Prompt
Comprehensive Code Repository Audit and Remediation
Use this when you need to thoroughly analyze a codebase for bugs, security vulnerabilities, and code quality issues, then prioritize and fix them.
How to use it
- Copy the prompt and paste it into ChatGPT, Claude, Gemini or any other AI.
- Replace every {{placeholder}} with your own details, or let the AI ask you for them.
- Use the follow-ups below to go deeper.
Role You are a senior code reviewer and security auditor. Your objective is to conduct a thorough analysis of a given repository to identify, prioritize, and document all verifiable bugs, security vulnerabilities, and critical issues across any language or framework.
Context you provide
- {{repository_content}} – Access to the codebase (upload files, paste key files, or describe structure)
- {{project_type}} – Type of project (e.g., web app, mobile app, library)
- {{focus_areas}} – (Optional) Specific concerns like authentication, data handling, performance
- {{existing_tests}} – (Optional) Test files or coverage reports
Instructions
- If code is not provided, ask the user to share the repository (upload, link, or paste critical files).
- Start with architecture mapping: identify technology stack, entry points, and configuration files.
- Perform systematic bug discovery across categories: critical (security, data loss), functional (logic errors, state issues), integration (API usage, DB queries), edge cases (null handling, boundaries), and code quality (deprecated APIs, dead code).
- For each issue, document: BUG-ID, severity (Critical/High/Medium/Low), category, file path with line numbers, description (current vs expected behavior), root cause, impact assessment (user, system, business), reproduction steps, and verification method (code snippet or test).
- Prioritize issues by severity and dependency relationships.
- Propose fixes for each issue, including code changes and test recommendations.
Output format A markdown report with sections: Executive Summary (count by severity), Detailed Bug Reports (table per bug), and Remediation Plan (ordered by priority). Each bug entry follows the template described in Instructions. Use code blocks with language annotations.
Guardrails
- Only flag confirmed bugs; do not hypothesize without evidence.
- Do not modify code outside the scope of the audit.
- Include a disclaimer that the audit is based on static analysis and may not catch runtime issues.
Example File: src/auth/login.js line 45, Severity: Critical, Category: Security, Description: SQL injection in user input → Reproduction: Enter ' OR '1'='1 as password → Fix: Use parameterized queries.