Backend Security Audit Prompt for Claude Code

If you caught the post, this is the exact resource. Copy the prompt below, paste it into Claude, or into Claude Code pointed at your repo, and let it run a first pass before you ship.

Built for solo developers and small teams shipping backends fast, on whatever stack. It catches the vulnerabilities that get exploited most often, before a real security review or before something goes to production.

I do not want my backend to get hacked. Please review this codebase end-to-end and address the following, explaining each change as you make it: SECRETS & CONFIGURATION - Scan for exposed API keys, tokens, and hardcoded secrets in the code and git history - Move every secret to environment variables and confirm .env is gitignored - Rotate any secret you find hardcoded or previously committed INPUT & INJECTION - Add input validation and sanitization on every endpoint that accepts user data - Prevent SQL/NoSQL injection (parameterized queries, ORM-safe patterns) - Prevent XSS (output encoding, sanitize any HTML rendered from user input) - Add CSRF protection on state-changing routes - Validate every file upload: type, size, extension, and storage location NETWORK & TRANSPORT - Enforce HTTPS everywhere, including redirects from HTTP - Review and tighten the CORS configuration, no wildcard origins on authenticated routes - Add standard security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy) - Add rate limiting on auth endpoints and any expensive or public-facing routes AUTH & SESSIONS - Confirm passwords are hashed with a modern algorithm (bcrypt/argon2), never stored in plaintext - Check session/token expiration and refresh logic - Confirm authorization checks exist on every protected route, not just authentication DEPENDENCIES & COMPLIANCE - Scan dependencies for known vulnerabilities and flag which ones need updating - Flag any compliance requirements that likely apply (GDPR, PCI-DSS, SOC 2, etc.) given what this app stores or processes - Call out anything else you notice that's a risk, even if it wasn't listed above Go file by file, explain what you changed and why, and flag anything you're not fully confident fixing automatically so I can review it manually.

Why each section actually matters

Secrets & config: one leaked API key in a repo, even a private one that turns public, can drain a billing account or take down your infra
Input & injection: injection and XSS have sat on the OWASP Top 10 for over a decade. They keep breaching apps that "should know better".
Network & transport: loose CORS is one of the most common self-inflicted wounds. It quietly opens your API to any origin that asks.
Auth & sessions: weak password hashing or sessions that never expire turn one leaked database into every user's account
Dependencies & compliance: most breaches trace back to an outdated dependency, not a zero-day. Compliance gaps get expensive after the fact, not before.

How to actually run it

New branch, not main. Let the changes land somewhere you can review and discard.
One service at a time. Point it at a single repo, not your whole monorepo in one pass. You'll get shallower fixes if you do.
Read every diff. This is a fast, thorough first pass, not a replacement for a real audit, especially before you're handling payments or health data.
Re-run it periodically, not just once before launch. New endpoints mean new attack surface.

Go deeper: follow-up prompts

Send these one at a time, after the first pass lands.

Write a SECURITY.md documenting what you found and fixed, so I have a record.

Now write tests that would have caught the vulnerabilities you just fixed.

Pretend you're an attacker. What's the next thing you'd try against this API?

One honest caveat. This catches the common, high-frequency mistakes fast: the ones that account for most real-world breaches. It won't replace a professional pentest before something that touches real money or real user data at scale. Treat it as your first pass, not your last one.