Gemini 4 Carbon Prompt Generator

Audit this codebase for security vulnerabilities. For every issue found provide: (1) file path and exact line number, (2) vulnerability class (OWASP Top 10 or CWE identifier), (3) the specific input or state that triggers it, (4) severity rating (Critical/High/Medium/Low) with justification, (5) a minimal targeted fix with corrected code. After the issue list, write an executive summary of the three most critical risks and the total attack surface. Do not report style issues. [Paste codebase]

Create a STRIDE threat model for this new feature: [describe feature — authentication flow, API endpoint, data pipeline, etc.]. For each threat category (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege): (1) list every specific threat that applies to this feature, (2) rate each threat's likelihood and impact (High/Medium/Low), (3) specify the security control that mitigates it, (4) flag any threat with no current mitigation. Finish with a prioritised remediation backlog sorted by risk score.

Write a professional penetration test report for the following findings: [paste raw notes — IPs, ports, services, CVEs, screenshots descriptions, payloads]. Structure the report as: (1) Executive Summary (risk posture, top 3 findings in plain language for a non-technical reader), (2) Scope and Methodology, (3) Findings table (ID, title, severity, CVSS score, affected component), (4) Detailed findings for each — description, evidence, reproduction steps, impact, remediation, (5) Remediation roadmap sorted by severity. Use professional, neutral language.

Review this code for security and correctness. I need: (1) every security issue with its CWE ID, the attack vector, and a corrected code snippet, (2) every logic bug — describe the input that triggers it and the incorrect output, (3) every performance issue that matters at scale (>10K requests/day), (4) any dependency that has a known CVE in the version pinned, (5) a risk-ranked list of changes where #1 is the most urgent. Only flag real issues — no style nits. [Paste code]

Design a multi-step agentic workflow that: [describe goal, e.g. 'monitors a GitHub repository for new PRs, runs automated security checks, posts a risk summary as a PR comment, and escalates High findings to a Slack channel']. Specify: (1) every tool call needed (APIs, webhooks, file reads, notifications), (2) the decision tree — which condition triggers which branch, (3) mandatory human checkpoints before irreversible actions, (4) failure handling for each tool — what happens on timeout, auth error, or bad response, (5) Python pseudocode using an async agent loop. List the three most likely production failure modes.

Audit this CI/CD pipeline configuration for security gaps: [paste GitHub Actions / GitLab CI / Jenkinsfile]. Check: (1) any secret or token that could be exfiltrated via log injection or forked-PR attacks, (2) pipeline steps that run with excessive permissions — flag every GITHUB_TOKEN scope that is broader than needed, (3) third-party Actions or plugins used with mutable tags (not pinned SHA) — supply-chain risk, (4) any build artefact that is not cryptographically signed, (5) the minimum permission set for each job. Output a hardened version of the config with every change annotated.

Write an incident response runbook for this scenario: [describe incident type — ransomware, data breach, API credential leak, DDoS, insider threat]. The runbook must cover: (1) Detection — the specific log entries, alerts, or user reports that indicate this incident type, (2) Containment — ordered steps to isolate affected systems without destroying evidence, (3) Eradication — how to remove the threat and verify it is gone, (4) Recovery — ordered steps to restore service safely, (5) Post-incident review — what data to collect and how to prevent recurrence. Format as a numbered checklist an on-call engineer can follow at 3 AM.

Review this API design — endpoints, request/response schemas, authentication, and error codes: [paste OpenAPI spec or describe the API]. Evaluate: (1) REST / GraphQL conventions — flag every violation with the correct pattern, (2) authentication and authorisation — are endpoints properly protected? Can a user access another user's data? (3) rate limiting — which endpoints need it and what is the right limit?, (4) error handling — do error responses leak internal details?, (5) breaking change risk — which fields, if changed, would break existing clients. Output a prioritised fix list.

Analyse this dependency manifest for security risk: [paste package.json / requirements.txt / go.mod / Gemfile]. For each dependency: (1) check if the pinned version has any known CVE — list CVE ID, severity, and fixed version, (2) flag any package that is no longer maintained (last commit > 2 years, archived, or deprecated), (3) identify direct vs transitive dependencies for each CVE, (4) for each vulnerable package, give the exact upgrade command to reach the patched version, (5) output a risk-sorted upgrade plan — fix Critical first, then High, then Medium.

Review this Terraform / CloudFormation / Pulumi infrastructure code for security misconfigurations: [paste IaC code]. Flag every resource that: (1) exposes a port to 0.0.0.0/0 (open to the internet), (2) uses a permissive IAM policy (wildcards in Action or Resource), (3) stores secrets or credentials in plain text, (4) disables encryption at rest or in transit, (5) lacks deletion protection on stateful resources (RDS, S3 with versioning off). For each finding, provide the corrected resource block. Finish with a CIS Benchmark alignment summary.

Read this codebase and produce a refactoring plan. I need: (1) a module dependency map — flag every circular dependency, (2) the five highest-debt areas ranked by risk and cost to fix, (3) a migration path for the highest-risk area — ordered steps, breaking change risks, and test strategy at each step, (4) every function over 100 lines that should be decomposed — suggest the decomposition for the longest one, (5) the single change with the highest risk-reduction-to-effort ratio. Present as an ordered sprint plan. [Paste codebase or describe architecture]

Review this system against zero-trust security principles: [describe or paste architecture diagram, service mesh config, or IAM policies]. Assess: (1) implicit trust — list every network path, service account, or user role that implicitly trusts something without verification, (2) least-privilege violations — every permission broader than the minimum needed for the job, (3) lateral movement paths — how far could an attacker move from each entry point if credentials for one service are compromised, (4) missing mutual TLS or certificate rotation, (5) the five highest-priority zero-trust controls to implement first. Provide a 90-day remediation roadmap.

Optimise these database queries for performance at scale: [paste SQL queries + relevant schema + index definitions]. For each query: (1) explain the execution plan in plain language, (2) identify the specific bottleneck — missing index, full table scan, N+1 pattern, unnecessary JOIN, (3) write the optimised query and explain the change, (4) specify the exact index to create if one is needed (with column order and type), (5) estimate the performance gain as a rough multiplier (e.g. '10–100× faster on a 50M-row table'). Flag any query that cannot be optimised without a schema change.

Review this cryptography implementation for weaknesses: [paste code handling encryption, hashing, key management, or certificate handling]. Check: (1) use of deprecated or weak algorithms — MD5, SHA-1, DES, ECB mode AES, RSA < 2048-bit, (2) hardcoded keys or IVs, (3) incorrect IV reuse or predictable nonce generation, (4) key storage in plaintext or in version-controlled files, (5) certificate validation — is hostname verification disabled anywhere? For every finding, provide the corrected implementation using a modern, safe alternative.

Audit service-to-service communication in this microservices architecture for security gaps: [describe services, communication patterns, authentication mechanisms, and network topology]. Evaluate: (1) authentication between services — is every call verified? Can Service A impersonate Service B?, (2) authorisation — does each service only call the APIs it is permitted to call, or can any authenticated service call any endpoint?, (3) data-in-transit encryption — is mTLS enforced on all internal channels, or only on ingress?, (4) secret rotation — how are service credentials rotated? What is the blast radius of a single leaked credential?, (5) provide a hardened service mesh configuration as the fix.

Diagnose this production incident. I will give you: the error output, relevant code, the last 500 lines of logs before the failure, and the git diff of changes deployed in the 24 hours before the incident. Work through in order: (1) list every plausible cause ranked by likelihood with brief reasoning, (2) for the top cause, write the exact diagnostic command and predict what its output looks like if the hypothesis is correct, (3) write the minimal code fix, (4) write a regression test that would have caught this before deployment, (5) identify whether this failure class can recur elsewhere. [Paste error, code, logs, diff]

Audit this cloud environment for resources that represent both a security risk and an unexpected cost: [paste AWS Cost Explorer export / GCP billing export / Azure cost data + current IAM/resource config]. Flag: (1) over-provisioned compute instances that could be right-sized AND are running with overly broad IAM roles, (2) publicly accessible storage buckets or blobs with data egress costs, (3) unused or orphaned resources that could be exfiltrated or used as C2 infrastructure, (4) API keys with no expiry still active on unused services, (5) provide a combined security-and-cost remediation table sorted by estimated monthly savings.

Write a secure coding guidelines document for a team building [specify: web API in Node.js, mobile app in React Native, ML pipeline in Python, etc.]. Cover: (1) input validation — the five most common injection patterns in this stack and how to prevent each, (2) authentication and session management — the correct implementation pattern with a code example, (3) secrets management — where keys and tokens must and must not be stored, (4) dependency management — pinning, auditing, and update cadence, (5) code review checklist — a 10-point security checklist every PR reviewer must check. Format as a developer handbook page.

You are a senior software engineer. Break down this feature into an agentic coding plan: [describe feature — e.g. 'add OAuth 2.0 login with Google to this Express.js app']. Produce: (1) a task list ordered by dependency — which subtasks must be done before others, (2) for each task: the files to edit, the specific change needed, and the test to verify it, (3) the integration test that proves the whole feature works end-to-end, (4) the rollback plan if the feature needs to be reverted after deployment, (5) the three edge cases most likely to cause a production incident after launch. Format as a numbered sprint plan an AI coding agent can execute step by step.

Perform a gap analysis against [SOC 2 Type II / ISO 27001 / PCI DSS 4.0 / NIST CSF 2.0 — specify] for this system: [describe your tech stack, data flows, access controls, logging, and incident response process]. For each control domain: (1) state current compliance status (Compliant / Partial / Non-Compliant), (2) cite the specific control or requirement number, (3) for every gap, describe the minimum change to achieve compliance and estimate effort in engineering-days, (4) flag any area requiring a legal or compliance specialist, (5) produce a compliance roadmap sorted by risk priority and estimated effort.