مكتبة الأوامر

Audit every table in this project's database. For each table: 1) confirm Row Level Security is enabled, 2) list the existing policies, 3) write the missing policies so a signed-in user can only read and change their own rows (match on the user id column), and admins are handled by an explicit role check. Output one SQL migration wrapped in BEGIN; ... COMMIT;. Do not disable RLS anywhere. List any table you could not secure and why.

Search the whole codebase for secret keys or tokens used in code that runs in the browser (anything with service_role, secret, sk_, or private in the name, and any env var exposed with a public prefix that holds a secret). For each one, move the call into a server route or server function, read the key from a server-only env var, and update the client to call the new route. List every key that must now be rotated.

List every API route and server action. For each, check that it reads the signed-in user on the server, refuses anonymous requests where needed, and verifies the user owns or may access the record before reading or writing. Never trust an id sent from the client alone. Fix every route that fails and show me a table: route, what it checked before, what it checks now.

Add rate limiting to sign-up, login, password reset, contact forms and any endpoint that sends email or calls a paid API. Limit per IP and per account, store counters somewhere that works across serverless instances (database or a key-value store, not memory), and return 429 with a Retry-After header. Add a bot check on sign-up.

Set up a nightly backup of the production database to storage outside the main project (a different provider or account), keeping 14 days. Write a RESTORE.md with the exact commands to restore into a fresh test project, then walk me through doing it once and timing it.

Make every server error and unhandled client error go to one place I check daily, with the route, user id (no personal data) and a short message. Send me an instant alert (email or messaging) when login, payment or the main page fails more than 3 times in 10 minutes. Show users a friendly error page, never a stack trace.

List every paid service this app uses. For each one: the pricing unit (users, GB, requests, tokens), our current usage, the free-tier limit, and the feature in our code that drives it. Then point out the three changes that would cut the bill most (caching, smaller images, cheaper AI model for simple tasks, pagination) and set a spending alert on each provider.

Add Arabic as a second language. Set lang and dir on the html element on the server from a cookie or the URL (never flip it after the page loads). Replace left/right CSS with logical start/end equivalents, keep numbers, prices and phone numbers left-to-right, mirror only directional icons (arrows, chevrons), load an Arabic font on its own variable, and put every user-facing string in one dictionary per language.