Secure a Web Application from A to Z
A comprehensive prompt to audit and secure a web application covering the OWASP Top 10, HTTP headers, authentication, input validation and secrets management.
Paste in your AI
Paste this prompt in ChatGPT, Claude or Gemini and customize the variables in brackets.
You are an application security expert specializing in securing web applications. Perform a complete security audit of my web application with the following characteristics:
- Tech stack: [tech stack] (e.g., Next.js + PostgreSQL, Django + MySQL, Laravel + Redis)
- Application type: [application type] (e.g., e-commerce, B2B SaaS, community platform, internal back office)
- Data sensitivity level: [sensitivity level] (e.g., GDPR personal data, PCI-DSS banking data, public data only)
- Deployment environment: [environment] (e.g., AWS, self-hosted VPS, Vercel, Docker on Kubernetes)
For each point, provide:
-
OWASP Top 10 vulnerability analysis: go through each of the 10 categories (injection, broken authentication, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, using components with known vulnerabilities, insufficient logging) and assess the risk specific to my stack.
-
Priority security checklist: an ordered list of actions by criticality, with a concrete code or configuration example tailored to my stack for each one.
-
HTTP security headers: provide the complete recommended configuration (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) with values suited to my application type.
-
Authentication and session management: specific recommendations (JWT vs. sessions, token lifetime, refresh tokens, rate limiting, 2FA) with concrete implementation.
-
Input validation and sanitization: a complete client-side and server-side strategy, with examples of middleware or validation functions for my stack.
-
Database security: parameterized queries, principle of least privilege, encryption at rest and in transit, secure backup strategy.
-
Secrets and environment variable management: best practices for storing, rotating, and injecting secrets in production.
-
Security logging and monitoring: which events to log, recommended format, alerts to configure, tools suited to my environment.
-
Incident response plan: procedure in case of a detected vulnerability, communication, rollback, and post-mortem.
Format your response with clear sections, concrete code where relevant, and prioritize recommendations by risk level (critical, high, medium, low).
Personalize this prompt with LĂ©a
Léa rewrites this prompt for your job and your exact goal — 3 quick questions.
Why this prompt works
<p>This prompt transforms the AI into a cybersecurity consultant who performs a personalized audit of your web application. By entering your tech stack, application type, data sensitivity level and deployment environment, you get concrete, tailored recommendations rather than generic advice.</p><p>The 9-section structure covers the entire application security perimeter: from OWASP vulnerabilities to HTTP headers, through secrets management and incident response planning. Each section explicitly requests <strong>concrete code examples</strong> adapted to your stack, making recommendations directly actionable.</p><p><strong>Usage tip</strong>: first run the prompt with your variables, then dive deeper into each section individually for more detail. You can also paste excerpts of your code for a targeted security review of your existing implementations.</p>
Use Cases
Expected Output
A structured audit report in 9 sections with OWASP risk analysis, prioritized checklist, HTTP header configurations, authentication recommendations, input validation examples, database and secrets management best practices, all with concrete code adapted to your tech stack.
Improve this prompt
Run this prompt through the Optimizer to strengthen its context, constraints and expected format.
Improve this prompt with the OptimizerComments
- LĂ©aAI
Ajoutez un champ `Stade du projet` (MVP / beta / production) pour affiner le niveau de priorité : en MVP, concentrez-vous sur l’OWASP Top 10 et l’authentification ; en production, poussez la sécurisation des secrets, monitoring et plan d’incident.
📬 Get new prompts every week
Join our newsletter and never miss a prompt.
Go further
Similar Prompts
Implement Clean Architecture in Practice
Implement Clean Architecture in practice with layers, ports and adapters, use cases, and unit tests without infrastructure.
REST API for ML Model
Exposing a model via an API
Write a deployment script
Automate deployment scripts
Create a Robust and Secure Webhooks API
A complete prompt to generate a production-ready webhooks API with subscription management, cryptographic signatures, intelligent retries and observability.