AI Security Review Prompt Pack

AI can produce a security report in seconds. Without structure, it reports what code like yours often has, not what yours actually does.

Ask an AI coding tool to “find vulnerabilities in this,” and you usually get something that reads like a security report: numbered findings, severity labels, OWASP categories, maybe a CVE ID and a “fix”. Then you check it. Two findings are in test fixtures. The “SQL injection” is a parameterised query. The “missing authentication” is handled by a router group the model never saw. The CVE ID points to a different package. And the real bug, a route that loads any user's object by ID with no ownership check, isn't on the list, because the bug is a line that isn't there.

AI Security Review Prompt Pack gives you ready-to-paste prompts with roles, {{placeholders}}, a map → trace → verdict process, output contracts and hard rules (above all: no finding without evidence, and never invent CVE / GHSA IDs, versions or scores), so Cursor, Claude Code, ChatGPT or Copilot Chat work from your code and your scanner output instead of memory. You get traced source → sink paths with file:line, access-control matrices with a verdict per route, CONFIRMED / LIKELY / LEAD / SAFE labels, honest NOT-VISIBLE rows, and fixes that come with a regression test.

This is not an AGENTS.md / agent-workflow pack, not a general PR-review pack, not a test-writing pack, not a debugging pack, not a refactoring pack and not a documentation pack. It is only about security review and remediation of your own code with AI.

What you get

- 📘 PDF field guide (32 pages): why “find vulnerabilities in this” fails, the security review loop (scope → map → trace → triage → fix → gate), an ethics and scope section, every prompt explained, combining prompts with an illustrative (fictional) worked example, team norms, prompt anatomy and follow-up prompts

- 🗂️ templates/: 8 prompts + 2 checklists + Cursor .mdc rule + README

- 🖼️ cover.png

The 8 prompts

1. Threat model a feature or repo (STRIDE-lite): assets, entry points with who can reach them, trust boundaries, traced flows, threats with control evidence or “not visible”, next check per threat

2. Secrets & config leak sweep: sensitive-file inventory, redacted previews (never full secrets), LIKELY-REAL vs placeholder, unsafe config, rotate → remove → history → prevent

3. Injection review (SQL, command, path, template, XSS): sources and sinks with file:line, hop-by-hop traces, CONFIRMED / LIKELY / LEAD / SAFE, one-sentence impact, stack-standard fix, SAST triage

4. Authn/authz & IDOR review: access-control matrix per route, AuthN vs AuthZ lines, every verb and bulk route, mass assignment, two-user regression tests

5. Dependency & CVE triage: works only from your scanner output and advisory text, IDs and versions copied verbatim, direct/transitive, runtime/dev, reachability with searches shown, upgrade plan

6. LLM app: prompt-injection & tool-permission review: untrusted inputs, tool capabilities and credentials, injection paths rated by side effect, output sinks, controls that hold even if the model is steered

7. Secure fix + regression test: one finding, root cause, benign test that fails first, minimal diff, NOT RUN when nothing ran

8. Pre-release security gate: diff classification, ten checks with PASS / FAIL / N/A / NOT-CHECKED and evidence, GO / GO-WITH-CONDITIONS / BLOCK for a human to decide

Also included

- Severity & exploitability triage checklist: is it real, who can reach it, what could happen, to whom, and a defensible rank, without asking a model for scores

- When NOT to trust AI security findings: a 10-minute false-positive check, where AI most often gets security wrong, what AI reviews tend to miss, and decisions that stay with a human

- Cursor rule (security-review.mdc): own code only, evidence before verdicts, not visible ≠ missing, never invent identifiers, never echo secrets, report first, minimal fix + real test

Who it’s for

- Developers using Cursor, Claude Code, ChatGPT or Copilot Chat who want a security pass on their own code before it ships

- Small teams without a dedicated security engineer who still handle logins, payments, uploads or admin panels

- Maintainers with a backlog of scanner output who need to decide what actually matters

- Anyone shipping an LLM feature with tools, RAG or rendered output

Who it’s not for

- Anyone looking to test, scan or attack systems they don't own or aren't authorised to test. The prompts are defensive and refuse payload generation by design

- People who need a compliance certification or a formal penetration test. This pack doesn't replace either

- Teams whose policy forbids pasting code into AI tools. This pack doesn't change that

How it works

1. Write down the scope you own and pick the prompt that matches the review

2. Fill the {{placeholders}} with paths, stack, roles and raw scanner output

3. Run it report-only and read the map, traces and verdicts before allowing edits

4. Triage with the checklists; fix one finding at a time with prompt 07

5. Gate the release with prompt 08; a human makes the call

Ethics note

Use this pack only on code and systems you own or are explicitly authorised to test. It is written for review and remediation: one-sentence impact descriptions, benign regression tests, no exploit payloads, no testing of third-party systems.

Honest positioning

No fabricated testimonials, download counts, detection rates, time-saved claims or benchmarks, and no CVE IDs. The worked example in the guide is clearly labelled as fictional. A clean AI review does not mean code is secure; the guide says what these prompts can and can't catch. Judge it by running prompt 04 against routes you know well, or prompt 05 against your latest scanner output, and checking every verdict and cited line.