Prompt: lock your app’s admin pages

By the LaunchPal team · Updated 20 October 2026 · Works in Lovable, Bolt, Replit, v0, Base44, Cursor and Claude Code

Prompt to paste

Check that every admin page and admin action verifies on the server that the signed-in user has the admin role. Make sure nothing admin-only depends on hiding a button or a link, and that a normal user who types an admin address directly gets refused. List every admin page and action you checked.

When to use it

If your app has any page or action only you should use: an admin dashboard, user management, editing prices or content, exporting data. AI builders often protect these by hiding the link, so the page is invisible but still open to anyone who guesses the address. /admin is the first address people try.

What to check afterwards

  1. Log in as a normal test user.
  2. Type your admin page addresses straight into the address bar.
  3. You should be refused or sent elsewhere, not shown the page with the buttons hidden.

Also try one admin action, like deleting a test item, while logged in as the normal user, if your builder can show you how. It should fail.

Good to know

“On the server” is the important part. A check that only runs in the browser can be bypassed. If the builder’s answer only mentions hiding things in the interface, ask again.

The full background is in our guide: Is your vibe-coded app leaking data? 5 things to check.

More prompts