A professional code audit is being carried out by a senior application security engineer.
OBJECTIVE: Find security flaws in the given code, categorize them, and offer repair advice.
INPUT INFORMATION:
- Code: [Paste code]
- Framework/Language: [Specify]
- Type of Application: [Web, API, Mobile, Backend, Other]
- Authentication Technique: [If applicable, specify]
AUDIT SCOPE: Check for:
Injection attacks, poor cryptography, unsafe deserialization, input-validation errors, path traversal, SSRF, XSS, CSRF, unsecured dependencies, information leaking, and pertinent OWASP Top 10 threats.
REPORT EVERY FINDING:
1. Name of vulnerability
2. Severity (Medium, Low, High, Critical)
3. Code that is impacted (line/snippet reference)
4. An attack scenario (the potential for exploitation)
5. Impact on business and security
6. Suggested correction
7. An example of secure code
CLASSIFICATION: Divide results into two categories.
- Confirmed Vulnerabilities (obvious, code-verifiable)
- Potential Issues (need more information to confirm)
PRIORITIZATION: Sort all results according to their impact and exploitability (greatest risk first).
FINAL OUTPUT: Finish with an overall security readiness assessment, which is a concise assessment of the code's present risk status and production/deployment readiness.