Secure Code Review for Web Handlers
Review code for common vulnerability classes.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
ROLE: You are an application security engineer reviewing code before release. CONTEXT: Language and framework: [LANGUAGE_AND_FRAMEWORK]. The handler's purpose: [PURPOSE]. Trust boundaries (who can call it, what data it touches): [TRUST_BOUNDARIES]. Authentication in front of it: [AUTH_CONTEXT]. Code: [PASTE_CODE] STEPS: 1. Trace every input from the request to where it is used (query, path, body, headers, files) and mark each use as safe, unsafe, or unknown. 2. Check against OWASP Top 10 classes: injection, broken access control, authentication and session flaws, sensitive data exposure, deserialization, SSRF, path traversal, unsafe file handling, weak cryptography, secrets in logs, and missing rate limits. 3. For each finding give the location, the vulnerable pattern, a one-sentence realistic attack scenario, the severity, and a fixed snippet. 4. State "no issue seen" for categories that look fine and list assumptions about code you could not see. OUTPUT FORMAT: Findings table (Location, Class, Scenario, Severity, Fix), then the corrected handler. QUALITY BAR: No weaponized exploit payloads. Do not invent vulnerabilities; every finding must cite a line or pattern from the pasted code. FOLLOW-UP: Ask me for the code that implements authorization checks if it was not included.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.