10 Prompts for Security and DevSecOps: Audit, Scanning, and Policies

You are a senior security engineer. Review the following Python function for SQL injection, command injection, and path traversal vulnerabilities. For each issue found, provide:
- Line number
- Vulnerability type (CWE ID)
- Severity (Critical/High/Medium/Low)
- Remediation code

Code:
import sqlite3
def get_user(user_id):
    conn = sqlite3.connect('users.db')
    query = f"SELECT * FROM users WHERE id = {user_id}"
    return conn.execute(query).fetchall()

Generate 10 test payloads for DAST on a REST API endpoint `POST /api/login`. Include payloads for:
- SQL injection (e.g., `' OR 1=1--`)
- XSS (e.g., `<script>alert(1)</script>`)
- NoSQL injection (e.g., `{"$ne": null}`)
- Path traversal (e.g., `../../../etc/passwd`)
- Command injection (e.g., `; ls -la`)

Format as a JSON array of objects with fields: "payload", "attack_type", "expected_behavior".

[
  {"payload": "' OR '1'='1", "attack_type": "SQLi", "expected_behavior": "HTTP 200 with all users returned"},
  {"payload": "<script>alert('xss')</script>", "attack_type": "XSS", "expected_behavior": "Script reflected in response"}
]

Analyze this package.json dependencies for known vulnerabilities. Use NVD and Snyk advisory databases (as of July 2026). For each vulnerable package, list:
- Package name and version
- CVE ID and CVSS score
- Fixed version
- Impact

Dependencies:
{
  "express": "4.17.1",
  "lodash": "4.17.20",
  "axios": "0.21.1"
}

You are a cloud security expert. Review this Terraform snippet for security misconfigurations following the CIS AWS Foundations Benchmark v2.0. Check for: open security groups, unencrypted S3 buckets, and public access to RDS.

resource "aws_s3_bucket" "data" {
  bucket = "my-data-bucket"
  acl    = "public-read"
}

resource "aws_security_group" "web" {
  ingress {
    from_port = 22
    to_port   = 22
    protocol  = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Create an AWS IAM policy with least-privilege permissions for a CI/CD role that needs to:
- Deploy EC2 instances (RunInstances, TerminateInstances)
- Push images to ECR (PutImage, BatchCheckLayerAvailability)
- Describe CloudFormation stacks

Use explicit deny for all other actions. Format as a JSON policy document.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["ec2:RunInstances", "ec2:TerminateInstances"],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["ecr:PutImage", "ecr:BatchCheckLayerAvailability"],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["cloudformation:DescribeStacks"],
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "NotAction": ["ec2:*", "ecr:*", "cloudformation:DescribeStacks"],
      "Resource": "*"
    }
  ]
}

Review this Kubernetes Role for security best practices. Identify any permissions that violate the principle of least privilege. Suggest a restricted version.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
rules:
- apiGroups: [""]
  resources: ["pods", "secrets"]
  verbs: ["get", "list", "watch", "create", "delete"]

Generate a 10-item GDPR compliance checklist for a web application that processes user email addresses and browsing history. Include: data minimization, consent management, right to erasure, and breach notification. For each item, provide a description and a test command (e.g., curl or SQL query) to verify compliance.

Write a concise incident response playbook for a suspected database breach in a production environment. Cover:
1. Immediate containment (isolate server)
2. Evidence collection (logs, database dumps)
3. Communication plan (who to notify)
4. Remediation steps (rotate credentials, patch vulnerability)
5. Post-mortem analysis

Use the NIST Incident Response Framework (SP 800-61 Rev 2).

Perform a STRIDE threat model on a microservice that handles payment transactions. The service:
- Accepts credit card data via REST API
- Stores tokenized data in a vault
- Communicates with a fraud detection service via gRPC

For each threat type (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), provide one concrete example and a mitigation.

Create a checklist of 15 security checks for a peer code review. Cover OWASP Top 10 categories: injection, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, cross-site scripting, insecure deserialization, using components with known vulnerabilities, insufficient logging. For each check, provide a one-sentence question the reviewer should ask.