15 Words to Put in Your App Prompt, and the One That Stops Your Database Being Readable
An AI coding tool builds exactly what you describe, so describe more than the screens. Fifteen words that change what Claude Code, Codex, Cursor or Grok builds for you, from empty states to undo. The last one, row-level security, is the one a security firm found missing on 16,326 Supabase databases with tables anyone could read.
Ask an AI tool for a pantry app and you get a list of groceries. Ask for a pantry app with an empty state, skeleton loading and offline-first, and you get an app that feels finished. The tool builds what the prompt names. The words below are the ones that name the parts people forget.
The 15 words
- Empty state: what a new user sees with no data. A next step, not a blank screen.
- Skeleton loading: grey placeholders while data loads, so the app never looks frozen.
- Error states, with a retry: a plain message and one button, not a silent failure.
- Offline-first: it works on a train with no signal and syncs later.
- Pull to refresh: the gesture people already try.
- Haptics: a small buzz on taps that matter.
- Dark mode.
- Accessibility labels: so a screen reader says "Rice, 2 kilos, expires Friday", not "button".
- Input validation: catch "abc" in a quantity field before it reaches the database.
- Rate limiting: stop a login or OTP screen being hammered.
- Pagination: load 20 at a time, not all 2,000.
- Undo: for deletes, instead of a scary confirm dialog.
- Localization: the strings ready for Hindi or Spanish from day one.
- Secret keys on the server: payment and AI keys never ship inside the app.
- Row-level security: each user can only reach their own rows.
Why the last one matters most
A security firm, UpGuard, checked about 300,000 sites using Supabase, a popular backend for AI-built apps, and found 16,326 databases with tables anyone could read. Over half showed signs of personal data, judged from the tables' column names. Supabase itself wasn't breached: the tables were readable because of how they were set up.
A table in an exposed schema without RLS is readable and writable by any role with a grant on it.
— Supabase documentation
The key inside your app is public on purpose; Supabase's docs say it only reaches what row-level security allows. So the lock is the policy, not the key. In February 2026 a researcher at Wiz found the database of Moltbook, an app whose founder said he didn't write a line of code, open to read and write, with 1.5 million API tokens and 35,000 email addresses in it.
Supabase changed its default on 30 October 2026: new tables in existing projects are no longer opened to its Data API automatically, because, in its words, agents and AI platforms create tables too. Tables that were already open stay open, so check yours.
What it can cost
In the EU, weak security can cost up to 10 million euros or 2% of global turnover under the GDPR, and a breach has to be reported within 72 hours. India's data protection law allows fines up to ₹250 crore for failing to protect personal data, from May 2027. In the US, the FTC took action against Chegg in 2022 over a cloud database reached with a shared login.
This is the long version of One Prompt App #01, a reel for @buildjayy on Instagram. If you're building an app and want a second pair of eyes on its security before launch, send me the word BUILD there, or start with the brief form on the front page.
Sources: UpGuard, 2026, on exposed Supabase databases; Supabase's documentation on Row Level Security, its database advisor rule 0013, its API keys page and its changelog of 30 October 2026; Wiz, 2 February 2026, on Moltbook; the GDPR, Articles 32, 33 and 83; India's DPDP Act, section 8(5), via AZB & Partners; and the FTC on Chegg, 31 October 2022.
- 4 Nov 2026
- Published, with the reel.
Product builder from Surat. Ships his own apps, runs live broadcasts, and takes on a few founders a year for product, brand and growth. hey@jaybutani.com