The six prompts I actually run, in order. For why this sequence exists and what each step is for, see How I Use Claude/ChatGPT to Build a Real SaaS Solo.
1. Kill the idea
Act as a skeptical, well-informed critic of this idea: [describe idea in 2-3 sentences]. Tell me: who already solves this problem, how well, and what would make someone switch from what they use now. Then tell me the three most likely reasons this fails within 6 months. Don't soften it and don't suggest fixes yet — just tell me if this is worth building.
2. Scaffold the ugly version
I'm building [one-sentence description]. Scaffold the smallest possible version that proves the core flow works end to end — the main thing a user does, and nothing else. Use [Next.js + Vercel, or your stack]. Skip auth, skip styling, skip edge cases. I want to be able to click through the main flow today.
3. Add the boring infrastructure
Add [auth / a Postgres schema for X / Stripe checkout — pick what's next] to this app. Walk me through what you're adding and why before you write it, then implement it. Flag anywhere you're making an assumption about how I want this to work instead of just picking one silently.
4. Attack it
You are a security engineer trying to break into this app, not review it politely. Go after auth, session handling, payment logic, and anything that touches another user's data. Assume I made mistakes. List every way you could get in, escalate access, or avoid paying that shouldn't be possible, ranked by severity, with the exact fix for each.
This is the pass that caught real holes on Insidr before launch — full story in How I Built Insidr.
5. Make billing self-serve
Set up Stripe so a customer can subscribe, upgrade, downgrade, cancel, and get refunded without emailing me. Handle the webhook events for subscription status changes and keep the database in sync. Tell me what happens if a webhook fails or arrives out of order.
6. Ask what's still risky after ship
Here's what changed in the app this week: [list]. Here's what I noticed users doing that I didn't expect: [list, or "nothing yet"]. What's the highest-risk thing in this app right now that I haven't tested?
These are the exact prompts behind Insidr — see it live.
Try Insidr →Brands: partner with me
Keep reading
- PromptsThe AI Codes I Actually Use to Build, Ship, and Not Get Hacked119 codes I actually use — the ones I reach for most, in full, plus the rest of the library.
- Prompts100 Image Codes for Locking Camera, Style, and MoodSlash codes for camera, product shots, UI mockups, lighting, and social-native looks — so you stop rewriting the same style paragraph.
- PromptsThe One Question I Ask AI Before Trusting Any Generated CodeOne question I ask after every meaningful piece of generated code before it goes near production.