The previous resource gave you the 3 essential locks before you ship. This is the next level: the hardening serious products use. Let's start with an uncomfortable, liberating truth: nothing is "impenetrable." Google, Stripe, the banks — they can all be attacked. The real goal isn't to be invulnerable; it's to be so expensive and annoying to attack that the attacker gives up and goes for an easier target, and to contain the damage when something does happen so that one failure doesn't turn into a catastrophe. It's like your house: there's no such thing as one that's impossible to rob, there's the one with bars, an alarm, a dog and cameras — where the thief takes a look, does the math on the effort, and heads to the neighbor's place. That's the goal: to be the hard house. Here are the 8 layers that pull it off, in plain language, each with its analogy and a prompt to ask your AI for it.
Nothing is "impenetrable," and anyone who tells you otherwise is lying. Google, Stripe, the banks: they can all be attacked. So what's security good for? The real goal isn't to be invulnerable — it's to be so expensive and annoying to attack that the attacker gives up and goes for an easier target. And it's to contain the damage when something happens, so that one failure doesn't turn into a catastrophe.
Two things people mix up: authentication is "are you who you say you are?" (the login), and authorization is "do you have permission for THIS specific thing?" (can this user see this piece of data?). The golden rule: deny by default. Everything is locked unless it's explicitly opened — never the other way around. Most leaks happen because someone left something "open by default" and forgot to close it.
I want to secure the authentication and authorization of my backend with the "deny by default" rule. Every endpoint should be born closed and only open with explicit justification. Set up a global guard that requires authentication on everything, and let me mark as public only what I specify. For authorization, check permissions per action, not just per login. Explain in simple steps what you did.
This layer is exactly what we saw in the previous guide (Lock 1). Here we raise it to an architecture rule: in a multi-user product, RLS isn't optional, it's the foundation.
My app is multi-user (many customers in the same database). Ensure full isolation with Row Level Security: enable RLS on ALL tables with user data, with policies that guarantee each person only accesses their own. I want the database to enforce it even if the code has a bug. Use (SELECT auth.uid()) for performance and restrict to the authenticated role. Give me the SQL and explain how to test that one user CAN'T see another's data.
Add rate limiting to my backend: a cap on requests per minute per user and per IP, stricter on sensitive endpoints (login, signup, and the ones that call the AI). When the limit is exceeded, respond with a clear error (429) without taking down the server. Tell me the limits you'd recommend to start with and how to tune them.
Before a malicious request ever touches your server, it passes through an outer shield — Cloudflare is the standard. That shield absorbs the massive attacks (the DDoS: thousands of machines hitting you at once), filters known bots and blocks attack patterns. Your server stays hidden behind it, without exposing its doors directly. It's the front line, the one the big players use.
I want to put an outer shield (WAF/CDN like Cloudflare) in front of my app. Walk me through simple steps to: route my domain through Cloudflare, enable DDoS protection and the application firewall, and hide my origin server so no one can hit it directly. Tell me which settings to turn on to start and which ones are free.
Secure my secrets (API keys, passwords, tokens). 1) Get them out of the code and out of git: put them in environment variables and create a .gitignore that ignores .env. 2) If I store my users' keys, encrypt them in the database with a per-user key. 3) Set up gitleaks as a hook before every commit so it stops me if I try to push a secret by accident. Explain each step in plain terms.
Never trust what the user sends. Every piece of data that reaches your backend gets validated against a strict schema before touching anything. This blocks the classic attacks: SQL injection (an attacker slipping commands into a form to steal your database), prompt injection (a user manipulating your AI into skipping its rules), and malformed data that breaks the system. The rule: validate at every edge. Everything external is suspect until proven otherwise.
Validate ALL input to my backend against a strict schema (use Zod or equivalent) at every endpoint, before processing anything. Reject whatever doesn't match the schema. Protect me specifically against SQL injection, prompt injection into the AI, and malformed data. Give me the pattern to apply at every edge and an example on one of my endpoints.
My app uses AI (which costs money per use). Protect me from a user bleeding my credits dry: 1) give each user a daily AI usage budget/cap, and cut them off when they hit it with a clear message. 2) Log consumption per user to detect abnormal behavior. 3) Alert me if someone spikes their spending. Explain how to set the limits so they don't affect the normal user.
You can't protect what you can't see. Every important action is logged (who, what, when) in an immutable log that no one can erase. If something odd happens, you have the recording. And an alerts system warns you while it's happening, not after. This is what lets you sleep at night: if someone tries something, you see it live.
Add auditing and observability to my app: 1) an immutable log that records who did what and when for the important actions (login, data changes, payments), which can't be deleted or edited. 2) Alerts that warn me in real time if something suspicious happens (many failed login attempts, abnormal spending, error spikes). Tell me which events to log first and how to receive the alerts.
If you want to ask for them all together when kicking off a serious project, this prompt sums up the 8 layers so your AI keeps them in mind from the foundation:
We're going to build this backend with enterprise-grade security from day 1, using "defense in depth" (many layers). Keep these 8 layers in mind in everything you build, and remind me which one is missing: 1. AUTH: authentication + authorization with "deny by default" (everything closed except what I open explicitly). 2. ISOLATION: Row Level Security on all tables (each user only sees their own, enforced by the database). 3. RATE LIMITING: cap on requests per user/IP, stricter on sensitive endpoints. 4. OUTER SHIELD: WAF/CDN (Cloudflare) in front, with DDoS protection and the origin hidden. 5. SECRETS: no keys in code/git; vault + environment variables; user keys encrypted; gitleaks before every commit. 6. VALIDATION: validate all input with a strict schema (Zod) at every edge; protection against SQL injection and prompt injection. 7. COST GUARDRAILS: per-user AI budget with automatic cutoff; detect abnormal consumption. 8. AUDITING: immutable log (who/what/when) + real-time alerts. Start by telling me which ones apply to my project and in what order we implement them, without over-engineering for what I don't need yet.
Join 4,200+ builders. No credit card. Build your first app with AI in minutes.