OWASP security audit of a code snippet

Prompt

Act as an application security engineer specializing in secure code review and the OWASP Top 10.

Context:
- Language and framework: {{language}}
- What this code does and where it runs: {{context}}
- Exposure: {{exposure}}
- Code to review:
```
{{code}}
```

Deliverables:
1. A 3-line executive summary: overall risk level and the most urgent finding.
2. A findings table: ID, affected line or snippet, OWASP Top 10 category and CWE where applicable, severity (critical, high, medium, low) justified by the exposure, and confidence level.
3. For each finding: why it is vulnerable and an abuse scenario described conceptually, without ready-to-use exploit payloads.
4. Complete fixed code using the idiomatic defenses of {{language}} (parameterized queries, contextual output encoding, allow-list validation, server-side access control, safe secret handling).
5. Automated tests proving the fix works, including typical malicious inputs.
6. Defense-in-depth measures outside the code (headers, least privilege, logging and alerting).

Constraints:
- Do not flag something as vulnerable unless you can justify it; if it depends on code I have not shown, mark it [FILL IN: confirm] and explain what to check.
- Also point out what is done well so it is not broken during the fix.
- If key context is missing (authentication, where the input comes from), ask me first.
- This review is guidance only: for production systems handling sensitive data, recommend a professional audit or penetration test.

Format: summary, table, per-finding detail, fixed code and tests.

How to use it

Usage example

Sample output

app.get('/invoices/:id', requireAuth, async (req, res, next) => {
  // Allow-list: positive integers only
  if (!/^[1-9]\d{0,9}$/.test(req.params.id)) {
    return res.status(400).json({ error: 'invalid_id' });
  }
  try {
    // Parameterized query (node-postgres syntax: [FILL IN: confirm driver])
    const { rows } = await db.query(
      'SELECT id, number, issued_at, total, status FROM invoices WHERE id = $1 AND user_id = $2',
      [req.params.id, req.user.id],
    );
    // 404 whether it is missing or someone else's: does not reveal which ids exist
    if (rows.length === 0) return res.status(404).json({ error: 'not_found' });
    return res.json(rows[0]);
  } catch (err) {
    return next(err);
  }
});

Key facts

Category

Programming & development · Debugging

Output type

Code

Level

Advanced

Designed for

ChatGPT, Claude, Gemini and Microsoft Copilot

Verified in

Pending editorial verification

Variables

Language and framework, What it does and where it runs, Exposure and Code

Language

English

Price

Free, no sign-up

Updated

Nov 7, 2026

Frequently asked questions