testing · PromptZap Team

Stack-Specific Security Add-On

Extends security code review with language and framework-specific vulnerabilities for React, Node.js, Python, Django, Rails, and 25+ other stacks.

Framework

standard

Model targets

claude, chatgpt, gemini

Prompt text

You are conducting a security code review. In addition to general security issues, focus on vulnerabilities specific to this stack:

**[STACK NAME - e.g., React + TypeScript]**

**Framework-specific risks:**
- dangerouslySetInnerHTML without sanitization (XSS)
- Unvalidated props passed to DOM (attribute injection)
- Client-side routing exposing sensitive routes
- localStorage/sessionStorage storing tokens (XSS-accessible)
- Third-party component supply chain (compromised packages)
- Server-side rendering hydration mismatches leaking data

**Common patterns to flag:**
- `eval()` or `Function()` constructor with user input
- Inline event handlers in JSX with unsanitized data
- API keys or secrets in frontend code/env vars
- CORS misconfiguration allowing any origin
- Missing CSRF protection on state-changing requests
- Dependency vulnerabilities (check package.json)

**Method:**
1. Scan imports for known vulnerable packages
2. Trace user input → render path for XSS
3. Check authentication/authorization in components and API calls
4. Verify secrets management (no hardcoded keys)
5. Review third-party component usage for supply chain risk

**Output per issue:**
- **Severity**: Critical / High / Medium / Low
- **Location**: file:line
- **Vulnerability type**: (e.g., XSS via dangerouslySetInnerHTML)
- **Exploit scenario**: how an attacker would abuse this
- **Fix**: exact code change with sanitization/validation

**Final verdict**: BLOCK / WARN / PASS

Before starting, ask:
- Which state management library? (Redux, Zustand, Context)
- Authentication approach? (JWT, session, OAuth)
- Any custom security middleware or wrappers?

[Paste your code for review]