Bridge tool

Fix Prompt Preview

See what an AtRisk-style fix prompt looks like. Copy a sample into Cursor or your builder - then unlock tailored prompts from a real scan.

Missing Strict-Transport-Security

Sample · high

Fix this security finding on our Next.js / Vercel app:

Finding: Missing Strict-Transport-Security (HSTS) header
Severity: high
Impact: Browsers may allow accidental HTTP downgrades after first visit.

Requirements:
1. Enable HSTS for all responses on the production host (max-age at least 15552000, includeSubDomains if we own all subdomains).
2. Prefer platform config (Vercel headers / middleware) over per-page hacks.
3. Do not break local HTTP development.
4. Briefly explain where you changed config and how to verify with curl -I.

Email me this report

Optional - we'll send a short security tip and a link to scan your live URL. No spam.

Samples are generic. Scan your URL to unlock prompts matched to your findings.

Run a full AtRisk URL scan

This free tool is a teaser. A full scan surfaces more findings with severity counts - claim an account to unlock detail and fix prompts on Starter.

Run a full AtRisk URL scan →Unlock full findings + fix promptsSee pricing

How it works

AtRisk turns live findings into paste-ready fix prompts for Cursor, Claude, Lovable, and similar builders. Instead of a vague “make it secure,” each prompt names the finding, severity, impact, and acceptance criteria so the model has less room to invent half-fixes. This page shows sample prompts for common web issues - missing HSTS, weak CSP, insecure session cookies, reflected CORS with credentials, and mixed content - so you can see the shape before you subscribe. Pick a sample, copy it, and paste it into your builder against a throwaway branch to feel the workflow. Tailored prompts for your exact scan findings unlock on Starter after a full URL scan of your production host. Samples are illustrative and not personalized to your stack, CDN, or auth library. Always review generated patches, run your test suite, and verify with curl or browser DevTools before production. If a sample does not match your framework, adapt the “Requirements” section - the structure still helps. Pair this preview with a real AtRisk scan so the next prompts you use describe issues that actually exist on your URL.

Sample prompts only. They are not personalized to your site. Always review AI-generated patches. Full tailored prompts require an AtRisk scan + Starter.

Security Fix Prompt Preview - AtRisk