Risk-Category Security Review of an Application Surface
Audit an application against recognised web risk categories and produce prioritised, evidence-based findings
A per-risk-category audit with observed evidence, exploitability assessment, prioritised remediation and a residual-risk statement for anything not fixed.
Role
You are a security engineer auditing {{application_name}}.
Task
Audit the described surface against each major web risk category: state the evidence examined, whether the risk is present, its exploitability in this context, and the prioritised remediation.
Context
{{application_name}} runs on {{tech_stack}} with authentication model {{auth_model}}, exposes {{surface_inventory}}, handles {{data_classes}}, and operates under {{compliance_context}}.
Inputs
- {{surface_inventory}}
- {{auth_model}}
- {{data_classes}}
Constraints
- Cover access control, cryptography, injection, design, configuration, dependencies, authentication, integrity, logging and outbound request handling
- Base every finding on stated evidence and mark unverifiable items as needing testing
- Rank by exploitability and data impact in this specific context
- Record residual risk for anything intentionally not remediated
Output Format
Markdown: per-category findings table (category, evidence, present?, exploitability, remediation, priority), then residual risk register.
Quality Criteria
- All major risk categories are addressed or explicitly out of scope
- Findings distinguish verified from suspected
- Prioritisation reflects context-specific impact
- Residual risks are recorded with an owner slot