P
💻DeveloppementAdvancedAll AIs

Secure a Web Application from A to Z

A comprehensive prompt to audit and secure a web application covering the OWASP Top 10, HTTP headers, authentication, input validation and secrets management.

Paste in your AI

Paste this prompt in ChatGPT, Claude or Gemini and customize the variables in brackets.

Tu es un expert en cybersécurité applicative spécialisé dans la sécurisation des applications web. Réalise un audit de sécurité complet pour mon application web avec les caractéristiques suivantes :

  • Stack technique : [STACK_TECHNIQUE] (ex : Next.js + PostgreSQL, Django + MySQL, Laravel + Redis)
  • Type d'application : [TYPE_APPLICATION] (ex : e-commerce, SaaS B2B, plateforme communautaire, backoffice interne)
  • Niveau de sensibilité des données : [NIVEAU_SENSIBILITE] (ex : données personnelles RGPD, données bancaires PCI-DSS, données publiques uniquement)
  • Environnement de déploiement : [ENVIRONNEMENT] (ex : AWS, VPS auto-hébergé, Vercel, Docker sur Kubernetes)

Pour chaque point, fournis :

  1. Analyse des vulnérabilités OWASP Top 10 : passe en revue chacune des 10 catégories (injection, broken authentication, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, using components with known vulnerabilities, insufficient logging) et évalue le risque spécifique à ma stack.

  2. Checklist de sécurisation prioritaire : liste ordonnée par criticité des actions à mener, avec pour chacune un exemple de code ou de configuration concret adapté à ma stack.

  3. Headers HTTP de sécurité : fournis la configuration complète recommandée (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) avec les valeurs adaptées à mon type d'application.

  4. Authentification et gestion des sessions : recommandations spécifiques (JWT vs sessions, durée de vie des tokens, refresh tokens, rate limiting, 2FA) avec implémentation concrète.

  5. Validation et sanitisation des entrées : stratégie complète côté client et serveur, avec exemples de middleware ou de fonctions de validation pour ma stack.

  6. Sécurisation de la base de données : requêtes paramétrées, principe du moindre privilège, chiffrement at rest et in transit, stratégie de backup sécurisé.

  7. Gestion des secrets et variables d'environnement : bonnes pratiques pour le stockage, la rotation et l'injection des secrets en production.

  8. Logging et monitoring de sécurité : quels événements logger, format recommandé, alertes à configurer, outils adaptés à mon environnement.

  9. Plan de réponse aux incidents : procédure en cas de faille détectée, communication, rollback, et post-mortem.

Formate ta réponse avec des sections claires, du code concret quand pertinent, et priorise les recommandations par niveau de risque (critique, élevé, moyen, faible).

Personalize this prompt with Léa

Léa rewrites this prompt for your job and your exact goal — 3 quick questions.

Why this prompt works

<p>This prompt transforms the AI into a cybersecurity consultant who performs a personalized audit of your web application. By entering your tech stack, application type, data sensitivity level and deployment environment, you get concrete, tailored recommendations rather than generic advice.</p><p>The 9-section structure covers the entire application security perimeter: from OWASP vulnerabilities to HTTP headers, through secrets management and incident response planning. Each section explicitly requests <strong>concrete code examples</strong> adapted to your stack, making recommendations directly actionable.</p><p><strong>Usage tip</strong>: first run the prompt with your variables, then dive deeper into each section individually for more detail. You can also paste excerpts of your code for a targeted security review of your existing implementations.</p>

Use Cases

Audit application security before production deploymentPrepare a security checklist for a code reviewProperly configure HTTP headers and authenticationBring an application into compliance with OWASP standardsTrain a development team on security best practices

Expected Output

A structured audit report in 9 sections with OWASP risk analysis, prioritized checklist, HTTP header configurations, authentication recommendations, input validation examples, database and secrets management best practices, all with concrete code adapted to your tech stack.

Improve this prompt

Run this prompt through the Optimizer to strengthen its context, constraints and expected format.

Improve this prompt with the Optimizer

Comments

  • LéaAI

    Ajoutez un champ `Stade du projet` (MVP / beta / production) pour affiner le niveau de priorité : en MVP, concentrez-vous sur l’OWASP Top 10 et l’authentification ; en production, poussez la sécurisation des secrets, monitoring et plan d’incident.

Glossary Terms

ContextEmbeddingFew-Shot PromptingFine-TuningGPTGuardrailsInferenceLLM

📬 Get new prompts every week

Join our newsletter and never miss a prompt.

Go further

Improve this prompt with the Optimizer

Analyze the prompt, strengthen the context and get a more precise version.

Prompt Engineering

Cross-model principles for writing more reliable prompts.

Similar Prompts

💻DeveloppementIntermediateAll AIs

Set up semantic versioning automation

Automate semantic versioning

0254
💻DeveloppementIntermediateGemini

Gemini Prompt to Create a REST API

Creating a REST API is a fundamental skill in modern development, but it involves many architectural decisions: choice of framework, endpoint structure, authentication management, data validation, and documentation. Google Gemini excels at generating structured code and can guide you through each step of this process. Using a well-crafted prompt, you not only get the skeleton of your API but also best practices built in from the start: proper HTTP codes, centralized error handling, security middleware, and layered architecture. Whether you're building a microservice for a personal project or an enterprise API designed to handle thousands of requests, Gemini adapts its response to the requested complexity level. The main benefit is time savings during the scaffolding phase: instead of spending hours manually configuring each component, you get a solid, coherent foundation in seconds, which you can then customize to your specific business needs.

0304
💻DeveloppementIntermediateGemini

Gemini Prompt for Creating a Chatbot

Gemini, Google's artificial intelligence model, offers remarkable capabilities for designing high-performance chatbots tailored to your needs. Whether you want to create a customer assistant for your e-commerce site, a technical support bot or a conversational companion, Gemini excels at understanding natural language nuances and generating contextual responses. Thanks to its extended context window and multimodal capability, Gemini enables building chatbots that can process text, images and even documents. The main challenge lies in the quality of the initial prompt that will define your chatbot's personality, tone, limits and skills. A well-structured prompt transforms Gemini into a true conversational architect, capable of generating the code, dialogue flows and business logic needed. In this guide, we offer optimized prompts to get the most out of Gemini when creating chatbots, from rapid prototyping to production deployment with error handling and advanced customization.

0409
💻DeveloppementBeginnerAll AIs

Write an ORM query

Write efficient ORM queries

0255