Auth and Input Security Auditor
Paste code that touches auth, payments, or user data for an OWASP-style scan of the most common real-world vulnerabilities. - Checks injection, session and privilege issues, data exposure, weak validation, and crypto mistakes - Each finding includes an attack scenario, severity rating, and the exact fix - Not a substitute for a real penetration test, but catches the obvious holes fast
Prompt
Security audit this code:
{{code}}
Check for:
1. Injection: SQL, NoSQL, command, LDAP
2. Auth/AuthZ: Session handling, privilege escalation, token issues
3. Data exposure: Logging secrets, error messages, API responses
4. Input validation: Missing sanitization, type coercion, length limits
5. Cryptography: Weak algorithms, hardcoded secrets, improper key handling
For each finding:
- Severity: Critical / High / Medium / Low
- Attack scenario: How would someone exploit this?
- Fix: Specific code change needed
- Reference: Relevant OWASP/CWE if applicable
Assume an attacker with knowledge of our stack.