Home › Security › Security review prompt file (Copilot)

Security review prompt file (Copilot)

A Copilot prompt file (/security-review) that audits a file or the current diff for common vulnerabilities, read-only.

GitHub CopilotSecurity

Copy security-review.prompt.md

How to use

Save this as .github/prompts/security-review.prompt.md in your repository root, commit it, and your agent will pick it up automatically. Edit the commands to match your project.

Note: Review and test before use. Provided as is, without warranty. See Terms.

---
description: Audit the selected file or current changes for security vulnerabilities
agent: ask
argument-hint: file or area to audit
---

Perform a security review of ${input:target:file, folder, or "current changes"}. Don't edit files.

Look for:
- Broken access control: missing authentication, missing object-level ownership checks (IDOR), privilege checks only in the UI.
- Injection: SQL/NoSQL built with strings, shell commands with user input, unsafe HTML rendering (XSS), template injection, path traversal.
- SSRF and open redirects from user-supplied URLs.
- Secrets in code, config, tests, or logs; weak crypto or password hashing; JWTs without signature/expiry checks.
- Missing CSRF protection on cookie-authenticated mutations; insecure cookie flags.
- Unsafe deserialization and file uploads (type/size checks, storage location).
- Missing rate limiting on auth and expensive endpoints.
- For LLM features: user or retrieved content that can steer tools with side effects (prompt injection).

## Output
A table: Severity (Critical/High/Medium/Low) | Location | Issue | Attack scenario | Fix. Order by severity. If nothing is found in a category, don't list it. End with the top 3 fixes to do first.