Free Security Prompts for ChatGPT

Act as a senior security engineer with 10+ years specializing in appsec for engineering teams. I will give you the brief; you will deliver a ship-ready security review.

Brief: [PASTE BRIEF HERE].
Constraints: must be specific, measurable, and grounded in appsec best practice. Avoid generic advice and obvious tips.

Deliver:
1. The full security review (the actual artifact, not a description of it).
2. Three sharpening notes - what you would test or improve first.
3. One contrarian angle most security engineers miss.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

You are a brutal but constructive security engineer reviewing my security review. Your job is to make it 2x better, not to be polite.

My security review: [PASTE HERE].
Target risk reduction: [STATE TARGET].
Audience: engineering teams.

Return:
- 5 specific weaknesses, each tied to risk reduction.
- A rewritten security review that fixes them.
- A diff-style explanation of what changed and why.

Be blunt. Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Generate 10 meaningfully different security reviews from the same brief. Each variant must hit a different angle - not paraphrases.

Brief: [PASTE].
Audience: engineering teams.

For each variant provide:
- Angle name (1-3 words).
- Hook / opening line.
- Full security review.
- The single psychological lever it pulls (loss aversion, status, novelty, etc.).

End with your top pick and a one-line reason. Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Pick the single best-known appsec framework for this situation, name it, then walk me through applying it to my brief step by step.

My situation: [PASTE].
Goal: risk reduction.

Output:
1. Framework name + 1-line origin (so I can verify).
2. Each step labelled, with my inputs filled in.
3. The resulting security review.
4. Where the framework breaks down - and what to swap in.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Take my existing security review and rewrite it cleanly for three distinct audiences. Keep the core promise; change the vocabulary, references, and emotional register.

My security review: [PASTE].

Audiences:
A) engineering teams (current).
B) A skeptic who has been burned before.
C) An expert peer who could spot fluff in two seconds.

For each: full rewrite + 2-line note on what shifted. Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Compress the strongest possible security review into exactly 50 words. Every word must earn its place.

Brief: [PASTE].
Audience: engineering teams.

Deliver:
- The 50-word security review.
- The 3 words you would protect if forced to cut to 30.
- The cheap word you almost used and why you killed it.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Produce a security review that is optimized to be found and shared in the appsec space, not just to read well.

Topic: [PASTE].
Audience: engineering teams.
Primary keyword/phrase: [PASTE].

Deliver:
- The security review, with the primary phrase used naturally in title, opener, and one mid-point anchor.
- 5 semantic keywords you wove in (and where).
- 3 share-bait one-liners I could pull as social hooks.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Build a comparison matrix that ranks options for my appsec decision honestly.

Options: [LIST 3-6].
My priority: risk reduction.
Constraints: [PASTE].

Deliver:
1. A table - options × criteria - scored 1-5 with a one-line justification per cell.
2. The weighted winner.
3. The "wrong but obvious" pick most security engineers would default to, and why it loses.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Embody a precise engineering teams persona and react to my security review as they would, out loud.

The persona: [PASTE 3-5 traits - role, fear, current solution, last frustration].
My security review: [PASTE].

Deliver:
- 3 internal-monologue paragraphs as the persona reading the security review.
- The exact line where they would close the tab - and why.
- 2 edits that would make them keep reading.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Enumerate the edge cases and failure modes that could break my security review in production / in market / in front of engineering teams.

My security review: [PASTE].
Context: appsec.

Deliver:
- 12 edge cases, ranked by likelihood × damage.
- For each: the trigger, the symptom, and the cheapest mitigation.
- The single edge case I should design around first.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Stress-test my appsec plan and surface what could go wrong, with mitigations.

Plan: [PASTE].
Stakes: risk reduction.

Deliver:
1. 7 risks across execution, market, technical, legal, reputational.
2. For each - probability (L/M/H), impact (L/M/H), and a mitigation that costs less than the worst case.
3. The 1 risk worth accepting and the 1 risk worth killing the plan over.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Convert a great security review into a reusable template I can fill in repeatedly.

Reference security review: [PASTE].
What stays fixed: the structure and rhythm.
What varies: the inputs.

Deliver:
- The template with clearly marked [VARIABLES].
- A one-line description of each variable and example values.
- 2 worked examples using different inputs.
- The 1 line I should never let a junior change.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Design a 30-day plan to take me from where I am now to shipping a credible security review in appsec.

Starting point: [PASTE].
Time available per day: [PASTE].
End state: risk reduction.

Deliver:
- Week 1-4 milestones (1 sentence each).
- Daily 30-minute focus for every day, grouped by week.
- The 3 things I should NOT do during these 30 days.
- The checkpoint that proves I'm on track at day 14.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

I am seeing symptoms in my appsec work. Diagnose the most likely root causes and propose tests to confirm.

Symptoms: [LIST 3-6].
What I have already ruled out: [PASTE].
Tools available: [PASTE].

Deliver:
1. 3 candidate root causes, ranked by likelihood with a 1-line reason.
2. The fastest test to disprove each.
3. The order to run those tests, and stop conditions.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Design the end-to-end workflow a security engineer would run to produce a high-quality security review repeatedly.

Volume target: [PASTE].
Team size: [PASTE].
Quality bar: risk reduction.

Deliver:
- The workflow as a numbered sequence of steps.
- For each step: input, output, owner, tool, and time-box.
- Where to insert review gates without slowing the pipeline.
- The bottleneck step and how to relieve it.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Design a measurement plan for risk reduction in this appsec context.

Goal: risk reduction.
Audience for the dashboard: [PASTE].
Available data sources: [PASTE].

Deliver:
- The 1 north-star metric - defined precisely.
- 3 input metrics that move it, with formulas.
- 3 guardrail metrics so we don't optimize the wrong thing.
- Dashboard layout sketch (sections, charts, refresh cadence).
- The 1 vanity metric I am tempted to track and should not.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Build an objection-handling script for my security review aimed at engineering teams.

My offer / position: [PASTE].
The 3 most common objections I hear: [PASTE].

Deliver:
- For each objection: validate, reframe, evidence, ask.
- 2 objections I am probably not hearing but should expect.
- The single phrase to never say in response, and why.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Design an A/B test for my security review with one clear hypothesis.

Current security review: [PASTE].
Hypothesis (or what I'm curious about): [PASTE].
Traffic / sample size available: [PASTE].

Deliver:
- The hypothesis sharpened to one sentence.
- Variant A vs Variant B - only one variable changed.
- Primary metric and minimum detectable effect.
- Test duration and stop conditions.
- The decision rule before I peek at results.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Storyboard my security review as a 7-beat narrative arc.

Subject: [PASTE].
Audience: engineering teams.
Emotional outcome I want: [PASTE].

Beats: Hook → Stakes → Conflict → Attempt → Setback → Insight → Resolution.

For each beat: 1 sentence of action + 1 sentence of feeling. End with the single image the audience walks away with. Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Build a glossary of the 20 most important terms in appsec as it relates to security reviews and engineering teams.

For each term:
- The term.
- A precise 1-sentence definition (no jargon recursion).
- 1 concrete example.
- The most common misuse I should watch out for.

End with the 1 term that is overused and meaningless. Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Produce a one-page cheat sheet for shipping a security review in appsec.

Audience: engineering teams.
Bias toward action, not theory.

Sections:
1. The 5-step quick path.
2. 3 hard rules (never break).
3. 3 soft rules (break with a reason).
4. Top mistake at each step.
5. The single check before publishing / shipping / sending.

Plain text, dense, under 400 words. Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

List the most damaging anti-patterns in appsec when producing a security review.

Deliver:
- 8 anti-patterns.
- For each: a named label, a 1-line description, a real-sounding example of the failure, and the corrective principle.
- The anti-pattern that looks like best practice from the outside.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

My security review or appsec effort went wrong. Build me a recovery plan.

What happened: [PASTE].
Who noticed: [PASTE].
Reversibility (1=easy, 5=baked-in): [PASTE].

Deliver:
- The first 24 hours: communications and operational steps.
- The next 7 days: trust-rebuild moves.
- The 30-day move that turns this into a credibility gain.
- The 1 thing I must NOT do in the first 24 hours.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Build a 90-day roadmap for serious progress on risk reduction in appsec.

Current state: [PASTE].
End state: [PASTE].
Resources: [PASTE].

Deliver:
- Month 1 / Month 2 / Month 3 themes (1 line each).
- 3-5 outcomes per month - each measurable.
- Dependencies and the order they must clear.
- The single bet I should kill if month 1 underdelivers.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.

Build me a swipe file of exceptional security reviews in appsec to study, not copy.

My focus: risk reduction.
Audience I serve: engineering teams.

Deliver:
- 10 exemplary security reviews (real or plausibly real) with 1-line context for each.
- For each - the one technique to steal and the one tic to avoid.
- 3 patterns that show up across most of them.
- The exemplary security review that is overrated and why.

Ask one clarifying question only if a hard blocker remains; otherwise proceed with stated assumptions. Use plain language, no fluff, no filler. Quote evidence when citing sources.