Fix it with your AI, prompts for Lovable, Bolt, Replit, v0, Cursor and Claude Code

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

How to hand a security finding to the AI tool that built your app, with a fix prompt for each builder, and how to confirm the fix on the live site.

The fastest fix for most security findings is the tool that wrote the code. Give it one finding, the evidence and what a good fix looks like, then check the live site again. Atlas, our example app at atlas.example, has a secret key in its bundle in every example below.

## Where do the prompts come from?

In a Lockpick report, open the issue and choose Copy fix prompt, or Copy prompt to fix all to hand over every issue at once. The prompts tell the assistant to work on a new branch and not to deploy, push or change your DNS on its own. The examples here are shorter versions of the same idea.

:::fix-prompt lovable
The published site at atlas.example sends a secret API key in its JavaScript bundle. Move every call that uses this key into an Edge Function, read the key from Secrets, and remove it from all frontend code. Do not publish yet. List the files you changed.
:::

:::fix-prompt bolt
The live site at atlas.example includes a secret API key in a script the browser downloads. Move the call that needs it into a server function, store the key in Secrets and remove it from the frontend. Show me the diff before publishing.
:::

:::fix-prompt replit
Our app at atlas.example exposes a secret key in client-side JavaScript. Move the call to a server route, read the key from Replit Secrets as an environment variable and delete it from the client code. Do not deploy.
:::

:::fix-prompt v0
atlas.example ships a secret key in the browser bundle through a `NEXT_PUBLIC_` variable. Rename it without the prefix, move the call into a Route Handler and update the client to call that route. Do not deploy.
:::

:::fix-prompt cursor
Work on a new branch. The deployed site at atlas.example includes a secret API key in its bundle. Find where it is read, move the call to server code that reads the key from an environment variable, and remove it from client code. Do not push.
:::

:::fix-prompt claude-code
Work on a new branch and do not deploy or push. The live site at atlas.example sends a secret API key to every visitor. Move the call that uses it to server code, read the key from the environment, remove it from the frontend and tell me which files changed.
:::

## What to do around the prompt

1. Replace the leaked key with the service that issued it before you paste anything. Never paste secrets into the chat, and replace a leaked key yourself with the service that issued it.
2. Paste one prompt, for one finding, and read the change it makes.
3. Publish, then [check again](/docs/get-started/check-again).

A fix counts when the scan looks again and no longer sees the problem. An AI saying it fixed something does not prove the live site changed, so the check after publishing is the part that matters.

## Questions people ask

### Can I give my AI every finding at once?

You can, and Lockpick has a prompt to fix all. One finding at a time is easier to review, so start there if the changes are large.

### Should I paste my API key into the chat so the AI can move it?

No. Replace the key with the service that issued it, then let the AI change the code that reads it from your secrets.

## Sources

- [Fix what we found](https://www.lockpick.app/docs/get-started/fix-what-we-found), Lockpick docs, read on 2026-10-06
- [Letting your AI fix things safely](https://www.lockpick.app/docs/learn/letting-your-ai-fix-things), Lockpick docs, read on 2026-10-06