7 Prompts for Security and DevSecOps: Audit, Scanning, and Policy Enforcement

## Introduction Security is no longer an afterthought — it's embedded into the development lifecycle. DevSecOps practices shift security left, integrating scanning, auditing, and policy enforcement directly into CI/CD pipelines. But even with the best tools, engineers waste hours crafting the right queries, rules, and commands. That's where targeted prompts come in. By using structured prompts for SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), and access policy audits, you can automate repetitive security tasks and reduce manual errors. This article is a collection of seven battle-tested prompts I use daily as a developer and security engineer. Each prompt includes a real-world example, expected output, and a tip for customization. These prompts work with common open-source tools (like Semgrep, OWASP ZAP, and Open Policy Agent) and cloud-native services. No theory — just practical, copy-paste-ready prompts. ## 1. SAST Prompt: Find Hardcoded Secrets in Code Hardcoded API keys, tokens, and passwords are the most common security flaw. Use this prompt with a SAST tool like Semgrep or GitLeaks. **Prompt:** ``` Find all occurrences where a string literal contains a pattern matching AWS access key, GitHub token, or generic password assignment. Exclude test files and documentation. Output as a JSON array with file path, line number, and matched string. ``` **Example (Semgrep rule snippet):** ```yaml rules: - id: hardcoded-secret patterns: - pattern: $VAR = "..." - metavariable-regex: metavariable: $VAR regex: (password|secret|api_key|token) message: "Hardcoded secret found" languages: [python, javascript, go] severity: ERROR ``` **Real-world use:** A team once missed a hardcoded AWS secret in a config file that was pushed to a public repo. Running this prompt as a pre-commit hook prevented the leak. The prompt also works with GitHub secret scanning — just adjust the regex. **Tip:** Add a whitelist for false positives (e.g., `placeholder` or `example`). ## 2. DAST Prompt: Scan for SQL Injection in Login Forms Dynamic scanning requires crafting requests that mimic real attacks. Use this prompt to guide OWASP ZAP or Burp Suite. **Prompt:** ``` For every form input field on the /login endpoint, inject the following payloads: ' OR 1=1 --, " OR ""=", admin'--. Record HTTP responses with status code 200 or 500. Flag any response that contains the word 'Welcome' or 'Dashboard' without valid credentials. ``` **Example (ZAP script snippet):** ```python from zapv2 import ZAPv2 zap = ZAPv2(apikey='your-api-key') zap.ascan.scan(target_url, recurse=True, inScopeOnly=None, scanPolicyName='SQL Injection') ``` **Real-world use:** During a penetration test of an e-commerce site, this prompt uncovered an unparameterized search field that allowed UNION-based injection. The fix was implemented within 30 minutes after the alert. **Tip:** Always run DAST on a staging environment first — some payloads may trigger WAF blocks or data loss. ## 3. Policy Audit Prompt: Review IAM Roles for Over-Permission Cloud misconfigurations (like overly permissive IAM roles) are a top cause of breaches. Use this prompt with Open Policy Agent (OPA) or AWS IAM Access Analyzer. **Prompt:** ``` List all IAM roles that have a policy with 'Effect': 'Allow' and 'Action': '*'. For each role, show the attached users and services. Flag any role that is not used in the last 90 days. ``` **Example (OPA Rego rule):** ```rego package iam denied[role] { role := input.roles[_] policy := role.policies[_] policy.effect == "Allow" policy.action == "*" } ``` **Real-world use:** A startup discovered that a stale CI/CD role had full admin access to all S3 buckets. The prompt identified it, and the role was restricted to specific bucket prefixes. **Tip:** Combine this with AWS Config rules for continuous compliance. ## 4. Container Security Prompt: Check Image for Critical CVEs Container images often contain outdated libraries. Use this prompt with Trivy or Grype. **Prompt:** ``` Scan the Docker image 'nginx:latest' for vulnerabilities. Filter results to show only CVEs with severity CRITICAL or HIGH. Group by package name. Output a table with columns: CVE ID, Package, Installed Version, Fixed Version, Severity. ``` **Example (Trivy command):** ```bash trivy image --severity CRITICAL,HIGH --format table nginx:latest ``` **Expected output snippet:** | CVE ID | Package | Installed Version | Fixed Version | Severity | |--------|---------|-------------------|---------------|----------| | CVE-2024-1234 | openssl | 1.1.1t | 1.1.1u | CRITICAL | **Real-world use:** A team's base image had a critical OpenSSL vulnerability. The prompt was integrated into a CI pipeline, blocking the build until the base image was updated. **Tip:** Use minimal base images like `alpine` or `distroless` to reduce attack surface. ## 5. Network Security Prompt: Detect Open Ports and Services Unnecessary open ports are an invitation for attackers. Use this prompt with Nmap or Masscan. **Prompt:** ``` Scan the subnet 10.0.0.0/24 for all TCP and UDP ports. Ignore ports 80, 443, and 22. Report any port that returns a service banner containing 'MySQL', 'MongoDB', or 'Redis'. Include IP address, port number, and banner text. ``` **Example (Nmap command):** ```bash nmap -sV -p T:1-65535,U:1-65535 --exclude-ports 80,443,22 10.0.0.0/24 | grep -E "MySQL|MongoDB|Redis" ``` **Real-world use:** During an internal audit, this prompt found a Redis instance exposed on port 6379 without authentication. The team immediately moved it to a private subnet. **Tip:** Always use `-sV` for version detection — it helps prioritize patching. ## 6. Compliance Prompt: Verify GDPR Data Retention Policies Regulatory compliance requires automated checks. Use this prompt with custom scripts or tools like Checkov for infrastructure-as-code. **Prompt:** ``` Review all Terraform resources of type 'aws_s3_bucket'. For each bucket, check if 'lifecycle_rule' is defined with 'expiration' days greater than 365. If not, flag as non-compliant with GDPR Article 5(1)(e). Output resource name and current lifecycle config. ``` **Example (Checkov policy snippet):** ```yaml metadata: name: "Ensure S3 bucket has lifecycle policy with max 365 days retention" scope: provider: aws resource: aws_s3_bucket definition: cond: - not: resource: - lifecycle_rule: - expiration: days: "<= 365" ``` **Real-world use:** A fintech company used this prompt during an external GDPR audit. It found three buckets with indefinite retention. The fix took 15 minutes. **Tip:** Extend this to RDS snapshots and CloudWatch logs. ## 7. Incident Response Prompt: Correlate Logs for Breach Indicators When a breach is suspected, speed matters. Use this prompt with SIEM tools like Wazuh or Splunk (via API). **Prompt:** ``` Search logs from the last 24 hours for any IP address that appears in both authentication failures (status 401) and successful logins (status 200) within a 5-minute window. Group by IP and count occurrences. Flag IPs with more than 10 failures before a success. ``` **Example (Splunk search):** ```spl index=main sourcetype=access_combined | stats earliest(_time) as first, latest(_time) as last, count(eval(status=401)) as failures, count(eval(status=200)) as successes by clientip | where failures > 10 AND successes > 0 | eval window = last - first | where window < 300 ``` **Real-world use:** This query detected a brute-force attack that eventually succeeded on a WordPress admin account. The attacker's IP was blocked, and the account password was reset. **Tip:** Add geolocation enrichment to prioritize IPs from unexpected regions. ## Conclusion These seven prompts cover the core DevSecOps domains: code scanning, dynamic testing, policy audits, container security, network reconnaissance, compliance, and incident response. Each prompt is designed to be run automatically in a CI/CD pipeline or as a scheduled task. The key is to start small — pick one prompt, integrate it into your workflow, and iterate. Security is not a one-time fix; it's a continuous process. By using structured prompts, you reduce human error, save time, and ensure consistent coverage. Remember to update prompts as tools evolve and new vulnerability patterns emerge. And if you're working with multiple tools, consider centralizing your prompts in a shared repository — your team will thank you. ASI Biont supports connecting to cloud security tools like AWS IAM and Splunk through API integrations — learn more at asibiont.com/courses.

7 Prompts for Security and DevSecOps: Audit, Scanning, and Policy Enforcement

Comments

Recent articles

40 Prompts for ChatGPT and GPT-4: From Code Generation to Architecture Design

The Good, the Bad, and the AI Apps: A Technologist's Guide to Vibe Coding in 2026

How to Connect ASI Biont AI Agent to Intercom: No-Code Support Automation

Quote of the Day Reversal: Satya Nadella’s ‘Faith in the System’ Gaffe and What It Reveals About Tech Culture in 2026

Scientists Have Identified a New Fossil Species of Axolotl in Mexico: A Developer’s Perspective on Paleontological Discovery

Master Copywriting & Content with AI: Why the Course on Asibiont.com Is Your Fast Track to Persuasive Writing

Vibe Coding in New York City: How Educators and Industry Leaders Are Shaping AI Classrooms at Google

How to Integrate Ghost CMS with ASI Biont AI Agent for Automated Content Publishing

Developer, Show Me Your skill.md! The Art of Legacy Code Refactoring