Library › Cybersecurity AI › Software developers

Write security review comments on a database PR

  • For Software developers
  • You practice Asking for a format you can use
  • Time about 5 minutes

About this exercise

Review this pull request for security problems and write exactly 3 numbered review comments in your team's format: 'file:line - Blocker|Suggestion|Nit - comment with the fix'. Blocker means it can't merge as is, and your team treats returning password hashes as a Blocker. Don't flag code that is already safe. Plain text, under 120 words.

Common mistakes when you ask AI for this

  • No comment format. The AI writes a long review with headings, so comments can't be pasted onto lines. Try: Give the shape: "file:line - Blocker|Suggestion|Nit - comment with the fix."
  • Flagging safe code. The AI sees an f-string and calls the sort column dangerous too, even though it is allowlisted. Try: Add: "Don't flag code that is already safe, like the allowlisted sort."
  • Naming the bug without the fix. The AI says 'SQL injection risk' and stops. Try: Ask: "Each comment names the fix, for example a parameterized query."
  • Trusting the author's note. The AI accepts 'only admins can call it' and rates the leaked password hashes as minor. Try: Say: "Returning password hashes is always a Blocker, even for admin-only endpoints."
  • Trusting the AI to count words. AI is bad at counting. Ask for "under 120 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 90 words total."

What a strong prompt includes

  • Gives the comment format
  • Skips safe code
  • Asks for the fix
  • Says exactly how many
  • Sets a word limit

Practice this now ↑

Related exercises