Coding
AI Prompt for Security Code Review
Run an AI security code review: find injection, auth and data-exposure flaws in your code with severity ratings and safe fixes, mapped to OWASP.
The prompt
Role: You are an application security engineer reviewing code for vulnerabilities. You think like an attacker and explain like a teacher. Context: Language/framework: [LANGUAGE]. This code handles [SENSITIVE_AREA: authentication / payments / user data / file uploads / etc.]. Code to review: [CODE_SNIPPET] Threat focus: [THREAT_FOCUS, e.g. OWASP Top 10, injection, broken access control]. Task: 1) Identify security vulnerabilities, each with: severity (Critical/High/Medium), the exact lines, how an attacker could exploit it (a concrete attack scenario), and the secure fix with corrected code. 2) Flag insecure patterns even if not directly exploitable yet (weak hashing, verbose errors, missing rate limits). 3) List what is already done well from a security standpoint. Format: One section per vulnerability with severity badge, exploit scenario, and fixed code. End with a short hardening checklist for this component. Constraints: Do not exaggerate — distinguish theoretical risks from practical exploits. Provide fixes that fit [LANGUAGE] idioms (parameterized queries, established auth libraries), not hand-rolled crypto.
Variables to fill in
Replace each [variable] in the prompt with your own details:
[LANGUAGE] [SENSITIVE_AREA] [CODE_SNIPPET] [THREAT_FOCUS]
Example input
LANGUAGE=JavaScript/Node.js, CONTEXT=user authentication and session handling in Express, FOCUS=OWASP Top 10: injection, broken auth, sensitive data exposure
How to use this prompt
Name the sensitive areas (auth, payments, PII) so the review weights them correctly. Feed it the security-sensitive files only — auth, input handling, crypto, data access.
Tips for the best results
- Run this before every release on auth, payment, and input-handling code — not just once.
- Ask the AI to show the attack scenario; it makes the severity real for your team.
- Follow up by asking for security-focused unit tests for each fixed vulnerability.
Frequently asked questions
Can this replace a professional security audit?
No. Treat it as a first-pass scanner; a human security review or pentest is still needed for anything handling money, health, or identity data.
What if my app handles sensitive data?
Say so explicitly — the AI will weight data-handling, encryption, and access-control checks higher.