Code Audit
Code Audit Before You Ship
Run a structured audit: correctness, security, a11y, and dead code - with file:line findings, not vibes.
The Prompt
code-audit-before-you-ship.md
Audit this change / area as a staff engineer doing a pre-merge review. Scope: {{scope}} What this code is supposed to do: {{intent}} Risk level (auth, payments, public page, internal): {{risk}} Report only findings, grouped: 1. Correctness / edge cases 2. Security (injection, authz, secrets, SSRF, unsafe HTML) 3. Accessibility and keyboard use if UI is in scope 4. Performance only if you can point to a real cost 5. Tests that are missing for the failures you found Each finding: file path, what's wrong, why it matters, and a concrete fix. Severity: high / med / low. Do not nitpick naming. Do not suggest a rewrite unless the design cannot meet {{intent}}.
Negative prompt
Included when you copy the prompt
Do not nitpick naming, formatting, or taste. Do not suggest a full rewrite unless the design cannot meet {{intent}}. Do not invent findings outside {{scope}}. Do not list performance issues without a concrete cost (N+1, unbounded list, sync work on the critical path). Do not skip security when {{risk}} involves auth, payments, or public input. Do not pad the report with empty categories - omit them.
Fill in your details below - this prompt updates as you type, then copy it.
Fill in your details
0 of 3 filled. Preview updates as you type - then copy the finished prompt (negative prompt included when present).
code-audit-before-you-ship.md
Prompt preview
Audit this change / area as a staff engineer doing a pre-merge review. Scope: {{scope}} What this code is supposed to do: {{intent}} Risk level (auth, payments, public page, internal): {{risk}} Report only findings, grouped: 1. Correctness / edge cases 2. Security (injection, authz, secrets, SSRF, unsafe HTML) 3. Accessibility and keyboard use if UI is in scope 4. Performance only if you can point to a real cost 5. Tests that are missing for the failures you found Each finding: file path, what's wrong, why it matters, and a concrete fix. Severity: high / med / low. Do not nitpick naming. Do not suggest a rewrite unless the design cannot meet {{intent}}.
Examples
Example input
Scope: PR that adds a public "report prompt" form at /report and POST /api/report Intent: Let visitors flag spam/abuse with reason + optional URL; email the team. Risk: Public page; unauthenticated POST; stores message in DB.
What you should get
**Security - high:** src/routes/api.report.ts - no rate limit or CAPTCHA on public POST. Fix: IP rate limit + size cap on body. **Security - high:** Same file - reason/html rendered in admin email without escaping. Fix: plain-text email or escape. **Correctness - med:** form allows empty reason. Fix: min length validation client + server. **A11y - med:** ReportDialog.tsx - error text not tied with aria-describedby. Fix: wire id on error. **Tests - missing:** API test for 429 after N posts; rejects >5KB body. Skipped: naming nits; no rewrite suggested.
When to use this prompt
Use it when
- You need help with tech leads.
- You need help with solo founders.
- You need help with reviewers.
Skip it when
- You only need a one-line ask with no constraints, format, or context.
- You cannot supply the fill-in details the template asks for.
- A different category or tool-specific workflow fits the job better.
How to get a good result
Done when
**Security - high:** src/routes/api.report.ts - no rate limit or CAPTCHA on public POST. Fix: IP rate limit + size cap on body. **Security - high:** Same file - reason/html rendered in admin email without escaping. Fix: plain-text email or escape. **Correctness - med:** form allows empty reason. Fix: min length validation client + server. **A11y - med:** ReportDialog.tsx - error text not tied with aria-describedby. Fix: wire id on error. **Tests - missing:** API test for 429 after N posts; rejects >5KB body. Skipped: naming nits; no rewrite suggested.
Common mistakes
- Leaving scope, intent, risk vague - the model then invents placeholders.
- Asking Cursor, Claude, or ChatGPT for a shorter answer after a long structured prompt - that throws away the format rules.
- Stopping when the first draft appears instead of checking it against the success criteria below.
FAQ
- What do I fill in before I copy this prompt?
- Replace these placeholders with your details: scope, intent, risk. Required fields are marked on the page. The prompt text updates as you type.
- Which AI tools is this prompt written for?
- It works best with Cursor, Claude, ChatGPT. Copy the filled prompt and paste it into the tool you already use.
- What should a good result look like?
- **Security - high:** src/routes/api.report.ts - no rate limit or CAPTCHA on public POST. Fix: IP rate limit + size cap on body. **Security - high:** Same file - reason/html rendered in admin email without escaping. Fix: plain-text email or escape. **Correctness - med:** form allows empty reason. Fix: min length validation client + server. **A11y - med:** ReportDialog.tsx - error text not tied with aria-describedby. Fix: wire id on error. **Tests - missing:** API test for 429 after N posts; re…
- What are common mistakes with this prompt?
- Leaving scope, intent, risk vague - the model then invents placeholders. Asking Cursor, Claude, or ChatGPT for a shorter answer after a long structured prompt - that throws away the format rules. Stopping when the first draft appears instead of checking it against the success criteria below.
Best for
- Tech leads
- Solo founders
- Reviewers
Related Prompts
More prompts like this — same topic and style.