coding · PromptZap Team

Security-Minded Code Audit

Reframes review as threat modeling: every input gets asked 'what if this is malicious?' — with severity-tagged findings and exploit scenarios.

Framework

standard

Model targets

claude, chatgpt, gemini

Prompt text

Review [code/file/PR] as a security analyst doing threat modeling, not a general code reviewer.

For each input the code accepts, ask: what happens if this is malicious, malformed, empty, huge, or unexpected type? Specifically check for:
- Injection risks (SQL, command, template, HTML/XSS)
- Auth/authorization gaps (missing checks, IDOR, trusting client-supplied IDs)
- Secrets or credentials that shouldn't be in code/logs
- Unvalidated redirects, unsafe deserialization, path traversal
- Rate-limiting/DoS exposure on any new endpoint

Output: a numbered list of findings, each tagged Critical/High/Medium/Low, with the exact line and a concrete exploit scenario (not just "this could be unsafe"). End with a prioritized fix order.