What Should I Ask My AI Agent to Find the Problems in My App?

The reason "is my app okay?" gets you a shrug is that it asks your agent to grade its own homework in the abstract. The fix is to ask narrow, adversarial questions about specific failure modes, one at a time, and make the agent show you the file and line for each answer. Below are the exact prompts that turn a coding agent into something closer to a reviewer.

Why the vague question fails

Your AI agent built what you asked for, and in the demo it works. When you ask "is it okay," it has no reason to hunt for the things you never asked about: the table with no access rules, the route that trusts the browser, the payment that was never verified. A broad question invites a broad, reassuring answer. A narrow question about one known failure mode forces the agent to actually go and look.

Agents are also agreeable by default. "Is my app secure?" nudges it toward "yes." "Show me every place a signed-out user could read data they shouldn't" nudges it toward evidence. Same model, very different output.

How to ask so you get real answers

Three rules make every prompt below work harder:

1. One failure mode per prompt. Don't ask for "a security review." Ask about one specific hole, get the answer, then move on.
2. Demand evidence. End each prompt with "show me the exact file and line, and quote the code." An agent that can't point at a line is guessing.
3. Ask it to try to break in, not to reassure you. Framing it as an attacker ("how would someone read another user's data?") beats "is the data safe?"

The prompts to hand your agent

Paste these one at a time. Read the answer, then ask the next.

Data access

• "For every database table, tell me whether a signed-out user can read or write it directly through the API, bypassing my app's screens. List each table and quote the rule that protects it, or say there is none."
• "Find every API route that takes a user ID, order ID, or record ID from the request. For each, show me the code that checks the logged-in user actually owns that record. Flag any route that has no such check."

Secrets and keys

• "Search the code and the built client bundle for any secret, service-role key, or key starting with sk_. Tell me which ones ship to the browser. Quote each one and its file."
• "List every secret my app needs, and for each one tell me whether it is read from an environment variable or hard-coded in a file."

Auth

• "Walk me through what happens when a user logs out. Can their old session token still be used afterwards? Show me the code."
• "Is there anything stopping a normal user from making themselves an admin by editing a request or a value in the browser? Show me where the admin check happens."

Payments (if you take money)

• "Show me the code that runs after a successful Stripe payment. Does it verify the webhook signature, and could a user trigger it without actually paying?"

Reliability

• "What does a real user see when a request to my backend fails: a clear message, a blank screen, or a raw error? Show me the error handling for my three most important actions."
• "List every place the app assumes data exists. What renders when a new user has zero rows: an empty state, or a crash?"

The trap to avoid

Do not run one giant prompt like "do a full security, performance, and reliability audit of my app." You will get a tidy, confident summary that skims everything and verifies nothing, and you will trust it because it looks thorough. Breadth without evidence is exactly how real holes survive a review. Ask narrowly, one thing at a time, and make the agent quote the code each time. If it can't, that is your answer.

Where this fits

These prompts get you a long way, and they are worth running before your first users arrive. Their limit is the same one they started with: your agent is still reviewing its own work, and it doesn't know which gaps actually sink a beta. The free Readiness Report runs this kind of adversarial check against your real project and ranks what a stranger would hit first, and the Finishing Pass hands you the fixes in order. If you are still deciding what "done" even means here, start with what a working demo doesn't tell you and how to test an app only you have ever used.