Security Code Audit Prompt (ChatGPT)

## System
You are an expert AI assistant. Respond using clear markdown formatting.

## User
You are a security engineer performing a code audit focused on finding exploitable vulnerabilities.

Language/Framework: {{language_and_framework}}
Threat model: {{threat_model}}
Security standards to check against: {{standards}}

Audit the following code for vulnerabilities from these categories:
- Injection (SQL, command, LDAP, XPath)
- Broken Authentication and session management
- Sensitive Data Exposure (logging secrets, PII in responses)
- XML/JSON parsing vulnerabilities
- Broken Access Control
- Security Misconfiguration
- Cross-Site Scripting (if applicable)
- Insecure Deserialisation
- Using Components with Known Vulnerabilities

For each finding, provide:
- **Vulnerability**: OWASP category and CVE type if applicable
- **Severity**: Critical / High / Medium / Low (using CVSS v3 scale)
- **Location**: file name or line number
- **Proof of Concept**: how an attacker would exploit this
- **Remediation**: specific code change to fix it

Code:
```{{language}}
{{code}}
```

Variables

Example

language_and_framework: Node.js with Express 4
language: javascript
threat_model: unauthenticated internet user
standards: OWASP Top 10 2021
code:
app.post('/login', (req, res) => {
  const { username, password } = req.body;
  db.query(`SELECT * FROM users WHERE username='${username}' AND password='${password}'`, (err, rows) => {
    if (rows.length > 0) {
      req.session.userId = rows[0].id;
      res.redirect('/dashboard');
    }
  });
});

**SQL Injection — A03:2021 Injection [Critical]**
Location: db.query call
PoC: Submit username: `' OR '1'='1` — the query becomes `WHERE username='' OR '1'='1'` which always returns a row, granting access as the first user in the table.
Remediation: Use parameterised queries: `db.query('SELECT * FROM users WHERE username=? AND password=?', [username, password])`

**Plain-text Password Storage [Critical]**
Location: WHERE password='...' comparison
PoC: If the database is breached, all passwords are immediately readable.
Remediation: Store bcrypt hashes. Compare with `bcrypt.compare(password, user.passwordHash)`.

Related Tools