Content Security Policy
Cut script-injection risk with a policy the existing app can actually run under.
What it adds
A CSP built from an inventory of what the app really loads, rolled out in report-only mode before it is enforced.
What your agent is told to do
5
What your agent is told to do
5-
1
Inventory first: every inline script and style, every third-party origin, every worker, frame, font, and image host the app loads. Report that list before writing a single directive.
-
2
Add a per-response nonce to the inline scripts you must keep, and hashes for the ones you cannot make dynamic.
-
3
Deploy in report-only mode, collect violations from real traffic for long enough to cover the slow paths, and only then enforce.
-
4
Set a violation report endpoint that deduplicates by directive and blocked URI, so one broken third-party script does not produce a million rows.
-
5
Do NOT reach for unsafe-inline or unsafe-eval to make the errors stop. A policy with unsafe-inline on script-src provides essentially none of the protection you added it for.
Edge cases it handles
6
Edge cases it handles
6- Asset hosts, API origins, and analytics domains differ between development, staging, and production — generate the policy per environment.
- Browser extensions inject scripts and will generate violation reports you cannot fix. Filter them out or they will drown the real signal.
- Some third-party scripts load further scripts at runtime; the origin you allowlist is rarely the only one they need.
- Violation reports can include URL fragments and query strings — strip anything sensitive before storing them.
- The nonce must be unique per response and never cached; a cached page with a stale nonce blocks its own scripts.
- Blocked content usually fails silently for the user. Watch error rates as well as reports when you flip to enforcing.
Definition of done
8
Definition of done
8- The policy is derived from an inventory of actual app dependencies.
- Inline scripts use per-response nonces or hashes; unsafe-inline is not present on script-src.
- A report-only rollout preceded enforcement, with violations reviewed.
- A deduplicating report endpoint exists and filters extension noise.
- Policies differ correctly by environment.
- No sensitive data is retained in stored violation reports.
- The feature matches the existing design system.
- No existing functionality is broken.
Related features
Rate Limiting
Rate Limiting
Stop one client from ruining it for everyone.
What it does
Throttling on the endpoints that get abused: auth, search, exports, and public forms.
How it works
- 1 Identify the endpoints worth protecting: sign-in, sign-up, password reset, search, exports, and anything unauthenticated.
- 2 Limit by a stable identifier — user ID where signed in, IP otherwise. Be aware IP is shared behind NAT and proxies.
- 3 Return 429 with a Retry-After header. Do not silently drop the request.
Copy the prompt
No account needed
Add this feature to my app:
https://addthisfeature.com/x/rate-limiting
Password Generator
Password Generator
Offer a strong password in one click wherever someone sets or changes credentials.
What it does
A generate control on password fields that produces a strong value, shows it, and hands it to the user safely.
How it works
- 1 Add the control to every place a password is set: sign-up, password change, password reset completion, and any admin screen that provisions credentials for someone else.
- 2 Generate the value in the browser using the platform's cryptographic random source. The value must never be produced on the server or sent anywhere.
- 3 Reveal the generated password by default so the user can record it, and offer a regenerate control beside it. A hidden generated password that the user cannot see is a password they will immediately reset.
Copy the prompt
No account needed
Add this feature to my app:
https://addthisfeature.com/x/password-generator
Data Integrity Constraints
Data Integrity Constraints
Enforce your important rules in the database, not just in the form.
What it does
Database-level uniqueness, foreign key, check, and not-null constraints backing the business rules the application currently only validates in code.
How it works
- 1 Inventory the rules the app relies on — required fields, uniqueness, valid enum values, positive amounts, referential links — and note which exist only in application code.
- 2 Before adding each constraint, query for rows that already violate it and decide explicitly whether to fix, delete, or exclude them. Every mature database has violating legacy rows.
- 3 Add constraints in a way that does not hold a long exclusive lock: create indexes concurrently, add checks as NOT VALID and validate them in a second step.
Copy the prompt
No account needed
Add this feature to my app:
https://addthisfeature.com/x/data-integrity-constraints
How it works
-
1
Copy the link
Grab the Markdown instruction URL for this feature.
-
2
Give it to your AI
Paste it into Claude Code, Cursor, v0, Lovable — whatever you build with.
-
3
It inspects, then implements
Your agent reads your existing app first, then adds the feature to fit it.
Works with your stack
These instructions are written to adapt. They tell the agent to detect your framework, match your existing design system, and reuse what you already have — rather than assuming a particular stack.
Need it tighter than that? Customize the feature and tell it exactly what you're running.