Tools / 02
PRD generator
Seven questions in, one build-ready spec out — with the security requirements AI tools forget already written in.
Output / PRD.md
Fill the form and press Generate — your PRD appears here. Why specs beat vibes, even when vibing
The quality ceiling of an AI-built app is set before the first prompt: tools like Lovable and Bolt build exactly what you describe and quietly improvise everything you don't. The improvised parts are never the buttons — they're the boundaries. Who can see which rows? What happens when payment fails halfway? What's deliberately not in version one? Those unglamorous answers are what separate apps that survive review from apps that need rescue.
This generator is deliberately dumb — pure templating, no AI. Its value is the structure: it forces the six decisions that matter, phrases your features as verifiable user stories, splits the build into phases small enough to test, and injects a non-negotiable security section (server-side auth, RLS, no client-side secrets) so the tool builds security in rather than you bolting it on. Teams I work with see dramatically fewer fix-it loops when the first prompt is a document instead of a sentence.
Workflow that works: generate, read it once and fix anything wrong (it's your product, not mine), paste it in, and build one phase at a time. When the app exists, come back and run the security checklist against what got built.
FAQ
Questions people ask
- Why does a better prompt/PRD matter for AI builders?
- AI tools build exactly what you describe and improvise everything you leave out — and the improvised parts (auth rules, error states, data boundaries) are where apps fail. A structured PRD front-loads those decisions, so the tool builds them in instead of you retrofitting them.
- Is this sent to an AI? Where does my idea go?
- Nowhere. This is pure templating in your browser — no API calls, no storage. Your idea exists in the text boxes and the generated markdown, nothing else.
- How do I use the output in Lovable, Bolt, or Claude Code?
- Paste the whole document as your first message. In Lovable/Bolt, follow with "build phase 1 only" so it works in slices you can verify. In Claude Code or Cursor, save it as PRD.md in the repo and reference it in your prompts.
- Why does the generated PRD include security requirements I didn’t enter?
- Because you shouldn’t have to know them. The template injects the non-negotiables — server-side auth checks, RLS, no client-side secrets, input validation — every time. That section is the difference between this and a blank prompt.