AI Prompts for Code Review: Security Audits, SOLID Rules & PR Checks

These AI prompts for code review turn any LLM into a first-pass auditor: 15 templates covering OWASP security, SOLID violations, N+1 queries, memory leaks, race conditions, and WCAG compliance — plus a CI integration pattern.

Automating Code Quality Audits with AI

Manual code reviews are time-consuming. Using AI for initial pull request auditing catches OWASP vulnerabilities, unindexed database queries, and bad architectural smells before code hits production.

15 Automated Code Review Prompts

• 1. OWASP Security Audit Prompt: Act as a Cybersecurity Auditor. Analyze the following PHP/Javascript code snippet for OWASP Top 10 vulnerabilities (SQL Injection, Cross-Site Scripting, CSRF, insecure deserialization). Highlight bugs in RED and provide secure, refactored code.
• 2. SOLID Principles Compliance Check: Act as a Software Architect. Review the following class definition: [Paste Code]. Audit the code against SOLID principles (Single Responsibility, Open/Closed, etc.). Suggest refactoring patterns to split tight dependencies.
• 3. Database Query Performance Review: Act as a Senior database engineer. Review the following Eloquent/SQL query pipeline code: [Paste Code]. Identify N+1 query problems, lack of eager loading, unindexed columns, and draft optimized alternatives.
• 4. Memory Leak Code Inspector: Act as a Senior systems developer. Inspect the following Node.js code block: [Paste Code] for event listener leaks, unclosed stream references, or heavy memory usage. Suggest heap management improvements.
• 5. Clean Code & Variable Naming Review: Act as a code quality reviewer. Audit this code for clean code practices. Identify unclear variable names, complex nested conditionals (suggest guard clauses), long methods, and lack of docstrings.
• 6. TypeScript Type Safety Audit: Act as a TypeScript lead developer. Review the following TypeScript module: [Paste Code]. Identify instances of "any", type assertions, or loose types. Suggest strict interfaces and generic types.
• 7. Thread Safety & Race Conditions: Act as a concurrent systems engineer. Analyze the following Go/Java concurrency logic: [Paste Code] for potential race conditions, deadlocks, or thread safety issues. Provide mutex locking fixes.
• 8. RESTful API Standards Compliance: Act as an API Architect. Audit the following controller route handler: [Paste Code] for RESTful best practices. Review HTTP methods, response headers, error codes, and resource paths.
• 9. CSS Specificity and Code Bloat: Act as a CSS architect. Audit the following CSS/Sass code block for nesting depth, specificity conflicts, redundant properties, and suggest lightweight clean layouts.
• 10. Error Handling & Resiliency Review: Act as a software reliability engineer. Audit this code block: [Paste Code] for error safety. Verify try-catch block placements, error logging, fallback values, and resource cleanup.
• 11. Unit Test Coverage Gap Analysis: Act as a QA lead. Review the following class code and its matching test suite: [Paste Code]. Identify missing edge cases, boundary parameters, and invalid input test configurations.
• 12. Docker Image Safety & Bloat Audit: Act as a DevOps auditor. Review this Dockerfile: [Paste Code] for security vulnerabilities, unnecessary base packages, missing health checks, and bad layer ordering. Suggest fixes.
• 13. Git PR Commit Squashing Review: Act as a git lead. Review the branch history commits list: [Paste List]. Suggest squashing strategies and clean git commit message formatting to match conventional commits.
• 14. React Component Dependency Auditing: Act as a React performance reviewer. Audit this component: [Paste Code] for unnecessary dependencies in useEffect, useCallback, and useMemo dependencies array to prevent infinity render loops.
• 15. Localization & Accessibility Compliance: Act as an accessibility specialist. Audit this HTML/JSX markup: [Paste Code] for WCAG 2.1 compliance (aria tags, contrast labels, screen reader friendliness, hardcoded strings, lang tags).

Classify Findings by Severity

Raw AI review output is noisy — add this instruction to any prompt to force actionable categorization:

Append to any prompt: "Categorize every finding as Blocker, Major, Minor, or Nit, and skip Nits unless nothing else exists."

Wiring AI Review into Your CI Pipeline

Manual prompting doesn't scale — the production pattern is PR-triggered automation:

1. PR opened → diff extracted: GitHub Action pulls the changed-file diff.
2. Scoped review prompt: send only the diff + surrounding file context (full repos blow the context window).
3. Structured output: ask for JSON findings (file, line, severity, fix) — parse reliably with JSON Extractor.
4. Post as PR comments: blockers block merge; minors become suggestions.
5. Human gate: AI reviews first-pass; a human still approves — AI hallucinations on business logic are real.

curl -X POST "https://rsflowhub.com/api/v1/ai/chat" \
  -H "X-API-Key: YOUR_FLOWHUB_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "Audit this diff for OWASP issues and N+1 queries, return JSON findings: [diff]"}'

Frequently Asked Questions