prompt
FreeSecurity-first code review prompt for AI assistants
FreeFree tier
About prompt
A comprehensive system prompt designed for AI assistants to perform thorough, security-first code reviews. It instructs the AI to act as an expert application security engineer and senior code reviewer, identifying vulnerabilities, enforcing best practices, and providing actionable, production-ready fixes. The prompt covers the OWASP Top 10:2021 (updated for 2025), defense in depth, least privilege, and fail secure principles. It also includes a detailed checklist for each vulnerability category (broken access control, cryptographic failures, injection, insecure design, etc.) and a review philosophy emphasizing that all user input is potentially malicious.
Key Features
Reviews against OWASP Top 10:2021 vulnerabilities
Assumes all user input is potentially malicious
Applies defense in depth and least privilege principles
Requires fail-secure handling for errors and edge cases
Provides actionable, production-ready fix recommendations
Covers broken access control, cryptographic failures, injection, insecure design, and more
Checks for hardcoded secrets, insecure direct object references, and CORS misconfigurations
Validates SQL, NoSQL, LDAP, XML, and XPath injection vulnerabilities
Enforces use of cryptographically secure random values and up-to-date TLS
Pros & Cons
Pros
- Comprehensive OWASP Top 10 coverage with detailed checklists
- Encourages actionable, production-ready fixes rather than generic warnings
- Free and open source, available on GitHub
- Emphasizes both security and maintainability
- Suitable for integration with various AI assistants and code review workflows
Cons
- Requires an AI assistant or language model to execute the prompt
- Focused exclusively on security; does not address performance, style, or logic errors
- Prompt is long (over 180 lines) and may exceed context limits of some models
- May produce verbose output depending on the AI's interpretation
Best For
Integrating security code reviews into CI/CD pipelinesPerforming vulnerability assessments on pull requestsAuditing existing codebases for security weaknessesEducating developers on secure coding practicesAutomating security checks with AI-assisted code review tools
FAQ
What is this prompt for?
It is a system prompt designed for AI assistants to perform security-focused code reviews. It instructs the AI to act as an expert security engineer and review code against the OWASP Top 10 and other best practices.
Is the prompt free to use?
Yes, it is open source and hosted freely on GitHub in the ai-boost/awesome-prompts repository.
What standards does the prompt cover?
It covers the OWASP Top 10:2021 (updated for 2025) and includes principles from OWASP AI Security Prompts, OpenSSF Security-Focused Guide for AI Code Assistants, and Crash Override LLM Security Review patterns.
Can I modify the prompt for my needs?
Yes, since it is open source, you can fork the repository and customize the prompt to fit your specific code review requirements.