← all checklists

Agent Prompts & PR Review

103 items · source

Copy as markdown

Filter items

Prompt Security for Coding Agents

• Developer instructions are version-controlled.
• Agent instructions are reviewed.
• Agent cannot modify its own security policy.
• Agent cannot modify security instructions and approve its own change.
• Agent receives least-privilege credentials.
• Agent does not receive unnecessary production secrets.
• Agent does not receive all repository secrets by default.
• Agent has repository-level scope.
• Agent has branch restrictions.
• Agent has production restrictions.
• Agent is prohibited from disabling security tests.
• Agent is prohibited from weakening authorization to make tests pass.
• Agent is prohibited from disabling TLS validation.
• Agent is prohibited from adding secrets to source.
• Agent is prohibited from bypassing review.
• Agent is prohibited from modifying security scanning without approval.
• Agent instructions explicitly distinguish trusted instructions from repository content.
• Repository files are treated as untrusted input.
• README files cannot override agent security policies.
• Issue/PR text cannot override agent security policies.
• Generated code cannot redefine agent permissions.

PR Security Checklist

For every AI-generated pull request:

• Identify every file changed.
• Identify every security-sensitive file changed.
• Identify new endpoints.
• Identify changed endpoints.
• Identify changed authorization logic.
• Identify changed authentication logic.
• Identify changed database queries.
• Identify changed RLS policies.
• Identify changed Storage policies.
• Identify changed environment variables.
• Identify new dependencies.
• Identify changed dependencies.
• Identify CI/CD changes.
• Identify IAM changes.
• Identify mobile entitlement/signing changes.
• Identify logging changes.
• Identify caching changes.
• Identify security-test changes.

Then:

• Review generated diff manually.
• Review surrounding code, not only changed lines.
• Run SAST.
• Run SCA.
• Run secret scanning.
• Run tests.
• Run authorization tests.
• Run integration tests.
• Run deployment/security checks.
• Verify no security test was deleted or weakened.
• Verify no security scanner was disabled.
• Verify no permission was widened.
• Verify no credential was added.
• Verify no new public endpoint was created accidentally.

"One-Line Fix" Review

Treat AI suggestions such as these as security-sensitive:

• "just disable validation"
• "make this endpoint public"
• "use service role"
• "disable RLS"
• "allow all origins"
• "skip certificate verification"
• "ignore SSL errors"
• "run as root"
• "use admin client"
• "use any"
• "turn off CSP"
• "allow unsafe-eval"
• "allow all IAM permissions"
• "print environment variables for debugging"
• "store token in localStorage"
• "disable sandbox"
• "use eval"
• "execute generated SQL directly"
• "execute generated shell commands directly"

Code Review Questions

Who controls this input?

• User?
• Browser?
• Mobile app?
• Repository contributor?
• GitHub issue/PR?
• Database?
• RAG document?
• AI model?
• Another agent?
• Third-party API?

Who makes the security decision?

• Deterministic server code?
• Database RLS?
• IAM?
• Model?
• Client?

Where is the real authorization boundary?

• Explicitly identified.
• Enforced server-side.
• Enforced independently of the UI.
• Tested negatively.

What happens when the check fails?

• Request denied.
• No sensitive side effect.
• No permissive fallback.
• Failure logged appropriately.

Can an attacker reach the same operation another way?

• REST.
• RPC.
• Storage API.
• webhook.
• mobile API.
• background job.
• agent tool.
• internal API.