5-step workflowsecurity auth secrets validation exposure guided-flow QA

Security Basics Review

The essential security pass for AI-built apps: secrets, auth enforcement, input handling, and data exposure.

Run this as a guided flow on Flows — verify gates and recovery prompts included →

Flows@flows12d ago

0 runs0 forks0

Chain

Inputs

Step 1

flow-security-basics-review-1-hunt-exposed-secrets

Step 2

flow-security-basics-review-2-attack-the-auth-enforcement

Step 3

flow-security-basics-review-3-harden-input-handling

Step 4

flow-security-basics-review-4-audit-api-exposure

Step 5

flow-security-basics-review-5-final-security-re-test

Final output

Workflow inputs

No inputs required — hit Run to stream each step in order.

Each step streams from its model and feeds the next. BYOK — you pay your provider directly. Add a key in Settings if a step needs one.

Step 1 · The most common AI-build failure: keys where users can read them.

flow-security-basics-review-1-hunt-exposed-secrets

Claude Sonnet 4.6→ {{step_1}}

Awaiting upstream steps…

Step 2 · Prove every private endpoint rejects you - by trying.

flow-security-basics-review-2-attack-the-auth-enforcement

Claude Sonnet 4.6→ {{step_2}}

Awaiting upstream steps…

Step 3 · Every input is hostile until validated - on the server.

flow-security-basics-review-3-harden-input-handling

Claude Sonnet 4.6→ {{step_3}}

Awaiting upstream steps…

Step 4 · APIs should return the minimum - check what they actually say.

flow-security-basics-review-4-audit-api-exposure

Claude Sonnet 4.6→ {{step_4}}

Awaiting upstream steps…

Step 5 · Re-run every attack after fixes - and write down what remains.

flow-security-basics-review-5-final-security-re-test

Claude Sonnet 4.6→ {{step_5}}

Awaiting upstream steps…

About this workflow

The essential security pass for AI-built apps: secrets, auth enforcement, input handling, and data exposure.

What happens when you run it

1
The most common AI-build failure: keys where users can read them.
Runs flow-security-basics-review-1-hunt-exposed-secrets on Claude Sonnet 4.6
2
Prove every private endpoint rejects you - by trying.
Runs flow-security-basics-review-2-attack-the-auth-enforcement on Claude Sonnet 4.6
3
Every input is hostile until validated - on the server.
Runs flow-security-basics-review-3-harden-input-handling on Claude Sonnet 4.6
4
APIs should return the minimum - check what they actually say.
Runs flow-security-basics-review-4-audit-api-exposure on Claude Sonnet 4.6
5
Re-run every attack after fixes - and write down what remains.
Runs flow-security-basics-review-5-final-security-re-test on Claude Sonnet 4.6

Best for

•Recurring tasks you currently copy-paste between tools.
•When a single prompt isn't enough — you need a chain where output(n) feeds prompt(n+1).
•Fork and adapt if your inputs differ materially from the author's use case.

Models used

Claude Sonnet 4.6