Skip to content
</>VibeCoder
security

Run a focused security review on a feature before shipping

Runs a practical, scoped security review of a specific feature or endpoint — checking auth, input validation, and data exposure before it ships.

Browse AI coding toolsSee more prompts
Who should use this

Is this prompt for you?

  • Developers about to ship a feature that touches user data, auth, or payments
  • Solo founders without a dedicated security team who still need a baseline review
  • Teams that want a consistent pre-merge security checklist for AI-generated code specifically
The prompt

Copy this prompt

Prompt
Do a focused security review of the following code before I ship it. Be specific and practical — cite the exact line or block for every issue, don't give generic security advice.

Code: [paste the endpoint, server action, or feature code]
Context: [what this code does, who can access it — e.g. "authenticated users only", "public endpoint", "admin-only"]
Stack: [language/framework, database, auth library]

Check specifically for:
1. Authentication & authorization: is every sensitive action actually checked against the current user's identity and permissions, not just assumed from the client? Any place where an ID from the request body/URL is trusted without verifying ownership?
2. Input validation: is every input validated for type, length, and format server-side (not just client-side)? Any place raw user input reaches a database query, shell command, file path, or HTML output?
3. Injection risks: SQL/NoSQL injection, command injection, path traversal, and XSS — flag any string concatenation into a query, shell command, or unescaped HTML output
4. Data exposure: does any response return more data than the caller needs (e.g. full user objects including password hashes or internal fields)? Are error messages leaking internal details (stack traces, query text) to the client?
5. Secrets handling: any hardcoded keys, tokens, or credentials, or secrets logged in plaintext?
6. Rate limiting / abuse: is this endpoint protected against being called in a tight loop (brute force, scraping, resource exhaustion)?
7. CSRF/session handling if this is a browser-facing form or state-changing GET request

For each issue found, rate it Critical / High / Medium / Low, explain the actual exploit scenario in plain language, and give the specific fix. If you find nothing in a category, say so explicitly rather than omitting it — I need to know what was actually checked.

This review is a starting point, not a substitute for a professional security audit on anything handling payments or sensitive personal data.

Works well with Claude Code, Cursor and OpenAI Codex.

How to use it

Getting the best result

  1. 1Paste the real code, including the surrounding auth/middleware layer, not just the handler function in isolation
  2. 2State exactly who should be able to access this feature — authorization bugs are invisible without that context
  3. 3Fix Critical and High issues before merging; treat Medium/Low as a backlog, not something to ignore silently
  4. 4For anything involving payments or regulated personal data, treat this as a first pass and get a human security review too
Expected result

What you should get back

  • A category-by-category review covering auth, input validation, injection, data exposure, secrets and rate limiting
  • Explicit confirmation of what was checked and found clean, not just a list of problems
  • Each issue rated by severity with a plain-language exploit scenario and a specific fix
  • A clear statement that this isn't a substitute for a professional audit on sensitive systems
Tips

Get more out of this prompt

  • Always include the authorization/middleware layer in the code you paste — most real authz bugs live at that boundary, not inside the handler
  • Ask for the exploit scenario in plain language for every finding — it's much easier to judge real severity that way
  • Re-run this review after any change to auth, input handling, or data access, not just once at initial launch
Common mistakes

What to watch out for

  • Reviewing only the business logic function and missing that authorization is checked (or not checked) one layer up
  • Treating every finding as equally urgent instead of triaging by real severity and exploitability
  • Assuming an AI security review replaces a professional audit for anything handling payments or regulated data
Related prompts

Keep going

api

Integrate a third-party API with proper error handling and retries

Gets an AI to build a production-grade API client — authentication, retries, rate limiting, and typed responses — instead of a bare fetch call.

Copy promptdatabase

Design a normalized SQL schema with indexes and constraints

Turns a plain-language description of your data into a normalized SQL schema with sensible indexes, foreign keys, and constraints.

Copy promptsaas

Scope and build a SaaS MVP feature end-to-end

Turns a rough SaaS feature idea into a scoped implementation plan and working code, covering data model, backend, UI and edge cases in one pass.

Copy prompt

Ready to put this prompt to work?

Pair it with an AI coding tool and a real project, then ship something this week.

Browse AI coding toolsSee a project to build