Vulnerability Scanner

The Problem

Security vulnerabilities hide in plain sight. SQL injection in a query builder, XSS in a template literal, broken authentication in a middleware — these flaws pass code review because reviewers focus on functionality, not exploitation. You need a dedicated security pass that thinks like an attacker, not a feature developer.

The Prompt

You are a senior application security engineer. Perform a security audit on the following code, thinking like an attacker trying to exploit it.

LANGUAGE/FRAMEWORK: [e.g., Node.js/Express, Python/Django, PHP/Laravel]
APPLICATION TYPE: [e.g., REST API, web app with auth, e-commerce]

CODE:
[paste your code here — focus on auth, input handling, database queries, or API endpoints]

Scan for these vulnerability categories (OWASP Top 10 2021):

1. **A01 — Broken Access Control**: Missing auth checks, IDOR, privilege escalation
2. **A02 — Cryptographic Failures**: Weak hashing, plaintext secrets, insecure transmission
3. **A03 — Injection**: SQL, NoSQL, OS command, LDAP, template injection
4. **A04 — Insecure Design**: Missing rate limits, business logic flaws
5. **A05 — Security Misconfiguration**: Debug mode, default credentials, verbose errors
6. **A06 — Vulnerable Components**: Known CVEs in dependencies
7. **A07 — Auth Failures**: Weak passwords, missing MFA, session issues
8. **A08 — Data Integrity Failures**: Insecure deserialization, unsigned updates
9. **A09 — Logging Failures**: Missing audit logs, sensitive data in logs
10. **A10 — SSRF**: Unvalidated URLs in server-side requests

For each vulnerability found:
- **Severity**: Critical / High / Medium / Low
- **Attack Scenario**: How an attacker would exploit this
- **Affected Code**: Exact line or function
- **Fix**: Secure code replacement

Example Output

## Security Audit: 3 vulnerabilities found

### CRITICAL: SQL Injection (A03)
Line 28: `db.query("SELECT * FROM orders WHERE user_id = " + req.params.id)`
Attack: Attacker sends `/orders/1 OR 1=1` to dump all orders.
Fix: `db.query("SELECT * FROM orders WHERE user_id = $1", [req.params.id])`

### HIGH: Broken Access Control (A01)
Line 45: `/api/users/:id` endpoint has no ownership check.
Attack: User A can access User B's data by changing the ID parameter.
Fix: Add `if (req.user.id !== req.params.id) return res.status(403).json({error: "Forbidden"})`

### MEDIUM: Missing Rate Limit (A04)
`/api/login` has no rate limiting.
Attack: Brute-force password attempts at unlimited speed.
Fix: Add express-rate-limit with max 5 attempts per minute per IP.

When to Use

Run this on every authentication flow, API endpoint, or database interaction before deployment. Essential when handling user input, financial data, or personal information. Use it as a pre-PR security gate for any code that touches auth, payments, or data access.

Pro Tips

• Scan one concern at a time — for large codebases, audit auth flows separately from data access layers for more thorough results.
• Include your middleware stack — paste your auth middleware alongside the route handler so the AI can verify the full request chain.
• Ask for exploit proof — follow up with “Write a curl command that demonstrates how to exploit the SQL injection you found” to understand the real-world risk.