Review a security-sensitive change | DevPrompt Lab

A review prompt that asks for evidence, attack paths, and practical fixes while avoiding speculative findings.

Reusable content

Review the supplied change as a security-focused engineer. Inspect the changed code and the surrounding call paths. Check authorization, input validation, injection, secrets, session handling, data exposure, and failure behavior only where relevant to this change. Report only reproducible issues. For each finding include severity, file and line, preconditions, an exploit or failure path, impact, and a minimal fix. If no issue is verified, say so and list the checks performed. Do not invent findings.

Change:

{{CHANGE}}

Threat model:

{{THREAT_MODEL}}

Test command (if available):

{{TEST_COMMAND}}

How to use it

Paste a focused diff and identify the trust boundary. Keep secrets and production data out of the prompt.

Example

Finding: [High] Missing owner check

Path: api/ProjectController.php:42

Precondition: an authenticated user knows another project ID.

Impact: project context can be read across accounts.

Fix: scope the lookup by both project ID and current user ID.