AI Code Audit Prompt: Combining Security, Error Handling, and Test Coverage

An audit implies more ground than a routine review — not just "does this work," but "what could go wrong, and are we actually checking for it." Combining three specific focus areas gets closer to that: security vulnerabilities, error handling, and testing gaps, reviewed together rather than one at a time.

It's worth being explicit about the goal here: this is about finding weaknesses so they can be fixed, not a guide to exploiting anything. A prompt built this way asks the model to flag problems and suggest remediations — the same purpose a human security-minded code reviewer or a static analysis linter serves.

The Three Categories Combined

• Security Vulnerabilities — injection risks, authentication and authorization gaps, hardcoded secrets or credentials, and insecure data handling.
• Error Handling & Edge Cases — missing error handling, unhandled exceptions, and edge cases like empty inputs, nulls, or boundary values. Many security issues are really error-handling gaps in disguise — an unhandled exception that leaks a stack trace, for instance.
• Testing Gaps — missing coverage for critical paths, edge cases, and error conditions. An audit that flags a vulnerability but doesn't note whether it's covered by a test leaves the door open for the same issue to resurface later.

Why These Three Together

Reviewing security in isolation misses issues that only surface as error-handling gaps. Reviewing error handling without asking about test coverage means even correctly-fixed issues might regress silently later. Putting all three in one pass — with severity tags so the output is prioritized — produces something closer to an actual audit report than three separate, disconnected findings lists.

Example Prompt Structure

Act as an experienced code reviewer.

Review the code below for:
1. Security vulnerabilities — injection risks, authentication/authorization gaps, hardcoded secrets or credentials, and insecure data handling.
2. Error handling and edge cases — missing error handling, unhandled exceptions, and edge cases like empty inputs, nulls, or boundary values.
3. Testing gaps — missing coverage for critical paths, edge cases, and error conditions.

For each issue found, report its location, a description of the problem, and a severity level (Critical / High / Medium / Low) and a specific suggested fix.

Code to review:
```
[PASTE YOUR CODE HERE]
```