AI Security Audit Workflow

Perform a threat model for my application: Type: [web app/API/mobile], Auth: [method], Data sensitivity: [describe], Infrastructure: [cloud provider/setup]. Use the STRIDE framework. For each threat: describe the attack scenario, likelihood (low/medium/high), impact severity, and which component is vulnerable. Prioritize by risk score.

Review this code for security vulnerabilities: [paste code]. Check for: SQL/NoSQL injection, XSS (stored, reflected, DOM-based), authentication/authorization bypasses, insecure direct object references, CSRF vulnerabilities, sensitive data exposure, and insecure dependencies. For each finding: severity, exact location, and fix.

Audit this configuration for security issues: [paste config files, docker-compose, nginx conf, etc.]. Check: exposed ports, default credentials, missing security headers, overly permissive CORS, insecure TLS settings, unencrypted secrets, and missing rate limiting. For each issue: what's wrong, the risk, and the exact fix.

Create a security remediation plan from these findings: [paste findings]. For each vulnerability: priority (critical/high/medium/low), specific fix with code example, estimated effort, verification step to confirm the fix works, and regression test to add. Group by: fix immediately, fix this sprint, and fix this quarter.