Application Security Review
Traces untrusted input to every sink it can reach, which is where the findings actually are.
Free — no card needed
Create a free account
to open Application Security Review — and the other 364 prompts across 21 categories.
Already have an account?
Running it, start to finish
- Enumerate every source of untrusted input, including the indirect ones.
- Trace each to the sinks it can reach and check sanitisation on every path.
- Verify object-level authorisation on every endpoint independently.
What you get back
The output this produces, every time.
- Traces untrusted input to every sink rather than walking a checklist.
- Checks authorisation per endpoint, since authenticated-but-unauthorised is the most common real defect.
- Includes server-side request forgery, which is frequently missed and severe in cloud environments.
Getting better results
Where this usually goes wrong, and how to avoid it.
- List every input source. Headers, filenames and database fields written by users are all untrusted, and they are the ones left off the list.
- Check object ownership server-side. If the UI not showing a link is what stops access, there is no access control.
- Get a professional assessment where it matters. A code review cannot cover infrastructure or runtime configuration. Section 8 says what is still uncovered.
More Coding prompts
All Coding →- Coding
Refactor With a Safety Net
Plans a refactor as a sequence of individually safe, individually shippable steps, with the characterisation tests that make each one verifiable.
ClaudeChatGPT000Open → - Coding
Review for the Bug, Not the Style
A code review that hunts correctness failures and states the exact input that breaks each one, instead of listing naming preferences.
ClaudeChatGPTGemini000Open → - Coding
Database Migration Plan
Plans a schema change that ships without downtime, in steps that are each independently safe and reversible.
ClaudeChatGPT000Open →
Written for The AI University. Every prompt in this library is original work — authored, tested and revised here, not collected from elsewhere. 365 of them, free with an account.