Skip to main content
Reference — generated from the toolkit

Source of truth: toolkit/prompts/security/self-review-asvs.md. Edit it there; this page is regenerated on build.

Security self-review (ASVS)

Purpose: the agent reviews its own diff against ASVS L2 before raising the PR — security encoded once, invoked everywhere.

Prompt​

Review THIS diff against OWASP ASVS Level 2. For each relevant control area (auth, access control, input validation, output encoding, data protection, logging), state pass/concern with the specific line. Flag: unparameterised queries, missing authz checks, secrets in code/logs, unvalidated LLM/tool output, PII in logs. Propose the minimal fix for each concern. Do not claim a control passes without pointing to the code that satisfies it.

Usage notes​

  • Runs before the PR is raised; the human still reviews at the merge gate.

Failure modes​

  • False "passes" (mitigated: "point to the code" requirement).