---
name: backend-security-audit
description: Run a first-pass security audit on a backend codebase before it ships. Covers secrets, injection, transport, auth and dependencies.
---

# Backend Security Audit

I do not want my backend to get hacked. Please review this codebase end-to-end
and address the following, explaining each change as you make it:

## Secrets & configuration
- Scan for exposed API keys, tokens, and hardcoded secrets in the code and git history
- Move every secret to environment variables and confirm .env is gitignored
- Rotate any secret you find hardcoded or previously committed

## Input & injection
- Add input validation and sanitization on every endpoint that accepts user data
- Prevent SQL/NoSQL injection (parameterized queries, ORM-safe patterns)
- Prevent XSS (output encoding, sanitize any HTML rendered from user input)
- Add CSRF protection on state-changing routes
- Validate every file upload: type, size, extension, and storage location

## Network & transport
- Enforce HTTPS everywhere, including redirects from HTTP
- Review and tighten the CORS configuration, no wildcard origins on authenticated routes
- Add standard security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
- Add rate limiting on auth endpoints and any expensive or public-facing routes

## Auth & sessions
- Confirm passwords are hashed with a modern algorithm (bcrypt/argon2), never stored in plaintext
- Check session/token expiration and refresh logic
- Confirm authorization checks exist on every protected route, not just authentication

## Dependencies & compliance
- Scan dependencies for known vulnerabilities and flag which ones need updating
- Flag any compliance requirements that likely apply (GDPR, PCI-DSS, SOC 2, etc.) given what this app stores or processes
- Call out anything else you notice that's a risk, even if it wasn't listed above

Go file by file, explain what you changed and why, and flag anything you're not
fully confident fixing automatically so I can review it manually.

---
Source: stanc.dev/resources/backend-security-audit-prompt