Web and API Security

Browse prompts in this category.

Prompts

Secure API Developer
Harden REST and gRPC APIs against the OWASP API Top 10 — BOLA/IDOR, mass assignment, broken auth, rate limiting, and excessive data exposure — with schema validation, DTOs, and HSTS. Use when designing or reviewing API endpoints, gateways, or middleware.
Secure API Key Management Developer
Implement API key lifecycle per NIST SP 800-57 — CSPRNG 256-bit generation, prefixed keys, SHA-256 hash-only storage, scope binding, overlap-period rotation, immediate revocation, and usage monitoring. Use when designing API key issuance, validation, or rotation flows.
Secure API Rate Limiting Developer
Implement rate limiting for OWASP API4:2023 with token bucket/sliding window algorithms, per-user/IP/endpoint granularity, Redis-backed distributed counters, 429 + Retry-After headers, and fail-open fallback. Use when protecting APIs against abuse, scraping, or credential stuffing.
Secure CORS Developer
Configure strict CORS with explicit origin allowlists, null-origin rejection, credential/wildcard safety, preflight handling, and method/header scoping in Express, Spring, Django, ASP.NET, and Go. Use when adding cross-origin access controls or auditing Access-Control-* headers.
Secure CSP Developer
Design strict CSP Level 3 headers with default-src 'none', nonce/hash-based script-src, strict-dynamic, object-src 'none', frame-ancestors, SRI, and report-only rollout. Use when authoring or tightening Content-Security-Policy for SPAs, Next.js, Django, or Rails.
Secure CSRF Prevention Developer
Implement CSRF defenses using synchronizer tokens, double-submit cookies, SameSite=Lax/Strict, Origin/Referer validation, and framework middleware for Django, Spring Security, Express csurf, Rails, and ASP.NET Core. Use when protecting state-changing POST/PUT/DELETE endpoints or login forms.
Secure Database Encryption Developer
Implement application-layer envelope encryption with Google Tink and AWS/GCP/Azure KMS — per-service CMKs, AES-256-GCM DEKs, two-phase key rotation, and least-privilege IAM. Use when encrypting database columns, managing Tink keysets, or designing field-level at-rest encryption.
Secure File Upload Developer
Implement file-upload pipelines with magic-byte type validation, size caps, malware scanning, path-traversal and zip-slip prevention, image re-encoding, and signed-URL storage isolation on S3/GCS. Use when accepting uploads in Django, Express multer, Spring, or Go.
Secure JWT Developer
Implement JWT creation and validation per RFC 7519/7515 with strict alg enforcement, alg:none blocking, exp/iss/aud claim validation, kid-based key rotation, and refresh-token rotation with reuse detection. Use when issuing, verifying, or revoking JWTs/JWEs.
Secure OpenAPI Validation Developer
Design OpenAPI 3.0/3.1 specs and spec-first validation middleware enforcing additionalProperties:false, pattern/enum constraints, securitySchemes scopes, and contract/fuzz tests via Schemathesis or ZAP. Use when designing OpenAPI contracts or wiring up express-openapi-validator-style runtime checks.
Secure Server-Side Web Application Developer
Generate secure-by-default server-side web code eliminating classes of vulnerability by construction — parameterized queries, auto-escaping, deny-by-default authZ, Argon2id hashing, session hardening, CSRF, and CSP. Use when scaffolding or reviewing full-stack backend endpoints.
Secure SQL Injection Prevention Developer
Generate SQL injection-safe data access with parameterized queries/prepared statements, ORM query-builder APIs, identifier allowlists, and least-privilege DB accounts across JDBC, SQLAlchemy, Prisma, pg, and EF Core. Use when writing SQL queries, ORM calls, or stored procedures.
Secure SSRF Prevention Developer
Implement SSRF-safe outbound HTTP with URL allowlists, RFC 1918/6890 private-IP denylists, DNS pinning against rebinding, redirect validation, and cloud metadata (169.254.169.254/IMDSv2) blocking. Use when writing outbound fetchers, webhook dispatchers, or URL-preview services.
Secure tRPC Developer
Harden tRPC routers with strict Zod input schemas, protected/admin middleware chains, typed context isolation, sanitized TRPCError handling, batch-size caps, subscription auth, and CSRF protections. Use when building or reviewing tRPC procedures, middleware, or clients.
Secure Webhook Developer
Implement webhook senders and receivers per the Standard Webhooks spec with HMAC-SHA-256 raw-body signing, timestamp + replay windows, constant-time verification, idempotency via event IDs, exponential-backoff retries, and secret rotation. Use when emitting or ingesting webhook events.
Secure WebSocket Developer
Harden WebSocket servers per RFC 6455 with handshake authentication, Origin allowlists, CSWSH defenses, per-channel authorization, message schema validation, rate limiting, and wss-only transport. Use when building ws, Socket.IO, Spring, gorilla, or FastAPI WebSocket endpoints.
Secure XSS Prevention Developer
Generate XSS-safe front-end and back-end code with context-aware output encoding, DOMPurify sanitization, Trusted Types, strict nonce-based CSP, and framework-safe patterns for React, Angular, Django, and Express. Use when rendering user-supplied HTML, Markdown, or dynamic attributes.
Secure XXE Prevention Developer
Harden XML parsing against XXE, Billion Laughs, and entity-expansion attacks by disabling DTDs/external entities, XInclude, and network resolution across Java, Python defusedxml, .NET, and PHP. Use when parsing XML, SOAP, or SAML from untrusted sources.