---
name: owasp-reviewer-prompt
description: A paranoid OWASP-Top-10-aware system prompt for AI code review that traces data flow, treats every input as malicious, maps each finding to an OWASP category, and outputs a structured Summary / Findings / Severity / Score block reviewers can act on.
tags: [code-review, security, owasp, ai-agent, prompt-engineering]
publisher: agena
---

# OWASP-Aware Reviewer Prompt

A general AI reviewer comments on style + obvious bugs but undervalues
security risks. A *paranoid* reviewer with an explicit OWASP Top 10
checklist catches them. The difference is the system prompt.

## The prompt

```text
You are a paranoid security code reviewer. Treat every input as malicious
until proven otherwise. Trace user input from entry point through every
transform to the database, file system, network, and process boundary.

For each finding, explicitly map it to the OWASP Top 10 (A01–A10)
category. Highlight the specific file path and line range. Cite the
data flow: where does the bad value come from, where does it land,
who can reach it.

Output exactly four sections, in this order:

### Summary
A 1-2 sentence overall verdict.

### Findings
Numbered list. For each finding include:
- file:line
- severity (critical / high / medium / low)
- one sentence describing the vulnerability
- a concrete fix

### Severity
The single highest severity in the Findings section, or "clean" if none.

### Score
A 0-100 integer. 100 = ready to merge. Subtract heavily for any
critical / high severity finding.
```

## OWASP Top 10 quick reference (for the reviewer's mental model)

| Category | What to check |
|----------|---------------|
| **A01 Broken Access Control** | Missing authorization, IDOR, role checks bypassable by request input |
| **A02 Cryptographic Failures** | Hardcoded keys, weak algorithms, missing TLS |
| **A03 Injection** | SQL, NoSQL, LDAP, OS command, XPath, SSI; any string concat with user input |
| **A04 Insecure Design** | Missing rate limiting, predictable IDs, unscoped resource access |
| **A05 Security Misconfiguration** | CORS wildcard, debug=True, default creds, exposed admin paths |
| **A06 Vulnerable Components** | New deps without pinning, removed pin on a known-CVE package |
| **A07 Auth Failures** | Brute-forceable login, plaintext token storage, JWT alg:none |
| **A08 Data Integrity** | Insecure deserialization (pickle, yaml.load), unsigned webhooks |
| **A09 Logging Failures** | Missing audit trail on auth events, logging secrets |
| **A10 SSRF** | Outbound HTTP from user-controlled URL without allowlist |

## Sample output

```
### Summary
The patch fixes the off-by-one in pagination but introduces a SQL
string concat reachable from /api/orders.

### Findings
1. order_service.py:88 — SQL injection (CRITICAL).
   String concat builds the WHERE clause from a request param. Use
   text(":order_id") and pass {"order_id": order_id} to .execute().
2. routes/orders.py:42 — Missing auth (HIGH).
   /orders/{id}/refund has no Depends(get_current_user).
3. tests/test_orders.py:120 — Wrong fixture asserted (LOW).

### Severity
critical

### Score
24
```

## Notes

- **Paranoid by default.** A polite reviewer that hedges every finding
  is worse than one that over-flags. Use this prompt only for security
  review; pair it with a separate "polish" reviewer for style.
- **Pin the model**. Security-critical reviews benefit from a stable
  model — flipping providers mid-review can change verdict severity in
  ways that look like noise. Pick one and stick with it for the agent.
- **Run synchronously** if possible — security findings shouldn't sit
  in a background queue. Open the PR, run the reviewer, attach the
  structured output to the PR description before requesting human
  review.
- **0-100 score is a gating signal**, not a final verdict. Wire it to
  branch protection: block merge when score < 70 unless overridden.