PromptDev
Review a form for security issues
A prompt for walking a form or endpoint through a concrete security checklist — validation, authz, rate limits, injection, CSRF — ranked.
Last updated
Fill in the blanks
Assembled in your browser — nothing you type is stored or sent anywhere.
Your prompt
Review this form or endpoint for security issues: [paste the form fields, endpoint code, or route handler here].
Walk it against each of these, and report only what actually applies to what's described here — no generic security lecture: input validation (type, length, and allowed values on every field); authorization (can a user act on someone else's data, and is the check enforced server-side); rate limiting (can it be spammed or brute-forced); injection (SQL, command, template, or stored XSS via input rendered elsewhere); and CSRF (a state-changing request with no token check, if this is browser-form-based). Rank findings by exploitability, and for each one give the concrete request an attacker would send. If something isn't described precisely enough to judge — for instance whether there's a server-side auth check — list it as a question instead of assuming the best or worst case.
Model-agnostic — works in Claude, ChatGPT, Gemini or any AI chat.
Why this prompt works
- →Naming the five checks explicitly stops the review from drifting into a generic "use HTTPS and sanitize input" lecture that says nothing about this particular form.
- →Requiring the concrete attacker request per finding separates theoretical risk from exploitable risk — a finding that can't be turned into an actual request usually isn't actionable yet.
- →The instruction to ask rather than assume the best or worst case keeps both false alarms and false confidence in check, since security reviews otherwise tend toward one extreme or the other.