Application Security Audit Checklist
ChatGPT Prompt
Build a security audit checklist for a {application_type} handling {data_sensitivity}. Organise by the OWASP Top 10 plus the categories it underweights: authentication and session handling, authorisation and object-level access control, input validation and injection, cryptography and secrets management, dependency and supply-chain risk, logging and monitoring, and infrastructure configuration. For each item give the specific check, how to test it (manual step or tool), what a pass looks like, the severity if it fails, and the remediation. Weight broken object-level authorisation highly — it is the most commonly missed and most exploited. Add the checks that belong in CI rather than a periodic audit, and note where a specialist penetration test is required rather than a checklist.
💡 Pro Tip: Replace placeholders in [BRACKETS] with your specific information for best results.
How to Use This Prompt
- 1Click the copy button above to copy the prompt to your clipboard
- 2Open ChatGPT, Claude, or your preferred AI assistant
- 3Paste the prompt and replace any [PLACEHOLDER TEXT] with your specific details
- 4Review the AI's response and iterate if needed for better results
Related Prompts
Python Code Review
Review the following Python code for {purpose}. Work in priority order and say why each finding matters rather than only naming it: first correctness and security — injection, authentication and authorisation gaps, unsafe input handling, secrets in source; then reliability — error handling, resource cleanup, and behaviour under partial failure; then performance where it is measurably relevant rather than speculative; then readability and structure. Check for mutable default arguments, bare except clauses swallowing errors, missing context managers around resources, type hints on public interfaces, and the GIL implications of any threading used for CPU-bound work. For every issue give the location, the concrete failure it causes, a corrected snippet, and a severity. Separate defects that will bite in production from stylistic preferences, and state explicitly what you could not assess without seeing tests, configuration or the calling code.
JavaScript Code Review
Review the following JavaScript code for {purpose}. Work in priority order and say why each finding matters rather than only naming it: first correctness and security — injection, authentication and authorisation gaps, unsafe input handling, secrets in source; then reliability — error handling, resource cleanup, and behaviour under partial failure; then performance where it is measurably relevant rather than speculative; then readability and structure. Check for unhandled promise rejections, missing await, accidental floating promises, closure captures inside loops, prototype pollution on merges, and equality and coercion bugs from ==. For every issue give the location, the concrete failure it causes, a corrected snippet, and a severity. Separate defects that will bite in production from stylistic preferences, and state explicitly what you could not assess without seeing tests, configuration or the calling code.
TypeScript Code Review
Review the following TypeScript code for {purpose}. Work in priority order and say why each finding matters rather than only naming it: first correctness and security — injection, authentication and authorisation gaps, unsafe input handling, secrets in source; then reliability — error handling, resource cleanup, and behaviour under partial failure; then performance where it is measurably relevant rather than speculative; then readability and structure. Check for `any` escaping through public APIs, unsafe type assertions hiding real mismatches, non-null assertions used instead of narrowing, discriminated unions that are not exhaustively handled, and whether types actually encode the invariants or merely decorate them. For every issue give the location, the concrete failure it causes, a corrected snippet, and a severity. Separate defects that will bite in production from stylistic preferences, and state explicitly what you could not assess without seeing tests, configuration or the calling code.
Java Code Review
Review the following Java code for {purpose}. Work in priority order and say why each finding matters rather than only naming it: first correctness and security — injection, authentication and authorisation gaps, unsafe input handling, secrets in source; then reliability — error handling, resource cleanup, and behaviour under partial failure; then performance where it is measurably relevant rather than speculative; then readability and structure. Check for resource leaks outside try-with-resources, mutable state shared across threads without synchronisation, equals and hashCode contract violations, overly broad exception catching, and N+1 queries behind an ORM. For every issue give the location, the concrete failure it causes, a corrected snippet, and a severity. Separate defects that will bite in production from stylistic preferences, and state explicitly what you could not assess without seeing tests, configuration or the calling code.
C++ Code Review
Review the following C++ code for {purpose}. Work in priority order and say why each finding matters rather than only naming it: first correctness and security — injection, authentication and authorisation gaps, unsafe input handling, secrets in source; then reliability — error handling, resource cleanup, and behaviour under partial failure; then performance where it is measurably relevant rather than speculative; then readability and structure. Check for ownership ambiguity and raw pointers where a smart pointer belongs, rule-of-five violations, iterator and reference invalidation after container mutation, undefined behaviour from signed overflow or aliasing, and exception safety across resource acquisition. For every issue give the location, the concrete failure it causes, a corrected snippet, and a severity. Separate defects that will bite in production from stylistic preferences, and state explicitly what you could not assess without seeing tests, configuration or the calling code.
REST API Design for Task Management
Design a RESTful API for Task Management. Define the resource model and the relationships between resources, then the endpoints with methods, path structure, request and response schemas, and status codes for success and every failure. Model the hierarchy carefully — projects, tasks, subtasks, assignees, comments — and decide whether subtasks are a separate resource or a self-referential relation. Handle bulk operations, since clients will always need to move many tasks at once. Cover authentication and authorisation including how object-level permissions are enforced, pagination (state whether cursor or offset and why), filtering and sorting conventions, rate limiting with the headers returned, and a consistent error envelope carrying a machine-readable code. Address versioning strategy and what constitutes a breaking change. Provide an OpenAPI fragment for two representative endpoints, and list the three design decisions most likely to be regretted later with the alternative for each.