{"id":"sec-dev-design-review-questions","audience":"developers","category":"security","track":"security","technique":"context","title":"Ask the right security questions about a new service","free":false,"task":"You're reviewing a design doc for a new webhook service. Write exactly 4 numbered questions for the author, each naming a specific component from the doc and asking about a trust boundary the doc leaves open. Skip anything the doc already answers. Plain text, under 110 words.","materialLabel":"Design doc excerpt (attached to your prompt automatically)","material":"Design doc: Partner Webhooks Service (author: Tariq, draft 2)\n\nComponents:\n- Ingest API (public): receives POST requests from partners at https://hooks.example.com/{partnerId}.\n- Queue: messages go to an internal queue (orders-events).\n- Worker: reads the queue and updates customer orders in the Orders DB.\n- Admin UI (internal): support staff can replay failed webhooks.\n- Partner config store: holds each partner's callback URL and shared secret.\n\nWhat's decided:\n- TLS on the public endpoint (managed certificate).\n- The queue is only reachable from inside our network.\n- Admin UI is behind company SSO.\n- Rate limit: 100 requests per minute per partnerId.\n\nOpen in the doc:\n- \"Partners sign requests, details TBD.\"\n- \"Worker trusts the order ID in the payload.\"\n- \"Partners can set their callback URL from the partner portal, any URL is accepted.\"\n- \"Replays in Admin UI: anyone in support can replay any partner's events.\"\n- Secrets in the config store: \"stored for now in a plain DB column.\"","rules":[{"type":"numberedItems","count":4},{"type":"plainText"},{"type":"maxWords","max":110}],"mistakes":[{"title":"Generic questions","why":"The AI asks 'Have you considered authentication?' without pointing at a component.","fix":"Say: \"Each question names a component from the doc.\"","checks":["r0"]},{"title":"Asking what's answered","why":"The AI asks about TLS and rate limits, which the doc already settles.","fix":"Add: \"Skip anything in 'What's decided'.\"","checks":["r2"]},{"title":"Missing the open items","why":"Without being pointed at the gaps, the AI spreads questions over everything.","fix":"Ask: \"Focus on the trust boundaries the doc leaves open.\"","checks":["r1"]},{"title":"Questions plus essays","why":"The AI adds a paragraph of explanation under each question.","fix":"Be exact: \"Exactly 4 numbered questions, each under 20 words.\"","checks":["numberedItems","maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the doc comments they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Asks for specific components","patterns":["component","name (a|the|each)","specific"]},{"label":"Targets the open items","patterns":["open","trust boundar","gap","tbd"]},{"label":"Skips settled items","patterns":["skip","already (answer|decid)","decided","don'?t ask"]},{"label":"Says exactly how many","patterns":["\\b4\\b.{0,25}(question|line|item)","exactly (4|four)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Review questions land when they point at a real gap. Ask the AI to name a component in every question and skip what the doc already settles.","rubricLabels":["Each question names a specific component from the doc (Ingest API, Worker, Admin UI, Partner config store, or the partner callback URL)","The questions are about items the doc leaves open (request signing, the worker trusting the order ID, any callback URL accepted, who can replay events, or plain-text secrets)","No question asks about TLS, whether the queue is internal, SSO on the Admin UI, or rate limiting, and every line ends with a question mark"]}