💡 How to use these prompts:
Replace everything in [BRACKETS] with your specific details before sending.
Click Copy to copy any prompt to your clipboard instantly.
For each finding below, determine whether the vulnerable code is actually reachable from untrusted input in this application. Separate REACHABLE from THEORETICAL and show the path for every one you mark reachable.
Order these findings by what an attacker would actually gain, not by the scanner severity label. For each one in your top ten, state concretely what access or data it would yield.
Group these findings by underlying root cause rather than by occurrence. Identify any single fix that would close more than one of them, and say how many each fix clears.
Review these findings and flag the ones most likely to be false positives, with the specific reason for each. Be explicit about your confidence and do not mark anything uncertain as safe.
For the confirmed findings, estimate remediation effort in engineer-days and group them into quick wins, standard fixes and structural work. State which ones cannot be fixed without an architectural change.
Summarise this backlog for a non-technical audience: how many findings are genuinely exploitable, what the worst realistic outcome is, how long remediation takes, and what risk remains in the meantime. No jargon.