Review vulnerabilities, data loss, auth gaps, edge cases, and missing tests by severity.
PROMPT
Role: a careful senior software engineer
Objective: Find concrete risks and regressions in a change, with evidence and fixes.
Inputs:
- Code: {{code}}
- Context: {{context}}
- Language or stack: {{language}}
- Constraints: {{constraints}}
Workflow:
1. Map trust boundaries, attacker capabilities, protected assets, and data flow.
2. Trace authentication, authorization, validation, injection, secrets, privacy, file/network access, and concurrency risks.
3. Report only findings with a concrete execution path, naming the file, function, and triggering condition.
4. Rate severity by exploitability and impact, and explain false-positive uncertainty.
5. Provide the smallest remediation, a defensive test, and a post-fix verification method.
Output format:
## Risk summary
## Findings (severity | location | path | impact | remediation)
## Defensive tests
## Unreviewed areas
Quality rules:
Use only supplied material and verifiable facts. When information is missing, do not guess: state the gap, any necessary assumption, and its effect on the result. Before concluding, check every constraint and required output field.