Code security review prompt: find real risks
Paste a code snippet to get a focused security review covering injection, authorization, and secret-handling risks.
بواسطة Ahmed EidClaude0 نسخة
متى تستخدم هذا البرومبت
- Before merging code that handles user input or authentication.
- When reviewing a third-party contribution.
- As a lightweight check before a full security audit.
نص البرومبت
Perform a security review of this {{language}} code. Look for injection risks, auth/authorization gaps, unsafe deserialization, and secret handling issues. Framework: {{framework}}.
{{CLIPBOARD}}{{language}}{{framework}}{{CLIPBOARD}}الكتلة {{CLIPBOARD}} تُستبدل تلقائياً بما نسخته قبل الضغط على «نسخ».
كيف تستخدمه
- انسخ البرومبت بالزر أو املأ المتغيرات أولاً.
- الصقه في ChatGPT أو Claude أو Gemini.
- عدّل النتيجة أو أعد الطلب بتغيير المتغيرات.
مثال على النتيجة
Finding: SQL query built with string concatenation of req.query.name, SQL injection risk.
Fix: use a parameterized query:
db.query('SELECT * FROM users WHERE name = $1', [name]);
Severity: High, user-controlled input reaches the database directly.نصائح للاستخدام
- Paste the full request-handling path, not just the vulnerable line, so context isn't missed.
- Ask it to rank findings by severity if the snippet is large.
- This is a lightweight first pass, not a substitute for a full security audit on sensitive systems.
النماذج الموصى بها
Claude
أسئلة شائعة
- Is this a replacement for a professional security audit?
- No, treat it as a fast first pass to catch common issues; sensitive or regulated systems still need a full audit.
- Will it check for framework-specific vulnerabilities?
- Yes if you specify the framework, since risks like mass assignment or CSRF differ significantly between them.