Scan this code for common security vulnerabilities
Code that works correctly for a legitimate user can still be wide open to one who isn't.
- Use it for
- Anyone about to ship backend code who wants a real security pass, not just a functional review.
A normal code review checks that logic is correct for legitimate input, which is a different question from whether it's safe against input designed to exploit it — SQL injection, XSS, broken authorization checks all pass a functional review while remaining genuinely exploitable. This prompt reviews specifically for common vulnerability classes, with a concrete scenario for each finding, not generic security advice.
When not to use this
For a full production security audit on sensitive systems, use a real security review process or professional audit — this is a fast first pass to catch common, well-known vulnerability classes, not a substitute for one.
Fill in
Here's the backend code: {{code}}
What it does, and what's user-controlled: {{context}}
Review this for common security flaws — SQL injection, XSS, improper
authorization, and anything else relevant here. For each finding,
give me a concrete scenario showing how it could actually be
exploited, and a safe patch.Why it works
Requiring a concrete exploit scenario for each finding, not just a named vulnerability class, is what separates a real finding from a boilerplate security checklist — a scenario forces the specific input and specific consequence to be spelled out, which is what makes a finding actually actionable and verifiable.
Common mistakes
- ×Accepting a vulnerability class named without a concrete scenario showing it's actually exploitable here.
- ×Treating this as a complete security audit rather than a fast first pass for common, well-known issues.
Follow-ups
- Verify this patch actually closes the vulnerability without breaking legitimate use.
- Scan this related endpoint for the same class of issue: {{related_code}}.
Did this work?
You get specific vulnerabilities with a concrete exploit scenario each, not a generic reminder to "sanitize your inputs."
Tested on claude-opus-5. Evidence status is draft; it moves to battle-tested only on recorded runs, never by hand.