30 Prompts for Security and DevSecOps: Audit, Scanning, and Policies

Analyze the Python codebase in the 'src/' directory for security vulnerabilities. Focus on the OWASP Top 10 for 2021, particularly SQL injection, XSS, and insecure deserialization. Output a Markdown table with columns: vulnerability name, file path, line number, severity (Critical/High/Medium/Low), and recommended fix. Ignore false positives if possible.

Scan the Docker image 'myapp:latest' for Common Vulnerabilities and Exposures (CVEs) in the base image and installed packages. List only critical and high-severity vulnerabilities. For each, provide the CVE ID, affected package, current version, and a link to the NVD entry.

Review the Kubernetes deployment file 'deploy.yaml' against the Pod Security Standards (Restricted profile). List any violations, such as running as root, allowing privileged escalation, or missing read-only root filesystem. Provide the exact YAML path and suggested fix.

Analyze the attached IAM policy document (JSON) for over-privileged permissions. Identify any actions that grant 'FullAccess' to services like S3, EC2, or IAM. List the principal, effect, action, and resource. Suggest a least-privilege alternative for each.

Scan the repository's commit history for hardcoded secrets—API keys, passwords, tokens, and private keys. Use regex patterns for AWS keys, GitHub tokens, and Slack webhooks. Output a table with commit hash, file path, secret type, and severity.

Examine the Terraform plan output for security misconfigurations. Check for S3 buckets with public access, security groups with 0.0.0.0/0 to port 22, and RDS instances without encryption. For each issue, provide the resource address, current setting, and recommended change.

Analyze the provided web server access log (Nginx format) for potential attack patterns: SQL injection attempts, path traversal, or brute-force login. Summarize the top 5 suspicious IPs, the type of attack, and the number of occurrences.

Given the 'requirements.txt' file, check each package against the NVD database. List packages with known vulnerabilities, including the fixed version. Prioritize by CVSS score.

Evaluate the current security controls (list provided) against SOC 2 Trust Service Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). For each criterion, state whether it's met or not, and list missing controls.

Generate a security checklist for deploying a new microservice. Include items: authentication (JWT/OAuth), input validation, output encoding, dependency scanning, and logging. For each item, provide a brief description and a sample implementation.

Execute a DAST scan against the staging URL 'https://staging.example.com' using OWASP ZAP. Run the 'Full Scan' with AJAX Spider enabled. After completion, generate a JSON report with all alerts, grouped by risk level (High, Medium, Low). Include evidence (request/response) for high-risk findings.

{
  "site": "https://staging.example.com",
  "alerts": [
    {
      "risk": "High",
      "name": "SQL Injection",
      "url": "/api/users?id=1",
      "evidence": "Request: GET /api/users?id=1' OR '1'='1; Response: 200 OK with user data"
    }
  ]
}

Write a Rego policy for OPA that denies any Kubernetes deployment with 'imagePullPolicy: Always' in production namespaces (e.g., 'prod-*'). The policy should also allow 'imagePullPolicy: IfNotPresent' for non-prod. Provide the policy code and a test case.

package kubernetes.admission
denying[msg] {
  input.request.kind.kind == "Deployment"
  namespace = input.request.object.metadata.namespace
  startswith(namespace, "prod-")
  containers = input.request.object.spec.template.spec.containers[_]
  containers.imagePullPolicy == "Always"
  msg = "Production deployments must use 'IfNotPresent' imagePullPolicy"
}

Using CodeQL, query the JavaScript repository for hardcoded credentials. Write a QL query that finds string literals containing 'password', 'secret', or 'api_key' assigned to variables. Output the file, line number, and the literal value.

Generate a CycloneDX SBOM for the Node.js project in '/app'. Include all direct and transitive dependencies, their versions, licenses, and download locations. Output as JSON.

{
  "bomFormat": "CycloneDX",
  "components": [
    {
      "name": "lodash",
      "version": "4.17.21",
      "licenses": [{"license": {"id": "MIT"}}],
      "purl": "pkg:npm/lodash@4.17.21"
    }
  ]
}

Inspect the Dockerfile for 'myapp:latest' and ensure it creates a non-root user and switches to it. If not, output the lines that need to be added. Also check if the container runs with 'USER root'.

Analyze the AWS security group JSON for inbound rules. Flag any rule with 'CidrIp': '0.0.0.0/0' and port 22, 3389, or 3306. For each, suggest a more restrictive CIDR (e.g., office IP range).

Run GitLeaks on the 'develop' branch of the repository. Scan for high-entropy strings and known patterns (AWS, GitHub, Slack). Output results in JSON format with commit, file, and secret.

{
  "leaks": [
    {
      "commit": "abc123",
      "file": "config.json",
      "secret": "AKIA..."
    }
  ]
}

Create a threat model for a payment API using STRIDE. For each category (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), list at least one threat, its impact, and a mitigation.

Compare the current Terraform state file (state.json) with the live AWS resources. List any resources that have drifted—e.g., changed tags, security groups, or instance types. Provide the resource name, expected value, and actual value.

Write a Semgrep rule that detects hardcoded IPv4 addresses in Python code (except 127.0.0.1 and 0.0.0.0). The rule should match string literals like '10.0.0.1'. Output the rule YAML and a test case.

rules:
  - id: hardcoded-ip
    patterns:
      - pattern-regex: "\\b(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\\b"
      - pattern-not: "127.0.0.1"
      - pattern-not: "0.0.0.0"
    message: "Hardcoded IP address found"
    languages: [python]
    severity: WARNING

Design a policy engine using OPA that validates Terraform modules before deployment. The engine should check for: (1) S3 bucket versioning enabled, (2) CloudTrail logging enabled, (3) KMS encryption on EBS volumes. Provide the Rego policies and a script to run them via `opa eval`.

package terraform.aws
violation[msg] {
  resource = input.resource.aws_s3_bucket[_]
  resource.versioning[0].enabled != true
  msg = sprintf("%s: versioning is not enabled", [resource.name])
}

Create a runbook for responding to a 'Critical' alert from AWS GuardDuty (e.g., 'UnauthorizedAccess:EC2/SSHBruteForce'). The runbook should include: step-by-step containment (isolate the instance), investigation (analyze CloudTrail logs), and recovery (apply security group changes). Output as a checklist.

Given a service dependency graph (list of services and their allowed connections), generate Kubernetes NetworkPolicy YAML for each namespace. Use 'podSelector' and 'ingress/egress' rules. Example: 'frontend' can talk to 'backend' on port 8080, 'backend' can talk to 'db' on port 5432.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-allow-frontend
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - port: 8080

Audit all TLS certificates in the 'certificates/' directory. For each, extract: issuer, subject, validity period, signature algorithm, and key size. Flag certificates using SHA-1 or RSA 1024. Output a table with status (Pass/Fail).

Write a SQL query for a security data lake (e.g., AWS Athena) that retrieves all failed CIS benchmark checks for EC2 instances in the last 7 days. Group by instance ID and check ID. Include the timestamp, region, and account ID.

SELECT instance_id, check_id, region, account_id, MAX(timestamp) as last_fail
FROM compliance_results
WHERE status = 'FAIL' AND dt >= current_date - interval '7' day
GROUP BY 1, 2, 3, 4;

Outline a zero-trust network architecture for a multi-cloud environment (AWS + GCP). Include: micro-segmentation, identity-aware proxy, mutual TLS, and continuous monitoring. For each component, specify the tool (e.g., BeyondCorp, AWS Network Firewall) and configuration steps.

Create a GitHub Actions workflow that achieves SLSA Level 3 for a Java application. Include: (1) provenance generation using slsa-framework, (2) signed attestations, (3) reproducible build. Provide the YAML and the commands for verification.

name: SLSA
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: slsa-framework/slsa-github-generator@v1.0

Write a script (Bash or Python) that checks the current Git branch and applies different security policies: for 'main' branch, require SAST scan, dependency check, and container image signing; for 'feature' branches, only require linting and unit tests. Output the policy decision.

if [[ "$BRANCH" == "main" ]]; then
  echo "Applying full security suite: SAST, SCA, signing"
  # run SAST
else
  echo "Running minimal checks"
fi

For each dependency in 'requirements.txt', compute a risk score based on: (1) number of open CVEs, (2) last release date, (3) number of maintainers, (4) license type. Output a sorted list with risk score and recommendation (keep/update/replace).

Design a pipeline that automatically blocks a deployment if a critical vulnerability is found. The pipeline should: scan the image, compare against a policy (e.g., no CVSS > 7.0), and if blocked, create a Jira ticket and notify the team via Slack. Provide a diagram and pseudocode.