As of 13 August 2026, AI can only partly scan your code for security flaws.

What to actually do

1. Hand it to a person

   The route this page recommends

   A person who owns the outcome does this end to end, worth it when the failure is dear.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the repository in your code editor and remove secrets, access tokens, private keys, passwords and personal data before sharing any files with an AI tool.
   2. Gather the relevant source files, dependency and lock files, authentication and authorisation code, configuration, tests, deployment details and a short description of the data the application handles.
   3. Paste the gathered material into ChatGPT, Claude or Gemini using the prompt, keeping each file clearly labelled and stating what was omitted.
   4. Ask the model to produce separate findings for confirmed-looking issues, plausible issues and false-positive risks, with file locations, attack paths, remediation and independent checks.
   5. Run the suggested tests and a reputable static or dependency security scanner against the repository, then compare its results with the AI findings.
   6. Ask a developer or security-aware colleague to reproduce each material finding, inspect the proposed fix and check that the fix does not remove a required security control.
   7. Apply approved fixes in a branch, rerun the tests and scanners, and record unresolved findings and the limits of the review before release.

   Prompt

   Act as a security-focused code reviewer, not as the final authority. Review the code and project information below for security flaws. Do not claim the code is secure and do not invent files, dependencies, runtime behaviour or test results. Do not include or reproduce secrets, access tokens, private keys, passwords or personal data; tell me to remove them before sharing.
   
   Context:
   - Application type: [web app, API, mobile app, service or other]
   - Language and framework: [details]
   - Deployment environment: [details]
   - Authentication and authorisation model: [details]
   - Data handled: [details]
   - Threat model or security requirements: [details]
   - Relevant dependency and lock files: [paste or attach]
   
   Repository files:
   [paste or attach the relevant source files, configuration files and tests]
   
   For each suspected issue, provide:
   1. Severity with a short reason, without pretending the severity is certain.
   2. The exact file and line or code section involved.
   3. The security property at risk and a plain-English explanation.
   4. A realistic attack path and the assumptions it depends on.
   5. A minimal remediation proposal, preserving existing behaviour where possible.
   6. A test or independent check that a developer can run to confirm the issue and the fix.
   7. Any missing context that prevents a reliable conclusion.
   
   Separate confirmed-looking issues, plausible issues and false-positive risks. Check for injection, broken access control, authentication and session weaknesses, insecure secrets handling, unsafe deserialisation, path and file handling, cryptographic misuse, SSRF, XSS, CSRF, sensitive-data exposure, insecure dependencies and dangerous configuration. Finish with a list of areas you could not assess from the supplied material. Never recommend disabling security controls merely to make tests pass.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.