OWASP-AI-Security-Prompts

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #ai #go #golang #machine-learning #rust #nodejs #java #windows #awesome #mcp

OWASP-AI-Security-Prompts

(★ 19)

AI prompts that teach Claude, ChatGPT, and Cursor to identify and fix OWASP Top 10 vulnerabilities in code. Transform any AI assistant into a security focused code reviewer.

OWASP-AI-Security-Prompts Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# OWASP AI Security Prompts - Secure Code Review with AI

Transform Claude, ChatGPT, and Cursor into expert security code reviewers using specialized prompts based on the OWASP Top 10:2021.

## What This Is

Three specialized AI prompts that teach language models to identify and fix security vulnerabilities:

- **OWASP Top 10 coverage** - All major web application security risks
- **Actionable fixes** - Specific code changes, not just warnings
- **Security patterns** - Secure coding practices and prevention
- **Context aware** - Framework-specific security guidance

## Real Results

Used these prompts to secure production applications across multiple tech stacks. The AI identified critical vulnerabilities that traditional linters missed.

**Before**: SQL injection vulnerabilities in authentication logic  
**After**: Parameterized queries with proper input validation

**Before**: Hardcoded API keys scattered throughout codebase  
**After**: Secure configuration management with encrypted secrets

## What's Included

- **`security-code-reviewer.md`** - General purpose security analysis
- **`cursor-security-prompt.md`** - IDE-integrated vulnerability scanning
- **`secure-development-assistant.md`** - Development workflow security guidance
- **`owasp-examples/`** - Real vulnerability examples and fixes
- **`reference/`** - Quick OWASP Top 10 cheat sheets

## Quick Start

1. **Clone this repo**

```bash
git clone git@github.com:Alexanderdunlop/OWASP-AI-Security-Prompts.git
```

2. **Choose your AI tool and prompt**

- Claude/ChatGPT → Use `security-code-reviewer.md`
- Cursor → Use `cursor-security-prompt.md`
- Development workflow → Use `secure-development-assistant.md`

3. **Extract your code context** (recommended)

```bash
# For JavaScript/TypeScript
npx repomix --include "src/**" --output context.xml

# For Python
python onefilellm.py ./src/ --output context.xml
```

4. **Apply the prompt**

- Paste the prompt into your AI tool
- Include your code context
- Submit code for security review

## Best Practices

### For New Projects

Use the development assistant prompt to build security practices into your workflow from day one.

### For Existing Codebases

1. Start with authentication and authorization logic
2. Focus on user input handling and data validation
3. Review external integrations and API endpoints
4. Scan configuration and deployment settings

### The Security-First Combination

These prompts work best with context extraction tools:

- [repomix](https://github.com/yamadashy/repomix) (JS/TS)
- [onefilellm](https://github.com/jimmc414/onefilellm) (Python)

## OWASP Top 10:2021 Coverage

The prompts identify and help fix:

- **A01 Broken Access Control** - Authorization bypass, privilege escalation
- **A02 Cryptographic Failures** - Weak encryption, exposed secrets
- **A03 Injection** - SQL, NoSQL, OS command injection
- **A04 Insecure Design** - Missing security controls, business logic flaws
- **A05 Security Misconfiguration** - Default configs, unnecessary features
- **A06 Vulnerable Components** - Outdated dependencies, known CVEs
- **A07 Authentication Failures** - Weak passwords, session management
- **A08 Data Integrity Failures** - Insecure deserialization, supply chain
- **A09 Logging Failures** - Missing audit trails, log injection
- **A10 Server-Side Request Forgery** - SSRF vulnerabilities

## Original Source

Based on the [OWASP Top 10:2021](https://owasp.org/Top10/) - the global standard for web application security risks.

OWASP Foundation provides open-source security guidance used by developers and organizations worldwide.

## Examples

### Before (Vulnerable)

```javascript
// SQL injection vulnerability
app.get("/user", (req, res) => {
  const query = `SELECT * FROM users WHERE id = ${req.query.id}`;
  db.query(query, (err, results) => {
    res.json(results);
  });
});
```

### After (Secure)

```javascript
// Parameterized query with input validation
app.get("/user", (req, res) => {
  const userId = parseInt(req.query.id);
  if (!userId || userId < 1) {
    return res.status(400).json({ error: "Invalid user ID" });
  }

const query = "SELECT * FROM users WHERE id = ?";
  db.query(query, [userId], (err, results) => {
    res.json(results);
  });
});
```

## Related Resources

- [OWASP Top 10:2021](https://owasp.org/Top10/)
- [OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/)
- [OWASP Application Security Verification Standard](https://owasp.org/www-project-application-security-verification-standard/)
- [How I Turn Any GitHub Repo Into Perfect AI Context](https://medium.com/vibe-coding/how-i-turn-any-github-repo-into-perfect-ai-context-game-changer-71919d497531)

## Contributing

Found security issues in the prompts? Discovered new vulnerability patterns? PRs welcome!

---

_Not affiliated with OWASP Foundation, Anthropic, or any tools mentioned. These are security focused prompts developed from real world development work._

OWASP-AI-Security-Prompts

OWASP-AI-Security-Prompts Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

OWASP-AI-Security-Prompts

OWASP-AI-Security-Prompts Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README