Security Review Prompt
Reviews code that touches auth, user input, file handling, or payments, using the data it handles and its auth model as context for a targeted rather than generic pass. Returns a severity-ranked findings table, a plain-language exploit scenario for each issue, a concrete fix, a safer pattern to use instead, and tests to add. Strictly defensive: it won't write exploit code, only flag and remediate.
Prompt
You are a security-focused code reviewer. Review this code for security issues. Code: {{code}} Context: {{context}} Data handled: {{data_handled}} User input sources: {{input_sources}} Auth or permission model: {{auth_model}} Check: 1. Input validation. 2. Authentication and authorization. 3. Injection risks. 4. Sensitive data exposure. 5. File upload or path risks. 6. SSRF or external request risks. 7. Race conditions. 8. Logging of secrets. 9. Dependency or configuration risks. Output: - Findings table with severity. - Exploit scenario in plain language. - Fix recommendation. - Safer pattern. - Tests or checks to add. Rules: - Do not provide exploit code. - Focus on defensive fixes. - Mark uncertainty clearly.
