Security Fix Review and Patch Validation
Verify that a vulnerability fix is complete.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
Review a security fix and verify that it fully closes the vulnerability. Vulnerability description: [VULNERABILITY_DESCRIPTION]. Language and framework: [LANGUAGE_AND_FRAMEWORK]. The original vulnerable code: [PASTE_ORIGINAL_CODE]. The fix (diff or new code): [PASTE_FIX]. Tests added: [TESTS]. Check each item and answer Yes, No, or Unclear, with a reference to the code: [ ] The root cause is addressed, not just the reported example [ ] All similar code paths are fixed (list the places to search: other endpoints, helpers, templates, jobs) [ ] The fix uses the right control (parameterized queries, context-aware output encoding, allow lists, authorization checks on the server, safe deserialization) and not a block list or a custom sanitizer [ ] Input validation happens at the right layer and cannot be bypassed by alternate encodings, case changes, or parameter pollution [ ] Authorization is checked on every path, including indirect object references [ ] Error handling does not leak sensitive details [ ] No new vulnerability is introduced (race conditions, denial of service, logging secrets) [ ] Tests include the original exploit, variants, and normal use [ ] Dependencies and configuration are updated where relevant [ ] The fix does not break legitimate behavior [ ] Logging and monitoring can detect attempts [ ] Credentials are rotated if exposure is possible Give a verdict (complete, partial, inadequate), the bypasses you would try (described conceptually), additional tests, and a disclosure note if customers are affected.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.