Introduction
DevSecOps integrates security into every phase of the software development lifecycle. But even with the best tools, the human bottleneck — translating policies into code, interpreting scan results, and writing secure configurations — remains a challenge. Large language models (LLMs) can help bridge this gap when given the right prompts. Below are 10 battle-tested prompts for security engineers and developers, covering SAST, DAST, IAM policies, compliance scanning, and incident response. Each prompt includes a real-world example and a code snippet to show how you can use it in your CI/CD pipeline or daily workflow.
1. SAST Scan – Identify OWASP Top 10 Vulnerabilities
Prompt:
You are a security engineer. Perform a static application security test on the following Python code. List all OWASP Top 10 vulnerabilities present, with exact line numbers and a suggested fix.
Code: [paste your code]
Example usage:
Developer pastes a snippet that uses raw SQL queries. The AI returns:
- Line 12: SQL Injection (A03:2021). Use parameterized queries.
- Line 45: Hardcoded secret (A05:2021). Move to environment variables.
CI/CD integration (GitHub Actions snippet):
- name: Prompt-based SAST
run: |
cat app.py
| xargs -0 sh -c 'echo "$1" | llm-prompt "$(cat prompt.txt)"'
This approach helps teams without commercial SAST tools to quickly detect common flaws.
2. DAST – Generate Attack Vectors for Your API
Prompt:
You are a penetration tester. Given the OpenAPI specification below, list 10 specific attack payloads to test for SQL injection, XSS, and broken object-level authorization. Provide curl commands for each.
Swagger: [paste YAML/JSON]
Example output:
- curl -X POST "https://api.example.com/users" -d '{"name": "' OR '1'='1"}'
- curl -X GET "https://api.example.com/orders/../admin/orders"
Many teams use this prompt during the test phase of their pipeline to augment their DAST scans (e.g., on staging endpoints).
3. AWS IAM Policy Audit – Least Privilege Principle
Prompt:
You are an AWS security specialist. Audit the following IAM policy JSON. List permissions that violate the principle of least privilege, suggest a stricter policy, and explain the risk.
Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "*"
}
]
}
Real-world case: A cloud engineer received this output: "Wildcard action s3:* on all resources – risk is data exfiltration. Suggested: limit to s3:GetObject on arn:aws:s3:::my-bucket/*". The prompt was used to automatically review policies before commit via a pre-commit hook.
4. Compliance Check – CIS Benchmark for Docker
Prompt:
You are a compliance auditor. Review the following Dockerfile and docker-compose.yml for violations of the CIS Docker Benchmark (v1.6). Provide a score out of 10 and specific steps to remediate.
Dockerfile: [paste]
docker-compose: [paste]
Example findings:
- Score: 4/10
- USER root → Use a non-root user (CIS 4.1)
- HEALTHCHECK missing → Add health check (CIS 4.6)
- --privileged flag in docker-compose → Remove (CIS 4.5)
Teams embed this prompt in their image build stage to gate deployments based on compliance score.
5. Terraform Security – Check for Misconfigurations
Prompt:
You are a Terraform security expert. Analyze the following HCL code for security misconfigurations related to network exposure, encryption, and IAM. For each issue, provide a `tflint`-style fix and a line reference.
main.tf:
resource "aws_security_group" "example" {
ingress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
Output:
- Line 3–6: Security group allows all inbound traffic from any IP. Replace cidr_blocks with specific IPs or use aws_security_group_rule with self attribute.
This prompt helps before terraform plan to catch regressions early.
6. Incident Response – Analyze a Log Pattern
Prompt:
You are a SOC analyst. The following CloudTrail log shows repeated `DescribeInstances` calls from an unknown IP. Determine if this is a data scraping attempt or legitimate. Suggest immediate containment steps.
Log: [paste JSON]
Example analysis:
- Likelihood: High – IP is not in the allowed list, calls occur every 5 seconds, no AssumeRole context.
- Containment: Detach IAM policy via AWS CLI: aws iam detach-user-policy --user-name unknown_user --policy-arn arn:aws:iam::xxx:policy/DescribePolicy
You can pipe logs into this prompt using a SIEM workflow to get instant triage suggestions.
7. Kubernetes RBAC – Generate Minimal Permissions
Prompt:
You are a Kubernetes security administrator. Create a Role and RoleBinding that grants a CI/CD service account the minimum permissions required to create pods and deployments in the `staging` namespace. Use the principle of least privilege.
Generated YAML:
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: staging
name: ci-deployer
rules:
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list", "create", "update"]
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "create", "update"]
Teams run this prompt as part of a Policy-as-Code pipeline to generate bindings automatically from high-level descriptions.
8. Secrets Detection – Review Commit History
Prompt:
You are a security scanner. Given the following git diff (or the output of `git log -p`), list any hardcoded secrets (API keys, tokens, passwords) and suggest how to rotate them.
Diff: [paste]
Real-world scenario: A developer accidentally committed an AWS secret key. The prompt identified the pattern AKIA... in config.py and recommended git filter-branch to purge history and use AWS Secrets Manager. The output was used as guidance for a security incident ticket.
9. Secure Coding – Generate Safe Snippet (e.g., SQL Queries)
Prompt:
You are a senior developer writing security-conscious code. Write a function in Python that fetches user data from a PostgreSQL database without using string concatenation. Use parameterized queries and include input validation for the user ID (must be UUID).
Generated code:
import psycopg2
import uuid
def get_user(user_id):
try:
uuid.UUID(user_id)
except ValueError:
raise ValueError("Invalid user ID")
conn = psycopg2.connect(...)
cur = conn.cursor()
cur.execute("SELECT * FROM users WHERE id = %s", (user_id,))
return cur.fetchone()
Developers use this snippet as a reference in code review checklists, reducing SQL injection risks by 90% (based on internal team metrics).
10. Policy Explanation – Translate Jargon for Non-Security Stakeholders
Prompt:
You are a security evangelist. Explain the following network security policy in simple terms for a product manager. Answer: Why do we need it? What happens if we skip it? Give an analogy.
Policy: "All ingress traffic to production must go through a WAF that enforces a rate limit of 100 req/s per IP and blocks known bot IPs."
Output:
"This rule is like a bouncer at a club who only lets in 100 people per second. If we skip it, attackers can flood our server (DDoS) or try to break in. The WAF also checks IDs and blocks known troublemakers."
This prompt is especially useful during security awareness training or when writing documentation for compliance audits.
Conclusion
Integrating LLM prompts into your DevSecOps workflow isn't about replacing tools — it's about augmenting human expertise with faster, context-aware guidance. Start by using these 10 prompts in your daily stand-ups, PR reviews, or CI/CD pipelines. For example, add the SAST prompt as a comment in your Git hooks, or feed CloudTrail logs into the incident response prompt automatically. Over time, you'll build a custom library of prompts that reflect your organization's specific policies and tech stack. Try one today and see how much quicker you can detect and remediate security issues.
References: OWASP Top 10 (2021), CIS Docker Benchmark v1.6, NIST SP 800-53, AWS Well-Architected Framework.
Comments