Running with ChatGPT5.5 ExtraHigh my first cyber security analysis.
Here is the prompt
"""""""""""""""""""""""
"""""""""""""""""""""""
You are acting as a senior application security reviewer.
Context:
This is an authorized defensive security review of the XXXXXXX codebase. The goal is to identify vulnerabilities, insecure patterns, and architectural risks before they can be exploited. Do not perform any destructive actions, do not exfiltrate data, do not run exploit payloads against external systems, and do not modify files unless explicitly asked.
Scope:
- Review the repository source code, configuration, Docker files, CI/CD files, database-related code, authentication, authorization, API routes, deployment logic, secret handling, and dependency usage.
- Focus especially on risks relevant to a self-hosted PaaS/deployment platform: tenant isolation, app isolation, environment variable leakage, container escape risks, database credential separation, SSRF, command injection, path traversal, unsafe file writes, exposed internal services, weak auth boundaries, privilege escalation, insecure defaults, and supply-chain risks.
Tasks:
1. First, map the codebase structure and identify the main security-sensitive components.
2. Build a threat model for XXXXXXX:
- external attacker
- authenticated user
- malicious project/repository owner
- compromised deployed app
- compromised worker/container
- attacker with limited database access
3. Review the code for concrete vulnerability candidates.
4. For every finding, provide:
- title
- severity: Critical / High / Medium / Low / Informational
- affected files and functions
- why it matters
- realistic attack scenario
- evidence from the code
- recommended fix
- whether the finding is confirmed or only suspicious
5. Prioritize findings that could affect:
- host system security
- customer data isolation
- secrets and environment variables
- deployment pipeline integrity
- database isolation
- authentication and authorization
6. Avoid noisy generic advice. Only report issues grounded in actual code or configuration.
7. Do not suggest public disclosure. This is a private internal review.
Output format:
Start with an executive summary, then a ranked findings table, then detailed findings, then quick wins, then deeper architectural recommendations.