What this prompt does
This prompt generates an OWASP Top 10 (2021) code audit checklist tailored to your [language] and [framework]. For each vulnerability it produces a description and risk level, specific code patterns to search for in [language], grep/search commands to find vulnerable code, before/after fix examples, an automated testing approach, recommended security headers and config, and detection tools, with extra focus on [priority_vulns] and your [app_context], output as a shareable [format] checklist.
The structure works because a generic OWASP list flags categories but doesn't get vulnerabilities fixed. By grounding each item in concrete [language] patterns plus grep commands and before/after fixes, the checklist becomes something a reviewer can work through without you in the room. Focusing on [priority_vulns] for your specific [app_context] (say, payment processing) means the highest-risk issues for your app rise to the top instead of being buried in boilerplate.
When to use it
- Running a security pass on a
[language][framework]codebase before a release or audit. - Giving a reviewer a self-contained checklist with grep commands they can run themselves.
- Prioritizing
[priority_vulns]that matter most for your[app_context]. - Standardizing security reviews so each language has a consistent, repeatable checklist.
- Producing before/after fix examples that show developers exactly what to change.
- Building a security regression suite so closed vulnerabilities stay closed.
Example output
You get a [format] checklist (Markdown with checkboxes by default), organized by OWASP Top 10 category. Each entry has a risk level, the [language]-specific anti-patterns to look for, copy-pasteable grep/search commands, a before/after fix snippet, a testing approach, recommended headers/config, and tool suggestions. It closes with a prioritized remediation plan, effort estimates per fix, and a security regression test outline, weighted toward [priority_vulns].
Pro tips
- Set
[app_context]precisely; "e-commerce with payment processing" surfaces very different risks than a static marketing site. - List your true
[priority_vulns]so the checklist front-loads what would hurt you most, not generic items. - Treat the grep commands as a starting net; they catch obvious patterns but miss obfuscated or indirect cases.
- Always pair the checklist with a real SAST tool; an LLM checklist complements automated scanning, it doesn't replace it.
- Adapt the before/after fixes to your
[framework]'s idioms rather than pasting them verbatim. - Keep one checklist per
[language]so a reviewer can run it end to end without context-switching.
