As of 13 August 2026, AI cannot fix security vulnerabilities in your code.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open the vulnerability report and record the affected files, exploit description, severity, affected versions and required security behaviour.
   2. Create a sanitised working copy of the relevant repository and remove passwords, tokens, personal data, customer data and proprietary secrets before sharing anything with an AI tool.
   3. Gather the relevant source files, dependency manifest, runtime and framework versions, deployment details, existing tests and the commands used to run them.
   4. Paste the report and context into a coding model using the supplied prompt, then answer its questions from your repository and security documentation rather than asking it to guess.
   5. Apply the proposed diff only in a separate branch, inspect every changed line, and compare the new tests with the original exploit and the intended trust boundaries.
   6. Run the project's formatter, unit and integration tests, dependency checks and security scanner, then test the exploit against the patched branch without claiming the vulnerability is closed from a clean scan alone.
   7. Send the diff, test output, scan results, threat assumptions and residual-risk list to a qualified security professional for review before deployment, and record the approval and rollback plan.

   Prompt

   Act as a security-focused software engineer reviewing a proposed fix, not as the final approver. I will provide a vulnerability report, the relevant source code, dependency and runtime details, existing tests, and the intended security behaviour.
   
   First, restate the vulnerability, affected attack path, trust boundary, assumptions and likely impact. Identify any missing information and ask focused questions before proposing a fix if that information could change the remediation.
   
   Then propose the smallest safe change. Show a unified diff, explain each changed line, identify any required configuration or dependency changes, and explain why the change blocks the attack without weakening other controls. Do not invent APIs, versions, settings, test results or security guarantees. If you are uncertain, say exactly what is uncertain.
   
   Add or update focused tests for the exploit case, relevant edge cases and the expected secure behaviour. Give exact commands for formatting, unit tests, integration tests, dependency checks and security scanning, but do not claim that any command has passed unless I provide its output.
   
   Finish with: residual risks, possible regressions, deployment precautions, rollback steps, data or secrets that must not be pasted into a chatbot, and a checklist for review by a qualified security professional. Treat the result as a draft patch until those checks are complete.
   
   Vulnerability report:
   [PASTE REPORT]
   
   Relevant code and file paths:
   [PASTE CODE]
   
   Application, framework, language, versions and deployment environment:
   [PASTE DETAILS]
   
   Existing tests and security controls:
   [PASTE DETAILS]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.