10 AI Prompts That Turn Code Review into a Security Audit
Every developer knows the sinking feeling: you've just merged a feature, and a security researcher emails you about a SQL injection in your login endpoint. Or worse, the OWASP Top 10 becomes your personal to-do list after a penetration test. Static Application Security Testing (SAST) tools like SonarQube and Semgrep catch many issues, but they generate a flood of false positives. Manual code review is thorough but slow. What if you could use AI as a smart filter—one that understands the context, prioritizes real vulnerabilities, and even suggests fixes?
This is where security-focused prompts come in. By crafting the right instructions, you can turn a general-purpose LLM into a specialized security auditor. In this guide, I'll share 10 battle-tested prompts that I use daily in my DevSecOps workflow. Each prompt includes a real-world example, the problem it solves, and the security principle behind it. Whether you're a solo developer or part of a security team, these prompts will help you catch vulnerabilities before they reach production.
1. The OWASP Top 10 Diagnostic
Prompt: "Act as a senior application security engineer. Analyze the following code for vulnerabilities listed in the OWASP Top 10 (2021). For each vulnerability, provide: 1) The CWE identifier and OWASP category, 2) The line number and code snippet, 3) A realistic exploit scenario, 4) A concrete fix using secure coding practices. Code: [paste code]"
Example: I used this on a Django view that handled file uploads. The AI immediately flagged a path traversal vulnerability (CWE-22) in the filename handling, which could allow an attacker to overwrite arbitrary files. It also suggested using os.path.basename() and a whitelist of allowed extensions. The fix was implemented in minutes.
Why it works: The prompt explicitly references OWASP Top 10, which is the industry standard for web application security. By asking for CWE identifiers, you get a structured output that you can directly map to your vulnerability management system.
2. The SAST False-Positive Filter
Prompt: "You are a security analyst reviewing SAST scan results. The tool flagged the following issue: [paste issue]. Analyze the code context: [paste code]. Determine if this is a true positive or false positive. Provide your reasoning and, if it's a true positive, suggest a fix. If it's a false positive, explain why."
Example: A SAST tool flagged a potential SQL injection in a parameterized query. The AI analyzed the code and found that the query used ParameterizedQuery from psycopg2, which safely escapes inputs. It correctly classified it as a false positive, saving the team hours of investigation.
Why it works: SAST tools often lack context. This prompt gives the AI both the tool's output and the actual code, allowing it to reason about data flow and parameterization.
3. The Dependency Vulnerability Checker
Prompt: "Act as a supply chain security expert. Review the following dependency list from package.json/requirements.txt: [paste list]. For each dependency, identify known CVEs (with CVE IDs), the severity, and the fixed version. Prioritize vulnerabilities that are actively exploited in the wild. Suggest a remediation plan."
Example: For a Node.js project, the AI flagged lodash with CVE-2021-23337 (high severity, prototype pollution) and recommended upgrading to version 4.17.21. It also noted that the version in use was 4.17.20, which was vulnerable. The prompt saved us from a potential RCE.
Why it works: The prompt asks for specific CVE IDs and severity, which forces the AI to use its training data on real vulnerabilities. It also prioritizes active exploitation, which is crucial for risk-based decision making.
4. The Secure Code Generator
Prompt: "Generate a [language] function that [task]. Follow these security requirements: 1) Input validation using allowlists, 2) Output encoding, 3) Use parameterized queries for database access, 4) Proper error handling without leaking stack traces, 5) Add comments explaining security decisions."
Example: I asked for a Python function to authenticate users. The AI generated a function using bcrypt for password hashing, secrets.compare_digest for constant-time comparison, and rate limiting logic to prevent brute-force attacks. It even included a comment explaining why to use secrets instead of random.
Why it works: By specifying security requirements upfront, you guide the AI to produce secure-by-design code, rather than generic code that might have vulnerabilities.
5. The Threat Model Generator
Prompt: "Create a threat model for [application/system] using the STRIDE methodology. List potential threats in each category (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). For each threat, provide: 1) The affected component, 2) A realistic attack scenario, 3) The risk (High/Medium/Low), 4) Recommended mitigations."
Example: For a microservices-based e-commerce platform, the AI identified a high-risk spoofing threat in the authentication service, where an attacker could forge JWT tokens if the secret was weak. It recommended using RS256 instead of HS256 and rotating keys regularly.
Why it works: STRIDE is a systematic approach to threat modeling. This prompt forces the AI to think like an attacker and cover all angles, not just the obvious ones.
6. The Security Code Review Checklist
Prompt: "Act as a meticulous code reviewer. Review the following code for security issues. For each issue, provide: 1) The line number, 2) The vulnerability type (e.g., XSS, CSRF, IDOR), 3) The OWASP Top 10 category, 4) A detailed explanation of how an attacker could exploit it, 5) The exact fix. Code: [paste code]"
Example: During a review of a REST API, the AI found an IDOR vulnerability in a user profile endpoint. The code returned user data based on the ID from the URL without checking if the authenticated user owned that profile. The AI suggested adding an ownership check and using get_object_or_404 with the user filter.
Why it works: The prompt specifies the exact output format, making the review actionable. It also covers multiple vulnerability types, so you get a comprehensive audit.
7. The Security Fix Suggester
Prompt: "Here is a code snippet with a security vulnerability: [paste code]. Explain the vulnerability and provide three different secure fixes. For each fix, explain the trade-offs (performance, complexity, compatibility). Recommend which one you'd choose and why."
Example: I had a PHP script that concatenated user input into an HTML response, leading to XSS. The AI suggested: 1) Using htmlspecialchars() for output encoding, 2) Implementing a Content Security Policy (CSP) header, 3) Using a template engine like Twig. It recommended the template engine for long-term maintainability.
Why it works: Giving options with trade-offs helps you make informed decisions. The recommendation is based on best practices, not just a single fix.
8. The CI/CD Security Gate Prompt
Prompt: "Act as a DevSecOps engineer. Write a CI/CD pipeline step (GitHub Actions or GitLab CI) that runs SAST (e.g., Semgrep or Bandit) and dependency scanning (e.g., Snyk or Trivy). The step should fail the build if any critical or high severity vulnerabilities are found. Include a comment explaining each configuration option."
Example: The AI generated a GitHub Actions workflow that used semgrep with a ruleset for OWASP Top 10 and trivy for container scanning. It configured the step to fail on critical and high severity issues, with a continue-on-error for medium and low to allow for manual review.
Why it works: This prompt turns the AI into a CI/CD expert, producing a production-ready pipeline step that you can copy-paste.
9. The Log Analysis for Security Incidents
Prompt: "Analyze the following log entries for potential security incidents: [paste logs]. Identify any anomalies such as brute-force attempts, SQL injection patterns, or suspicious IP addresses. For each incident, provide: 1) The timestamp, 2) The severity, 3) A description of the attack, 4) Recommended immediate actions."
Example: I fed in Nginx access logs. The AI spotted an unusually high number of 401 responses from a single IP, indicating a brute-force attack on the login endpoint. It recommended blocking the IP and enabling rate limiting.
Why it works: Logs are noisy, but the AI can quickly spot patterns that humans might miss. This prompt is great for incident response.
10. The Security Compliance Audit (OWASP ASVS)
Prompt: "You are a compliance auditor. Using the OWASP Application Security Verification Standard (ASVS) Level 1, analyze the following application description and code snippets: [paste]. For each ASVS control, state whether it is 'Compliant', 'Non-compliant', or 'Not applicable'. Provide evidence for non-compliance and specific remediation steps."
Example: For a small web app, the AI checked ASVS V2 (Authentication) and found that the app didn't enforce password complexity. It flagged non-compliance and suggested adding a password policy.
Why it works: ASVS is a comprehensive standard. This prompt gives you a structured audit report that you can use for compliance documentation.
Final Thoughts
These prompts are not a substitute for professional security tools and human review, but they significantly speed up the process. By using AI as a first-pass security auditor, you can focus your manual efforts on the most critical issues. Start by incorporating one or two prompts into your daily workflow—try the OWASP Top 10 Diagnostic or the SAST False-Positive Filter. You'll be surprised how many vulnerabilities you catch before they become security incidents. Remember, security is a continuous process, and AI is just another tool in your DevSecOps toolbox. Happy auditing!
Comments