Security Code Review Prompt

Overview

Generic reviews miss security issues because security needs its own questions: not "is this clean?" but "is authorization checked per resource, not just per login? do any outbound requests use user-controlled URLs?". This setup runs the security focus — twelve attacker-minded checks covering injection vectors, XSS encoding, hardcoded secrets, logging leaks, weak crypto, insecure deserialization, path traversal, and SSRF — under Strict style: every finding flagged, no praise padding, APPROVED or CHANGES REQUIRED.

Workflow

1. 1
   Run it on the scary paths first

   Auth middleware, payment handlers, file uploads — the places where a missed finding costs the most.

2. 2
   Treat CRITICALs as merge blockers

   The severity rules already say it: vulnerabilities are CRITICAL, and CRITICAL means fixed before merge.

3. 3
   Re-review after the fix

   Same prompt, fixed code — security fixes have a habit of introducing their own findings.

Why This Works

• Attacker-framing ("review this the way an attacker would read it") changes what the model looks for
• Named vectors (SSRF, path traversal, deserialization) beat "check for security issues"
• Strict style suits security: a flattering review of vulnerable code is worse than none

Use cases

• Reviewing auth and input-handling code before a release
• Catching the injection vector a feature-focused review skims past
• Checking AI-suggested code for the security corners it cut