OWASP and STRIDE Security Audit
By Marcus Bell · Published · Updated
Audits an application against the OWASP Top 10 and STRIDE threats, returning findings ranked by how easily each can be exploited.
Prompt template
## OWASP and STRIDE Security Audit Audit my application for security weaknesses. - Application summary: [textarea: What it does and who uses it] - Architecture: [textarea: Frontend and backend and database and third parties] - Authentication method: [dropdown: Sessions, JWT, OAuth, API keys, None yet] - Sensitive data handled: [multi: Personal data, Payments, Health data, Credentials, Business secrets] - Code or config to review: [textarea: Relevant files or endpoints] - Audit depth: [dropdown: Quick scan, Standard, Deep] Map the system into entry points, data stores, and trust boundaries. Walk each of the OWASP Top 10 categories against that map and note which apply. Then apply STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) to each trust boundary. For every finding give the location, the attack in two sentences, the preconditions, and the fix. Rank by exploitability first (unauthenticated and remote beats local and privileged), then by impact. Give a severity of Critical, High, Medium, or Low. Do not request or paste real secrets: refer to them by name only. End with the top three fixes to ship first and a list of areas you could not assess.