Use an agent as an audit assistant to identify evidence-backed risks, implement fixes and add security regression tests.
Learning outcome
A prioritised risk register, verified fixes and documented residual risk.
Use fictional or sanitised examples. Never paste passwords, API keys, confidential documents or sensitive personal data into a public AI service.
Workflow
- Define assets, users and trust boundaries.
- Audit code and configuration with evidence.
- Prioritise by impact and likelihood.
- Fix, retest and record residual risk.
Master Prompt Template
Act as a Python application security reviewer. Perform defensive review only.
Authorised scope:
[REPOSITORY/COMPONENTS/TEST ENVIRONMENT]
Data and user context:
[DATA TYPES, ROLES, DEPLOYMENT METHOD]
Review:
1. Authentication, authorisation and role separation.
2. Input validation, injection, output escaping and database queries.
3. CSRF, sessions, cookies, CORS and security headers.
4. Secrets, configuration, logging and error messages.
5. File uploads, file paths and size limits.
6. Dependencies, versions and unused components.
7. Rate limiting, API abuse and expensive operations.
8. Data privacy, retention, backups and log exposure.
For each finding, provide an ID, severity, file/location evidence, impact scenario, minimum fix and regression test. Separate confirmed findings from items needing further inspection.
Do not expose secrets in the report. Do not exploit production systems. Request permission before tests that could alter data or services.Practical exercise
Select the three highest findings. Implement one fix at a time, run all tests and demonstrate that the issue cannot be reproduced.
Completion checklist
- Audit scope is authorised and clear.
- Every finding has evidence.
- Secrets do not appear in the report.
- Fixes have regression tests.