temp_preferences_customTHE FUTURE OF PROMPT ENGINEERING

Frontend Security Code Reviewer (XSS/CSRF)

Security-focused frontend review covering XSS prevention, CSRF protection, CSP headers, sensitive data handling, and browser security APIs.

terminalgeminitrending_upRisingcontent_copyUsed 645 timesby Community

xsscode-reviewfrontendsecuritybrowser-securitycspcsrf

gemini

0 words

System Message

## Role & Identity You are a Senior Frontend Security Engineer with expertise in browser security models, XSS attack vectors, CSRF mitigation, Content Security Policy, and secure coding patterns for modern SPAs. You have found critical XSS vulnerabilities in production applications that could have exposed millions of users. ## Task & Deliverable Review the submitted frontend code for security vulnerabilities including XSS, CSRF, data exposure, and browser security API misuse. ## Step-by-Step Review Process 1. **XSS via DOM** — `innerHTML`, `dangerouslySetInnerHTML`, `eval`, `document.write`, `insertAdjacentHTML` with unescaped data. 2. **XSS via URL** — `href`/`src` with user input (javascript: URI), `window.location` assignment. 3. **CSRF** — SameSite cookie attribute, CSRF token in forms, `credentials: 'include'` fetch without CSRF token. 4. **Content Security Policy** — CSP header restrictiveness, `unsafe-inline`/`unsafe-eval` usage, nonce implementation. 5. **Sensitive Data Storage** — Tokens in localStorage (XSS risk), credentials in sessionStorage, PII in URL query params. 6. **Third-Party Scripts** — Unverified CDN scripts, `integrity` attribute (SRI), third-party script sandboxing. 7. **iframe Security** — Missing `sandbox` attribute, `X-Frame-Options`, clickjacking risk. 8. **postMessage** — Missing origin validation in `message` event handler. 9. **Prototype Pollution** — Recursive merge/extend with user-controlled keys, `__proto__` assignment. 10. **Open Redirect** — Unvalidated redirect URLs from query parameters.

User Message

Review this frontend code for security: {&{FRONTEND_SECURITY_CODE}}

About this prompt

## Frontend Security Code Reviewer (XSS/CSRF) A **frontend security expert review** that finds XSS injection points, CSRF token gaps, unsafe data storage, and CSP weaknesses — with PoC exploit payloads for every critical finding. ### Use Cases - Find dangerouslySetInnerHTML usage with user-controlled data enabling stored XSS attacks - Audit authentication token storage in localStorage for XSS exfiltration vulnerability - Review postMessage handlers for missing origin validation enabling cross-origin attacks

When to use this prompt

check_circleFind dangerouslySetInnerHTML with user-controlled data creating stored XSS attack vectors.
check_circleAudit authentication token storage for XSS exfiltration risk from localStorage usage pattern.
check_circleReview postMessage event handlers for missing origin validation enabling cross-origin message attacks.

signal_cellular_altadvanced

Latest Insights

Stay ahead with the latest in prompt engineering.

View blogchevron_right

How to Write System Prompts That Actually Work

Article

person Admin•schedule 5 min read

How to Write System Prompts That Actually Work

System prompts set the rules of the game for every AI interaction. This hands-on guide shows you exactly how to structure them for reliability and consistency.

Claude vs GPT-4o: Which Model Fits Your Use Case?

Article

person Admin•schedule 5 min read

Claude vs GPT-4o: Which Model Fits Your Use Case?

Choosing between Claude and GPT-4o is less about which is "better" and more about which fits your specific task. Here is a practical breakdown.

How Our Design Team Cut Brief-Writing Time by 70% with AI

Article

person Admin•schedule 5 min read

How Our Design Team Cut Brief-Writing Time by 70% with AI

A real-world case study on how a 12-person design team at a product agency standardised their creative brief process using prompt templates on PromptShip.

Why AI Hallucinations Happen (and How to Reduce Them)

Article

person Admin•schedule 5 min read

Why AI Hallucinations Happen (and How to Reduce Them)

Hallucinations are not bugs — they are a fundamental property of how language models work. Understanding why they happen is the first step to minimising them.

The State of AI Coding Assistants in 2026

Article

person Admin•schedule 5 min read

The State of AI Coding Assistants in 2026

From autocomplete to autonomous agents — AI coding tools have changed dramatically. Here is where things stand and what to expect next.

From Idea to Shipped Prompt: A Solo Founder's AI Workflow

Article

person Admin•schedule 5 min read

From Idea to Shipped Prompt: A Solo Founder's AI Workflow

One founder. No team. A dozen AI-powered tools and a tight prompt library. Here is the workflow that runs a bootstrapped SaaS doing $15k MRR.

Recommended Prompts

geminishieldTrusted

bookmark

Dockerfile Security & Best Practices Reviewer

Expert Dockerfile review covering multi-stage builds, non-root user, minimal base image, layer optimization, and security hardening.

Frontend Security Hardening Specialist

Audits and hardens frontend code against XSS, CSRF, clickjacking, insecure data storage, and Content Security Policy violations with remediation code.

Security-Focused Pull Request Reviewer

Security expert PR review scanning for OWASP vulnerabilities, injection risks, auth changes, and sensitive data exposure before merge.

Senior Python Backend Code Reviewer

Acts as a senior Python engineer to deliver a comprehensive, production-grade code review covering architecture, security, performance, and best practices.

Scalable Frontend Development Solutions

Structured scalable frontend development solutions analysis engine — takes your specific context and constraints and delivers an expert-level action plan you can execute immediately.

Frontend Micro-Frontend Architecture Designer

Designs micro-frontend architectures using Module Federation, single-spa, or iframe strategies with routing, shared dependency management, and inter-app communication patterns.

star 0fork_right 143

bolt

pin_invoke