Security audit of a web application for Construction

Your prompt is ready 4 brackets to fill

You are an application security engineer, working with clients, site managers and subcontractors at a construction contractor running several sites.

## Goal
Find and prioritise the security weaknesses in a web application, with fixes.

## What matters in Construction
- Rules and standards that usually apply: site-safety law (OSHA in the US, the BOCW Act in India); building codes and permits; environmental clearances; contract conditions such as FIDIC; labour laws for site workers.
- Common risks to plan for: weather and material delays; cost overruns; site accidents; disputes with clients or subcontractors; permit delays.
- Tools commonly used: MS Project or Primavera; AutoCAD; Excel; WhatsApp site groups.
- Words people in this field use: BOQ; RFI; change order; snag or punch list; running bill; retention money; critical path; method statement.
- Rules differ by country. If I have not said where I work, ask me, and do not present one country's law as if it applied everywhere.

## What I will give you
- App type and stack: [STACK]
- Code or configuration to review: [PASTE CODE, ROUTES OR CONFIG]
- How users sign in: [AUTH METHOD]
- Sensitive data handled: [e.g. payments, health data, personal data]

## What to do
1. Check the code against the OWASP Top 10: injection, broken access control, auth issues, XSS, CSRF, insecure config and more.
2. For each finding, explain how an attacker would use it.
3. Rate each finding as critical, high, medium or low.
4. Give the fixed code or configuration.
5. List quick wins and longer-term hardening steps.

## What to deliver
- A findings table: issue, location, severity, impact, fix
- Corrected code snippets
- A prioritised checklist to work through

## Rules
- Keep site-safety regulations, permits and fixed-price budgets in mind throughout, and point out anything in my plan that would break them.
- Where it fits, connect your recommendations to schedule variance and safety incidents.
- Only describe how to defend the app; do not write attack tooling.
- Use plain language and short sentences. Use headings and tables where they make the answer easier to scan.
- Do not invent figures, laws, sources or quotes. Mark anything you had to assume with "Assumption:".
- If something important is missing, ask me up to 3 short questions before you start.

## Before you answer
Check your draft against this list and fix anything that fails:
- The code works as written: no invented libraries, functions or APIs, and versions are named where they matter.
- It is written for a construction contractor running several sites; nothing in it would read the same for any other business.
- Every item under "What to deliver" is included.

Open in ChatGPT Claude Perplexity

How to use this prompt

Copy the prompt. Press Copy prompt and the full text goes to your clipboard.
Fill the brackets. Use the form above, or replace [STACK], [PASTE CODE, ROUTES OR CONFIG], [AUTH METHOD], [e.g. payments, health data, personal data] with your own details.
Paste and send. Paste it into ChatGPT, Claude, Microsoft Copilot and DeepSeek and send. Ask follow-up questions to refine the answer.

Why this prompt works

The “Security audit of a web application” prompt tells the assistant exactly what to hand back: a findings table: issue, location, severity, impact, fix; corrected code snippets; and a prioritised checklist to work through. It makes the assistant work through 5 steps in order, starting with "check the code against the OWASP Top 10: injection, broken access control, auth issues, XSS, CSRF, insecure config and more", instead of jumping straight to an answer. Before replying, the assistant checks its draft against 3 tests and fixes anything that fails.

This version is written for a construction contractor running several sites, so the assistant keeps site-safety regulations, permits and fixed-price budgets in mind and judges the result by schedule variance and safety incidents. If an important detail is missing, it asks you up to 3 short questions before it starts.

How to get the best answer

Fill every bracket with real detail: [STACK], [PASTE CODE, ROUTES OR CONFIG], [AUTH METHOD] and the rest should hold real names, numbers and dates, not placeholders.
Paste real material: where the prompt asks for notes, data or text, paste the actual content rather than a summary.
Refine in the same chat: ask "make it shorter", "turn it into a table" or "add more detail on step 2".
Check the result: review it against what you know about schedule variance and safety incidents before you share it.

Other industries

Same prompt for other industries

The same security audit of a web application prompt, rewritten for each industry.

FAQ

Frequently asked questions

Which AI assistant works best with the “Security audit of a web application” prompt?

The “Security audit of a web application” prompt works in any chat assistant and suits ChatGPT, Claude, Microsoft Copilot and DeepSeek best. Paste it in, send it, and ask follow-up questions in the same chat to refine the answer.

What do I fill in before sending the “Security audit of a web application” prompt?

Replace the 4 highlighted brackets – [STACK], [PASTE CODE, ROUTES OR CONFIG], [AUTH METHOD], [e.g. payments, health data, personal data] – with your own details. The more specific you are, the better the answer.

Is the “Security audit of a web application” prompt only for Construction?

No. This version is written for a construction contractor running several sites, and the same prompt is also written for 15 other industries, listed on this page.

Is the “Security audit of a web application” prompt free to use?

Yes. First AI Prompt prompts are free to copy and use in personal and business work, with no sign-up, no account and no daily limit.

Can I trust the answer the “Security audit of a web application” prompt gives?

Treat it as a strong first draft: the prompt tells the assistant not to invent facts and to mark its assumptions, but check figures yourself, especially anything with legal, financial or safety consequences.

Keep exploring