If youโre vibecoding anything, paste the prompt below In your prompt box and let your agent do a security sweep.
[
You are a senior security engineer and red-team specialist tasked with performing a comprehensive, adversarial security audit of the following codebase, system design, or application.
Your goal is to identify all possible security vulnerabilities, including common, uncommon, and novel attack vectors. Assume the system will be deployed in a hostile environment with motivated attackers.
---
AUDIT SCOPE
Analyze the system across all layers, including:
- Frontend (UI, client logic, browser storage)
- Backend (APIs, business logic, services)
- Authentication and authorization flows
- Database interactions and storage
- Infrastructure and deployment assumptions
- Third-party integrations and dependencies
---
CORE OBJECTIVES
1. Identify critical, high, medium, and low severity vulnerabilities
2. Detect logic flaws, not just known patterns
3. Surface chained attack paths (multi-step exploits)
4. Highlight unknown or unconventional weaknesses
5. Assume attacker creativity beyond standard checklists
---
THREAT MODELING
- Define possible attacker profiles (anonymous user, authenticated user, insider, API consumer)
- Identify entry points and trust boundaries
- Map out sensitive assets (data, tokens, permissions, secrets)
---
VULNERABILITY ANALYSIS
Check for (but do NOT limit yourself to):
### Authentication & Authorization
- Broken auth, weak session management
- Privilege escalation (vertical and horizontal)
- Insecure password reset flows
- Token leakage or reuse
### Input Handling
- Injection attacks (SQL, NoSQL, OS command, template injection)
- XSS (stored, reflected, DOM-based)
- CSRF vulnerabilities
- File upload exploits
### Data Security
- Sensitive data exposure
- Weak encryption or misuse of cryptography
- Hardcoded secrets or keys
- Insecure storage (localStorage, cookies, logs)
### API & Backend Logic
- Broken object-level authorization (IDOR/BOLA)
- Mass assignment vulnerabilities
- Rate limiting issues / brute force risks
- Business logic abuse (race conditions, double spending, bypassing checks)
### Infrastructure & Configuration
- Misconfigured headers (CORS, CSP, HSTS)
- Open ports, debug endpoints, admin panels
- Environment variable leaks
- Cloud/storage misconfigurations
### Dependencies & Supply Chain
- Vulnerable packages
- Unsafe imports or execution
- Malicious dependency risks
---
ADVANCED / UNKNOWN THREATS
Actively attempt to discover:
- Non-obvious logic flaws unique to this system
- Feature abuse scenarios
- State desynchronization issues
- Cache poisoning
- Replay attacks
- Timing attacks
- Multi-step exploit chains combining low-severity issues
- Any behavior that โshouldnโt be possibleโ but is
---
ADVERSARIAL TESTING MINDSET
- Think like an attacker trying to break assumptions
- Attempt to bypass validations and safeguards
- Manipulate edge cases and unexpected inputs
- Explore how different components interact under stress
--
OUTPUT FORMAT
Provide findings in this structure:
### 1. Vulnerability Summary
- Total issues by severity
### 2. Detailed Findings
For each vulnerability:
- Title
- Severity (Critical / High / Medium / Low)
- Affected component
- Description
- Exploitation scenario (step-by-step)
- Impact
- Recommended fix
### 3. Attack Chains
- Show how multiple minor issues could be combined into a major exploit
### 4. Secure Design Recommendations
- Architectural improvements
- Safer patterns and best practices
---
IMPORTANT INSTRUCTIONS
- Do NOT assume the code is safe
- Do NOT skip analysis due to missing context, infer risks where needed
- Be exhaustive and paranoid in your review
- If unsure, flag it as a potential risk and explain why
]
The Nigerian media will NOT report this.
However less than an hour ago,
Donald Trump has just confirmed that the USA Department of War has launched multiple airstrikes on ISIS terrorists in the NorthWest Nigeria who engage in kidnap, mass murder and terrorism.
I expect that by later this morning, there will be a lot of tears ๐ญ (hidden under faux patriotism) by the bigoted lunatic terror sympathisers and barbaric terror apologists on this app.
Go write this down.
Iโm convinced thereโs a ghost whose sole purpose is to rob humanity of its balance -- stealing forks and socks. Nothing else could so perfectly symbolize the absurdity of its existence: an eternity spent tormenting mortals, one mismatched pair and missing utensils at a time.
Hi, I'm Afolabi, a Product Designer, currently open to full or part time & contact jobs.
Portfolio: https://t.co/P2RewCA8dY
โ [email protected]
Please kindly Retweet๏ฟผ๏ฟผ๐๐ฟ
Hey Laravel Developers ๐ฉโ๐ป
Starting with Laravel v12.8.0, the Eloquent Collection class has a new method called withRelationshipAutoloading().
This method, as the name suggests, loads the requested relationship as and when it is used, instead of us manually specifying the eager load.
So, you no longer have to worry about additional queries being triggered in case you decide to no longer use the relationship in the future.
Accessing any relationship on the model is now a breeze without having to worry about N+1 query issues.
#laravel #php
This is a big one.
In this code snippet, Laravel is essentially calling $users->load('posts.comments') automatically for you behind the scenes, just in time. ๐ง
Thank you for your work on this @r9ray. ๐
HE DID IT.
To his favour, the chart went up and he managed to fully exit with no loss. Once the price came back to his entry, he one clip yeeted out of that.
The challenge: we must ship. That goes for all of us.
What will you ship between now and @LaraconUS (July 29)? โฐ๏ธ
Big or small, we believe in you and hope Laravel Cloud will help. ๐ Start shipping on February 24th
An iOS app built with NativePHP and Livewire! Using wire:navigate and transitions for the tab bar ๐
We are starting a new era for PHP Developers! Thanks @simonhamp for pushing so hard on this!
Hey Laravel Developers ๐ฉโ๐ป
Starting with Laravel v11.39.1, a new method called incrementOrCreate() is available on the Eloquent builder class.
As the name suggests, this method either increments the specified column if a record already exists or creates a new record with the increment counter set to 1.
This method works similarly to updateOrCreate or firstOrCreate under the hood.
A practical use case for this method is tracking and incrementing total product views in a separate table on an e-commerce website, as shown below.
#laravel #php
๐ I'm hiring an Executive Assistant ๐
Looking for a driven individual to work directly with me at Paystack, Sporting Lagos, and my investments.
๐ 12-18 month paid fellowship
๐ Location: Lagos, Nigeria
๐ช Role: Project mgmt, travel/logistics, & personal office ops
If you have great taste, empathy, & thrive in ambiguity, apply below! ๐