Review this endpoint for SQLi/NoSQLi risk. Highlight where untrusted user input touches DB queries. If raw SQL or operators are interpolated, rewrite using parameterized queries (e.g., $1 placeholders in Postgres, ORM filters in Django/Rails, or prepared statements in Mongo/Mongoose). Add schema validation with Joi/Zod/NestJS DTOs before DB calls. Show both the insecure and the corrected version.

Check this auth/session logic. Ensure access tokens are short-lived (<15m) and refresh tokens are rotated with jti replay detection. Store tokens in HttpOnly + Secure + SameSite cookies. Show example fixes in my stack (Express/NestJS/Django/Rails). If localStorage is used for JWT, rewrite to HttpOnly cookie storage.

Scan this code for CSRF exposure. If it uses cookies for auth, inject anti-CSRF tokens, enforce SameSite=Strict, and verify Origin/Referer headers on money-sensitive routes. Add middleware in Express (csurf), Django ({% csrf_token %}), or Rails (protect_from_forgery). Show how an attacker could exploit it, then show a secure fix.

Check if this code renders untrusted HTML. If you see dangerouslySetInnerHTML, safe, or raw, sanitize with DOMPurify (React/Next.js), Bleach (Django), or Rails’ sanitize helper. Escape by default. Add a strict Content Security Policy (default-src 'self'; script-src 'self'). Output the attack payload, the vulnerable render, and the corrected safe code.

Confirm this app enforces HTTPS. If Express, enable trust proxy + redirect. If Rails/Django, set force_ssl or SECURE_SSL_REDIRECT. Add HSTS headers (max-age=31536000; includeSubDomains; preload). Show the config snippet for Nginx/Express/Rails/Django. Flag any downgrade or mixed content risks.

Audit password handling. Ensure hashing uses Argon2id (Node), PBKDF2 (Django), or bcrypt (Rails). Enforce ≥12 chars, rate-limit login attempts, and add 2FA option. Show insecure example (MD5, no rate-limit) and corrected version with secure hashing + express-rate-limit/Nginx rate-limits.

Check this WebSocket connection. If tokens are passed in query strings, replace with auth field in the handshake and verify JWT + Origin on connect. Reject if Origin mismatch or token invalid. Show example exploit (leaked query token) and secure fix for Express/Socket.io or Rails Action Cable.

Scan this repo for hardcoded secrets (API keys, DB creds, JWT secrets). If found, rewrite to use platform secrets/KMS (AWS SSM, GCP Secret Manager, Vault, Vercel/Netlify/Heroku env vars). Add rotation guidelines. Never log secrets. Show an example of insecure vs secure key usage.

Instrument this app for detection. Log failed logins, rate-limit triggers, refresh token replay (jti mismatch), and CSP violation reports. Pipe logs to ELK/Datadog. Show example Express middleware for logging anomalies + alert triggers. Suggest automated responses (force logout, 2FA step-up, alert Slack/PagerDuty).

Check this code for high-risk patterns: shell exec with user input (→ command injection), sendFile with untrusted path (→ path traversal), missing frame-ancestors (→ clickjacking), server-side fetch with arbitrary URLs (→ SSRF). Show the insecure example, attacker payload, and fixed version.