Run a Security Review on Code

This prompt runs an AppSec-style pass over a code snippet, checking a fixed list of high-impact categories — injection, auth/authz, data exposure, dependency hygiene, and the broader OWASP Top 10 — and returns each finding with a severity rating and a concrete fix. Use it as a fast first-pass review before a human security sign-off, or to sanity-check code you've inherited. The structured checklist matters: it stops the model from fixating on one obvious bug while missing the authorization hole next to it.

What you can expect back

Finding 1 — SQL Injection (Critical)
req.query.name is interpolated directly into the query string. An attacker can send ?name=' OR '1'='1 to dump all rows or worse.
Fix:
  const q = 'SELECT id, name, email FROM users WHERE name = ?';
  db.query(q, [req.query.name], ...);

Finding 2 — Sensitive Data Exposure (High)
SELECT * returns every column (e.g. password_hash) and res.send leaks it to the client. Select only needed columns.

Finding 3 — Improper Logging (Medium)
console.log of full rows may write PII to logs. Log a row count, not the data.

Finding 4 — Missing AuthZ (High)
The route has no authentication or authorization check; any caller can query users.

Illustrative example — your results will vary by tool and inputs.

Get sharper results

• 01Include the surrounding context the snippet depends on — the auth middleware, ORM config, or framework version — because many real vulnerabilities live in how pieces connect, not in the function alone.
• 02Ask it to rank findings by exploitability in your specific deployment (public internet vs. internal-only) so you don't waste a sprint fixing a Low before a Critical.
• 03Treat dependency findings as leads, not verdicts — the model can't see your lockfile, so have it tell you which packages to manually check with npm audit or pip-audit.
• 04Request a short 'what this review can't catch' note; LLM review misses logic flaws, race conditions, and anything requiring runtime state, so you still need real tooling and a human.
• 05For larger files, paste one module at a time — a giant dump dilutes attention and the model starts skimming.

Adapt it for your case