@himanshu.exploresss

What they said

1. Story: Developer A used Claude, Developer B used Codex; A's site tested more secure.
2. They swapped models (A on Codex, B on Claude); A's site was still more secure, so "the difference was not the AI model."
3. Cause: a checklist (prompt) A used. The 20-item list (spoken + on screen, numbered 1-20 in a dot tracker):
   1. Check for SQL injection
   2. Block cross-site scripting (XSS)
   3. Add CSRF protection
   4. Validate file uploads (e.g. block .php)
   5. Fix broken object-level authorization (BOLA/IDOR: #17 yours vs #18/#19)
   6. Add rate limiting (HTTP 429 shown)
   7. Secure JWT secrets
   8. Keep API secrets server-side (key in browser vs server)
   9. Hash passwords securely
   10. Add multi-factor authentication
   11. Tighten CORS settings (allow app.yoursite.com, block evil.example)
   12. Remove auth tokens from local storage (use HttpOnly cookie)
   13. Enforce permissions server-side (isAdmin client flag vs 403 server check)
   14. Enable RLS (row-level security)
   15. Verify webhook signatures (event: order.paid)
   16. Check for SSRF (block 169.254.169.254 internal network)
   17. Remove exposed source maps (app.js.map)
   18. Change default credentials
   19. Keep sensitive data out of logs (password/card in log lines)
   20. Update vulnerable dependencies (Spoken text in Hindi transcript contains mis-hearings like "tighten code setting", "odd tokens"; the on-screen/ comment version above is correct.)
4. CTA: "follow and send me this reel and I will send you the prompt."

Try this

• Anyone building with AI coding tools: Give the AI a security checklist. In the reel's story, the checklist, not the model, made one site more secure. Paste it as a review prompt: "audit this codebase against these items and report each failure with file and line".
• Injection and input: Check for SQL injection, cross-site scripting, CSRF protection, file upload validation, and server-side SSRF checks.
• Access control: Fix broken object-level authorization, enforce permissions on the server instead of a client-side admin flag, enable row-level security, and add multi-factor authentication.
• Secrets and sessions: Keep API secrets server-side, secure JWT secrets, hash passwords, keep auth tokens out of local storage, tighten CORS, and change default credentials.
• Operations: Add rate limiting, verify webhook signatures, remove exposed source maps, keep sensitive data out of logs, and update vulnerable dependencies.
• Agencies and freelancers: Run this list before handing over any client build, and attach the results to your delivery report.

Links

• Claude (Anthropic) and Codex (OpenAI) as AI coding assistants. Supabase-style RLS, JWT, CORS, CSRF, SSRF concepts. No URL; "the prompt" delivered by DM. A commenter (@bikaashkhadgi, 84 likes) pasted the full list, matching the video.