7 Prompts for Security and DevSecOps: Audit, Scanning, and Policy Enforcement

Introduction

Security is no longer an afterthought — it's embedded into the development lifecycle. DevSecOps practices shift security left, integrating scanning, auditing, and policy enforcement directly into CI/CD pipelines. But even with the best tools, engineers waste hours crafting the right queries, rules, and commands. That's where targeted prompts come in. By using structured prompts for SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), and access policy audits, you can automate repetitive security tasks and reduce manual errors.

This article is a collection of seven battle-tested prompts I use daily as a developer and security engineer. Each prompt includes a real-world example, expected output, and a tip for customization. These prompts work with common open-source tools (like Semgrep, OWASP ZAP, and Open Policy Agent) and cloud-native services. No theory — just practical, copy-paste-ready prompts.

1. SAST Prompt: Find Hardcoded Secrets in Code

Hardcoded API keys, tokens, and passwords are the most common security flaw. Use this prompt with a SAST tool like Semgrep or GitLeaks.

Prompt:

Find all occurrences where a string literal contains a pattern matching AWS access key, GitHub token, or generic password assignment. Exclude test files and documentation. Output as a JSON array with file path, line number, and matched string.

Example (Semgrep rule snippet):

rules:
  - id: hardcoded-secret
    patterns:
      - pattern: $VAR = "..."
      - metavariable-regex:
          metavariable: $VAR
regex: (password

|secret|api_key|token)
    message: "Hardcoded secret found"
    languages: [python, javascript, go]
    severity: ERROR

Real-world use:
A team once missed a hardcoded AWS secret in a config file that was pushed to a public repo. Running this prompt as a pre-commit hook prevented the leak. The prompt also works with GitHub secret scanning — just adjust the regex.

Tip: Add a whitelist for false positives (e.g., placeholder or example).

2. DAST Prompt: Scan for SQL Injection in Login Forms

Dynamic scanning requires crafting requests that mimic real attacks. Use this prompt to guide OWASP ZAP or Burp Suite.

Prompt:

For every form input field on the /login endpoint, inject the following payloads: ' OR 1=1 --, " OR ""=", admin'--. Record HTTP responses with status code 200 or 500. Flag any response that contains the word 'Welcome' or 'Dashboard' without valid credentials.

Example (ZAP script snippet):

from zapv2 import ZAPv2
zap = ZAPv2(apikey='your-api-key')
zap.ascan.scan(target_url, recurse=True, inScopeOnly=None, scanPolicyName='SQL Injection')

Real-world use:
During a penetration test of an e-commerce site, this prompt uncovered an unparameterized search field that allowed UNION-based injection. The fix was implemented within 30 minutes after the alert.

Tip: Always run DAST on a staging environment first — some payloads may trigger WAF blocks or data loss.

3. Policy Audit Prompt: Review IAM Roles for Over-Permission

Cloud misconfigurations (like overly permissive IAM roles) are a top cause of breaches. Use this prompt with Open Policy Agent (OPA) or AWS IAM Access Analyzer.

Prompt:

List all IAM roles that have a policy with 'Effect': 'Allow' and 'Action': '*'. For each role, show the attached users and services. Flag any role that is not used in the last 90 days.

Example (OPA Rego rule):

package iam

denied[role] {
  role := input.roles[_]
  policy := role.policies[_]
  policy.effect == "Allow"
  policy.action == "*"
}

Real-world use:
A startup discovered that a stale CI/CD role had full admin access to all S3 buckets. The prompt identified it, and the role was restricted to specific bucket prefixes.

Tip: Combine this with AWS Config rules for continuous compliance.

4. Container Security Prompt: Check Image for Critical CVEs

Container images often contain outdated libraries. Use this prompt with Trivy or Grype.

Prompt:

Scan the Docker image 'nginx:latest' for vulnerabilities. Filter results to show only CVEs with severity CRITICAL or HIGH. Group by package name. Output a table with columns: CVE ID, Package, Installed Version, Fixed Version, Severity.

Example (Trivy command):

trivy image --severity CRITICAL,HIGH --format table nginx:latest

Expected output snippet:

Real-world use:
A team's base image had a critical OpenSSL vulnerability. The prompt was integrated into a CI pipeline, blocking the build until the base image was updated.

Tip: Use minimal base images like alpine or distroless to reduce attack surface.

5. Network Security Prompt: Detect Open Ports and Services

Unnecessary open ports are an invitation for attackers. Use this prompt with Nmap or Masscan.

Prompt:

Scan the subnet 10.0.0.0/24 for all TCP and UDP ports. Ignore ports 80, 443, and 22. Report any port that returns a service banner containing 'MySQL', 'MongoDB', or 'Redis'. Include IP address, port number, and banner text.

Example (Nmap command):

nmap -sV -p T:1-65535,U:1-65535 --exclude-ports 80,443,22 10.0.0.0/24

| grep -E "MySQL|MongoDB|Redis"

Real-world use:
During an internal audit, this prompt found a Redis instance exposed on port 6379 without authentication. The team immediately moved it to a private subnet.

Tip: Always use -sV for version detection — it helps prioritize patching.

6. Compliance Prompt: Verify GDPR Data Retention Policies

Regulatory compliance requires automated checks. Use this prompt with custom scripts or tools like Checkov for infrastructure-as-code.

Prompt:

Review all Terraform resources of type 'aws_s3_bucket'. For each bucket, check if 'lifecycle_rule' is defined with 'expiration' days greater than 365. If not, flag as non-compliant with GDPR Article 5(1)(e). Output resource name and current lifecycle config.

Example (Checkov policy snippet):

metadata:
  name: "Ensure S3 bucket has lifecycle policy with max 365 days retention"
scope:
  provider: aws
  resource: aws_s3_bucket
definition:
  cond:
    - not:
        resource:
          - lifecycle_rule:
              - expiration:
                  days: "<= 365"

Real-world use:
A fintech company used this prompt during an external GDPR audit. It found three buckets with indefinite retention. The fix took 15 minutes.

Tip: Extend this to RDS snapshots and CloudWatch logs.

7. Incident Response Prompt: Correlate Logs for Breach Indicators

When a breach is suspected, speed matters. Use this prompt with SIEM tools like Wazuh or Splunk (via API).

Prompt:

Search logs from the last 24 hours for any IP address that appears in both authentication failures (status 401) and successful logins (status 200) within a 5-minute window. Group by IP and count occurrences. Flag IPs with more than 10 failures before a success.

Example (Splunk search):

index=main sourcetype=access_combined
| stats earliest(_time) as first, latest(_time) as last, count(eval(status=401)) as failures, count(eval(status=200)) as successes by clientip
| where failures > 10 AND successes > 0
| eval window = last - first
| where window < 300

Real-world use:
This query detected a brute-force attack that eventually succeeded on a WordPress admin account. The attacker's IP was blocked, and the account password was reset.

Tip: Add geolocation enrichment to prioritize IPs from unexpected regions.

Conclusion

These seven prompts cover the core DevSecOps domains: code scanning, dynamic testing, policy audits, container security, network reconnaissance, compliance, and incident response. Each prompt is designed to be run automatically in a CI/CD pipeline or as a scheduled task. The key is to start small — pick one prompt, integrate it into your workflow, and iterate.

Security is not a one-time fix; it's a continuous process. By using structured prompts, you reduce human error, save time, and ensure consistent coverage. Remember to update prompts as tools evolve and new vulnerability patterns emerge. And if you're working with multiple tools, consider centralizing your prompts in a shared repository — your team will thank you.

ASI Biont supports connecting to cloud security tools like AWS IAM and Splunk through API integrations — learn more at asibiont.com/courses.