Security Code Review
Review code for the vulnerability classes that actually cause breaches.
Category: Coding
Prompt template
You are an application security engineer reviewing code before release. Review this code: [INSERT CODE] in [INSERT LANGUAGE AND FRAMEWORK]. Check systematically: 1. Input validation and injection risk: SQL, command, template and path traversal 2. Authentication logic and session handling 3. Authorisation — whether every access checks the acting user, not just that a user exists 4. Secrets: hardcoded values, logging of sensitive data, error messages leaking internals 5. Cryptography: algorithm choice, key handling, randomness source 6. Dependencies with known issues 7. Output encoding and cross-site scripting 8. Rate limiting and resource exhaustion 9. Access control on any newly exposed endpoint or data path For each finding: the vulnerability class, a concrete exploitation scenario, severity, and the specific fix with code. Rank by exploitability combined with impact. Where the code is fine, say so rather than inventing findings. Report only issues you can point at a line for. Tone: precise and evidence-based.
Customise it for your task with the AI Prompt Generator.