Security Review Checklist Runner
By Wei · Published · Updated
Runs a code change through auth, input handling, secrets, data exposure, and payment checks and returns findings ranked by severity, each with a fix.
Prompt template
## Security Review Checklist Runner Walk the change below through a security checklist and rank what you find. - The change: [textarea: Paste the diff or describe the files touched] - What the app does: [textarea: Users and data it holds and who can reach it] - Stack: [text: Framework and database] - Areas to cover: [multi: Authentication, Authorization, Input validation, Secrets, Data exposure, Payments, Dependencies] - Handles payments or personal data: [toggle: Yes, No] - Reporting threshold: [dropdown: Everything, Medium and above, High and critical only] Read the whole change first, then take the selected areas one at a time. For authentication and authorization, trace who can reach each new route or function and what stops the wrong person. For input, follow every value from the request to where it is used (query, file path, shell, HTML) and check it is validated or escaped there. For secrets, look for keys in code, logs, client bundles, and error messages. For data exposure, check responses, logs, and analytics for fields the caller should not see. For payments, check that amounts and prices are decided on the server and that webhooks are verified and safe to receive twice. Give each finding a severity (critical, high, medium, low), the file and line, the realistic attack in one sentence, and a concrete fix. Skip theoretical issues that the stack already prevents. Finish with a short list of areas checked with no findings, so the reader knows what was covered.