10 security prompts

Vulnerability review, threat modelling, configuration audit and incident response. Written for ChatGPT, Claude. Square brackets mark what you fill in; everything else can be pasted as it stands.

Review the code below. It handles [what it handles] and is reachable by [who can reach it].

Check only the classes that apply to this code, and say which you ruled out and why. For each finding, give the input that exploits it, what the attacker gains, and the fix.

Do not list generic advice. If the code is clean for a class, say so in one line.

<code>
[paste the code]
</code>

Here is a permission or policy configuration: [paste it].

Tell me what it permits that it probably was not meant to permit. Work from what the rules literally allow, not from their names.

For each over-permission, say what a holder could do with it and what the narrower version would look like.

Here is a vulnerability report for our dependencies: [paste it].

For each item, tell me whether the vulnerable code path is actually reachable given how we use the package — ask me what you need to know to decide.

Sort into: fix now, fix in the next cycle, and not applicable with a reason. Do not treat severity scores as the ranking.

We handle these secrets: [list them]. They are currently stored in [where] and reach the application by [how].

Describe what goes wrong with the current arrangement, in order of likelihood. Then propose the target arrangement and the migration order.

Be explicit about what is still exposed after the change — no arrangement removes all of it.

For [feature], tell me what to log so that an incident can be reconstructed afterwards.

For each log line: what event, what fields, and what must be excluded or redacted. Assume logs are readable by anyone on the engineering team.

Then say what question an investigator would be unable to answer from these logs.

Here is a configuration file: [paste it].

Identify everything reachable from outside, everything that defaults to permissive, and every place where a missing value would fail open rather than closed.

For each, give the specific line and the corrected value. Say which single change reduces exposure most.

Feature: [describe it]. Who can use it: [roles]. What it touches: [data and systems].

Work through: what an attacker would want from this, who could reach it, what they could do with each role's access, and what would be noticed versus silent.

Rank the risks by damage multiplied by plausibility. For the top three, give the control that addresses each.

Here is our authentication flow: [describe each step, including token lifetimes and where things are stored].

Walk through: what an attacker gains by stealing each artefact, what happens on logout, what happens when a password changes, and what happens when a session is active on two devices.

Name the weakest point and the smallest change that strengthens it.

Scenario: [what has been observed]. We know [what is confirmed] and do not know [what is unknown].

Write the first hour as an ordered checklist: what to preserve before changing anything, what to contain, who to notify and in what order, and what not to do yet.

Mark each step with whether it destroys evidence.

Here is a vendor's security page: [paste it]. We would send them [what data].

Separate what is a contractual commitment from what is a description of current practice. Note anything stated in a way that sounds like a guarantee but is not.

Then write the five questions I should send them, phrased so that a vague answer is obvious.