10 Prompts for Security and DevSecOps: Audit, Scanning, Policies

Introduction

Security is no longer a separate phase in the software development lifecycle — it's embedded into every step. DevSecOps practices help teams catch vulnerabilities early, enforce policies automatically, and maintain compliance without slowing down delivery. However, even with the best tools (SAST, DAST, container scanners), many teams struggle to interpret results and take action. That's where well-crafted prompts come in: they guide AI assistants to produce actionable audit reports, explain scan findings, and suggest policy configurations. This article provides 10 battle-tested prompts you can use today to improve your security posture.

Each prompt includes a real usage example, code snippets, and practical tips. The prompts cover SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), policy enforcement, and compliance auditing. Whether you're a developer, security engineer, or DevOps lead, you'll find prompts that save time and reduce risk.

1. SAST Report Summarizer

Prompt: "Summarize the SAST scan results from [tool] for [project]. List only critical and high-severity findings. For each finding, provide: file path, line number, vulnerability type (OWASP Top 10 category), and a one-line fix suggestion."

Example usage: You run Semgrep or SonarQube and get 200+ findings. Instead of reading each one, use this prompt to get a prioritized list.

Code snippet (input):

Tool: Semgrep
Project: payment-api
Findings (JSON): [
  {"file": "src/process.py", "line": 42, "severity": "critical", "check_id": "python.django.security.injection.sql", "message": "SQL injection in raw query"},
  {"file": "src/auth.py", "line": 18, "severity": "high", "check_id": "python.django.security.audit.weak-password-hash", "message": "Weak password hashing algorithm"}
]

Output (AI response):

Practical tip: Always include the tool name and severity filter — this prevents AI from hallucinating false positives or mixing standards.

2. DAST Vulnerability Explainer

Prompt: "Explain the following DAST finding from [tool] in simple terms: [finding description]. Include: what the vulnerability means, how an attacker could exploit it, and a concrete remediation step for a developer."

Example usage: Your DAST scanner reports a "Cross-Site Request Forgery (CSRF)" on an API endpoint. You need to explain it to a junior developer.

Code snippet (input):

Tool: OWASP ZAP
Finding: CSRF token missing on POST /api/transfer

Output (AI response):
- What it means: The endpoint does not validate whether the request came from your application's UI or from an external malicious site. An attacker can trick a logged-in user into making an unwanted transfer.
- Exploitation: Attacker hosts a fake page with an auto-submitting form to POST /api/transfer. If the victim visits it while authenticated, the transfer executes.
- Fix: Add a unique CSRF token to the form and verify it server-side. In Django: use {% csrf_token %} in templates and CsrfViewMiddleware.

Practical tip: For REST APIs, recommend using anti-CSRF headers (e.g., X-CSRF-Token) or double-submit cookies.

3. Dockerfile Security Linter

Prompt: "Review this Dockerfile for security best practices. Identify: running as root, hardcoded secrets, unnecessary packages, and missing health checks. Provide a corrected version."

Example usage: You have a legacy Dockerfile that runs the container as root. Use this prompt to get a secure rewrite.

Code snippet (input):

FROM ubuntu:latest
RUN apt-get update && apt-get install -y python3
COPY . /app
RUN echo 'password=secret123' > /app/config.txt
CMD ["python3", "/app/main.py"]

Output (AI response):
- Issues found:
1. Running as root (default USER is root)
2. Hardcoded secret in config.txt (should use environment variables or secrets manager)
3. No specific version tag for base image (uses latest, which can change)
4. No health check
- Corrected version:

FROM ubuntu:22.04
RUN apt-get update && apt-get install -y python3 && apt-get clean
RUN groupadd -r appuser && useradd -r -g appuser appuser
COPY . /app
RUN chown -R appuser:appuser /app
USER appuser
ENV APP_SECRET_FILE=/run/secrets/app_secret
HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost:8000/health || exit 1
CMD ["python3", "/app/main.py"]

Practical tip: Always specify exact image versions (e.g., ubuntu:22.04) to avoid supply chain attacks from mutable tags.

4. Kubernetes RBAC Policy Generator

Prompt: "Generate a Kubernetes RBAC YAML for a service account named 'ci-bot' in namespace 'ci'. The bot needs: list and get on pods, create and delete on jobs, and read configmaps. Use least privilege principle."

Example usage: You're setting up a CI/CD pipeline and need a service account with minimal permissions.

Code snippet (output):

apiVersion: v1
kind: ServiceAccount
metadata:
  name: ci-bot
  namespace: ci
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ci-role
  namespace: ci
rules:
- apiGroups: [""]
  resources: ["pods", "configmaps"]
  verbs: ["get", "list"]
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["create", "delete", "get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ci-bot-binding
  namespace: ci
subjects:
- kind: ServiceAccount
  name: ci-bot
  namespace: ci
roleRef:
  kind: Role
  name: ci-role
  apiGroup: rbac.authorization.k8s.io

Practical tip: Always test RBAC with kubectl auth can-i --as=system:serviceaccount:ci:ci-bot list pods before deploying.

5. Terraform Security Scanner

Prompt: "Scan this Terraform configuration for security misconfigurations. Focus on: S3 bucket public access, open security groups, unencrypted storage, and IAM wildcard actions."

Example usage: You wrote a Terraform file to deploy an AWS infrastructure and want to catch common mistakes.

Code snippet (input):

resource "aws_s3_bucket" "data" {
  bucket = "my-data-bucket"
  acl    = "public-read"
}

resource "aws_security_group" "web" {
  ingress {
    from_port = 22
    to_port   = 22
    protocol  = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Output (AI response):
- Misconfigurations:
1. S3 bucket my-data-bucket has acl = public-read — anyone can read objects. Fix: use acl = private and restrict with bucket policy.
2. Security group web opens SSH (port 22) to 0.0.0.0/0 — allow only specific IP ranges (e.g., your office IP).
- Corrected version:

resource "aws_s3_bucket" "data" {
  bucket = "my-data-bucket"
  acl    = "private"
}

resource "aws_s3_bucket_public_access_block" "data" {
  bucket = aws_s3_bucket.data.id
  block_public_acls   = true
  block_public_policy = true
}

resource "aws_security_group" "web" {
  ingress {
    from_port = 22
    to_port   = 22
    protocol  = "tcp"
    cidr_blocks = ["203.0.113.0/32"]  # Replace with your IP
  }
}

Practical tip: Use tools like tfsec or checkov before running terraform apply. Combine with this prompt for explanation.

6. Security Policy Compliance Checker

Prompt: "Given this company security policy: [paste policy text]. Check if the following infrastructure configuration complies. List violations and suggest fixes."

Example usage: Your policy requires all production databases to be encrypted at rest and have automated backups enabled.

Code snippet (input):

Policy: All production RDS instances must have encryption at rest enabled and automated backups with retention >= 7 days.
Configuration:
  resource "aws_db_instance" "prod" {
    engine = "postgres"
    storage_encrypted = false
    backup_retention_period = 3
  }

Output (AI response):
- Violations:
1. storage_encrypted = false — should be true.
2. backup_retention_period = 3 — should be at least 7.
- Fix:

resource "aws_db_instance" "prod" {
  engine = "postgres"
  storage_encrypted = true
  backup_retention_period = 7
}

Practical tip: Store policies as code (e.g., Rego or Sentinel) and integrate with CI to block non-compliant deployments.

7. Secrets Detection in Code

Prompt: "Scan this code for hardcoded secrets: API keys, passwords, tokens, and private keys. List the line number, the type of secret, and the risk level."

Example usage: You're about to commit code and want to ensure no secrets are exposed.

Code snippet (input):

import requests

api_url = "https://api.example.com"
api_key = "sk-1234567890abcdef"
password = "P@ssw0rd!"

def get_data():
    headers = {"Authorization": f"Bearer {api_key}"}
    r = requests.get(api_url, headers=headers)
    return r.json()

Output (AI response):

Suggestion: Move secrets to environment variables and use a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault).

Practical tip: Run tools like trufflehog or git-secrets in your pre-commit hooks to catch secrets before they reach the repository.

8. Incident Response Playbook Generator

Prompt: "Create an incident response playbook for a detected SQL injection attack. Include: detection steps, containment, eradication, recovery, and post-mortem checklist."

Example usage: Your DAST tool alerts on a SQL injection in production. You need a structured response.

Output (AI response):
- Detection: Confirm via WAF logs, database query logs, and DAST alert.
- Containment: Block the attacker IP in WAF; if possible, take the affected service offline or switch to a read-only replica.
- Eradication: Patch the vulnerable code (parameterized queries), rotate database credentials.
- Recovery: Restore data from the last clean backup; validate no backdoors left.
- Post-mortem: Root cause analysis, update SAST rules, add integration tests for injection, review access controls.

Practical tip: Store playbooks in your incident management tool (e.g., PagerDuty, Splunk) and trigger them automatically via alerts.

9. Dependency Vulnerability Report

Prompt: "Analyze this requirements.txt for known vulnerabilities. For each package, list the CVE, severity, and suggested upgrade version."

Example usage: You have a Python project and want to check for vulnerable dependencies before release.

Code snippet (input):

Flask==1.0
requests==2.20.0
Django==2.2

Output (AI response):

Practical tip: Use pip-audit or safety for automated scanning in CI. The AI prompt helps prioritize fixes.

10. CloudTrail Audit Log Analyzer

Prompt: "Analyze these CloudTrail logs for suspicious activity. Look for: root account usage, failed MFA authentication, unusual API calls from new regions, and IAM policy modifications."

Example usage: After a security incident, you need to review logs quickly.

Code snippet (input):

{
  "Records": [
    {
      "eventTime": "2026-07-20T10:00:00Z",
      "userIdentity": {"arn": "arn:aws:iam::123456789012:root"},
      "eventName": "ConsoleLogin",
      "sourceIPAddress": "192.0.2.1",
      "additionalEventData": {"MFAUsed": "No"}
    },
    {
      "eventTime": "2026-07-20T10:05:00Z",
      "userIdentity": {"arn": "arn:aws:iam::123456789012:user/john"},
      "eventName": "PutRolePolicy",
      "sourceIPAddress": "203.0.113.5"
    }
  ]
}

Output (AI response):
- Suspicious events:
1. Root account login at 10:00 UTC without MFA — root should not be used for daily operations. Investigate immediately.
2. IAM policy modification (PutRolePolicy) by user john from IP 203.0.113.5 — verify if this is authorized. If not, revoke the change.

Practical tip: Set up CloudWatch alarms on root usage and policy changes. Use this prompt for quick ad-hoc analysis.

Conclusion

Using these 10 prompts, you can turn an AI assistant into a powerful DevSecOps partner. From summarizing SAST results to generating RBAC policies, each prompt saves time and reduces human error. The key is to provide clear, structured input — always specify the tool, the severity levels, and the desired output format. Experiment with these prompts in your daily workflow, and adjust them to match your organization's policies and toolchain. Remember: security is not a one-time audit, but a continuous practice. Start with one prompt today, and build from there.

For further reading, consult the OWASP Top 10 (owasp.org), NIST SP 800-53, and the AWS Well-Architected Framework Security Pillar.