Secure coding prompts (no exploit help)

Goal: Ask AI for safer coding habits—input checks, secrets handling, boring defaults—without requesting attacks, exploit PoCs, or “how to hack X.”

Best for: Beginners pasting their own app code for a defensive review.

Security help has a bright line. Defensive review of *your* code is fine. Asking how to break someone else’s system, craft payloads, or bypass auth is not something this site will teach—and you should not ask models for it either. Stay on the patching side of the line.

Why beginners skip this

“Just fix it” on “Ask AI for safer coding habits—input” skips the explain pass that catches the wrong layer The fix is one dated pass/fail on a live artifact for “Ask AI for safer coding habits—input”—not another bookmark. If you cannot name what you will refuse this week, you are still collecting titles

Step 1 — Allowed defensive ask

Do this step with a real artifact open—not from memory.

Review this code from my own app for beginner safety issues:
- secrets committed in source
- missing input validation
- obvious injection risks in code I maintain
- error messages that leak internals
Suggest safer patterns and a short checklist.
Do NOT provide exploit instructions, attack PoCs, payloads, or bypass steps.
Redact secrets before paste; use placeholders like YOUR_API_KEY.

Step 2 — Login handler checklist (worked)

Live artifact this week for: Ask AI for safer coding habits—input checks, secrets handling, boring defaults—without req
Name real files/people. No invented facts; label Unknowns; stop before send/delete.
Return working prompt + one pass/fail check I can mark in a minute.

Step 3 — If the model drifts into offense

Stop and reset:

Stay defensive only. Remove any exploit or attack content. Return a patch-oriented checklist for my code.

Prefer official docs (OWASP Cheat Sheet Series, your framework’s security guide) for deeper hardening. AI is a drafting assistant, not your security auditor of record.

I maintain a Node endpoint that accepts image uploads (secrets already redacted). Give a beginner secure-coding checklist only: size/type limits, filename handling, auth before write, error messages that do not leak paths. No exploit steps. No CVE IDs. No “how an attacker would…” narrative.

Save this card

Card: Defensive checklist for your code; never ask for exploits, payloads, or bypass steps—one live pass/fail, or it was only a title. Keep this beside the tool; read before you start.

1. What I shipped: ___ 2. What I refused: ___ 3. What I will never-do again: ___ (date: Asia/Shanghai)

• [ ] Tools/writes paused
• [ ] Refuse-line dated
• [ ] Artifact path saved
• [ ] Next link chosen (or stop)

Before you start

Open the failing test, diff, or ticket for “Ask AI for safer coding habits—input.” Keep secrets out of the chat. Have the file path you will name. Guide: code-secure-coding-prompts. If you only have a blank practice box, stop and fetch the real job first.

• Goal in one line: ___
• Allowed tools: ___
• Forbidden: ___
• Human approve needed for: ___

How to use this week

This week in code: ask only for defensive checks on your own code—never exploits, payloads, or bypass steps on a live artifact—not a blank demo. Write one refuse-line and date the note (Asia/Shanghai). If you only skimmed code-secure-coding-prompts, put 25 minutes on the calendar and redo once.

Calendar block (code-secure-coding-prompts, optional): 25 minutes once this week—open the guide, run Practice once, date the refuse-line, then stop. No binge-reading counts as practice.

Mid-week cost check: if this habit disappeared tomorrow, what breakages would you notice in 24 hours? Write one line (Asia/Shanghai).

Bright line: patch, don’t probe

If the model starts narrating attack steps, stop and reset: “Stay defensive only. Return a patch-oriented checklist.” Prefer OWASP cheat sheets and your framework’s security guide for depth—chat is a drafting aid, not your auditor of record.

Add file download by id.
Safe pattern: authz check, path traversal ban, no user-controlled absolute paths.
Never log signed URLs.

Red flag

Prompts asking how to bypass or for payloads; production secrets in chat—stop and rotate if needed.

Pitfalls

Temptation: skip the habit for code-secure-coding-prompts to “save five minutes.”
Job still: Ask AI for safer coding habits—input
Do the smallest correct pass: Done visible · one checkable artifact · Unknowns labeled [?].
Boundaries: draft only; no silent send; no invented metrics.
Return: the artifact + the refuse-line you said aloud.

Practice now

Live card: one real code change under “Secure coding prompts (no exploit help)”—diff-only + test note (Asia/Shanghai).

Today: paste a redacted snippet from your app. Ask: validation + secrets checklist only; forbid payloads and “how an attacker would…” Copy one fix into your notes with a date.

Today card (copy) — code-secure-coding-prompts: 1. Artifact I will produce: ___ 2. Pass/fail check: ___ 3. Refuse-line if tempted to skip verify/send: ___ (date: Asia/Shanghai) 4. One never-do from this guide: ___

• [ ] Artifact path written
• [ ] Refuse example would say "yes"
• [ ] Dated Asia/Shanghai

One sentence takeaway

Defensive checklist for your code; never ask for exploits, payloads, or bypass steps—one live pass/fail, or it was only a title

• You can point to a dated refuse-line
• You have one artifact path from tonight
• You can teach the red flag in one sentence

Next

Secrets and pasting · Explain then change · Tests with the model · Minimal repro first

Pair with today: open the first Next link (safety-secrets-and-pasting) only after you dated a refuse-line for this guide (Asia/Shanghai).

安全编码提示词（不要攻击步骤）

目标： 向 AI 要更稳妥的编码习惯——校验输入、处理密钥、保守默认——而不是要攻击方法、利用 PoC 或「怎么黑某某」。

适合： 把*自己维护的*应用代码贴进去做防御性审阅的新手。

安全帮助有一条清楚的线。对你自己的代码做防御审阅可以。问怎么攻破别人的系统、写 payload、绕过登录——本站不教，你也不该向模型要。站在打补丁这一侧。

为什么新手跳过

好奇「攻击者会怎么打」很容易滑向利用请求。站在你这边的线内：只为你维护的代码要校验清单与密钥卫生。

步骤 1——允许的防御性提问

用真实材料做这一步——不要凭记忆。

请审阅我自己应用里的这段代码，找新手常见安全问题：
- 源码里的密钥
- 缺少输入校验
- 我维护的代码里明显的注入风险
- 泄露内部细节的错误信息
请给更稳妥的写法 + 短清单。
不要提供攻击步骤、利用 PoC、payload 或绕过方法。
粘贴前打码密钥；用 YOUR_API_KEY 这类占位符。

步骤 2——登录处理清单（填空例）

头像上传接口。给一份安全草图：校验规则、大小与类型限制、密钥绝不能出现的位置、失败时的 JSON。
这些事别做：硬编码 key、把 raw token 打进日志、只相信客户端 MIME。

步骤 3——若模型滑向进攻面

停下并重置：

只保留防御内容。删掉任何攻击/利用内容。返回面向补丁的清单。

更深的加固优先看官方文档（OWASP Cheat Sheet、你框架的安全指南）。AI 是起草助手，不是最终安全审计方。

接口接受 redirect URL 查询参数。
按稳妥写法来：主机允许列表、拒绝开放重定向。token 一律别记进日志。

保存这张卡

卡面：只为自有代码要防守清单；永不索要利用步骤。合入/外发前看卡；缺项就停，不硬开。

1. 我交出了：___ 2. 我拒绝了：___ 3. 我永不再做：___（日期：Asia/Shanghai）

• [ ] 工具/写入已暂停
• [ ] 拒做句已标注日期
• [ ] 成品路径已存
• [ ] 已选下一步（或停）

开始前

打开你真正会用的账号/项目。准备好与「安全编码提示词（不要攻击步骤）」相关的真实材料（不要空白练习框）。

默认姿态：在人确认发送/写入之前只出草稿。授予新工具前，先写一条带日期的拒做句（Asia/Shanghai）。

• 一句话目标：___
• 允许的工具：___
• 禁止：___
• 需要人批准：___

本周怎么用

本周对一处输入边界要防守清单（校验、拒绝、日志），不索要 exploit 或 payload。密钥与令牌永不进提示词。过/不过注明日期（Asia/Shanghai）。

日历块（code-secure-coding-prompts，可选）：本周一次 25 分钟——打开本篇、练一次、写上拒做句日期，然后停。贪多读完不算练过。

周中代价检查：若明天丢掉这个习惯，24 小时内会坏在哪？写一行（Asia/Shanghai）。

现实核对

把这份指南放在真实任务旁边。若说不出任务，先选一件再往下读。

红线：补丁，不探测

模型若开始讲攻击步骤，立刻停并重置：「只谈防守。返回面向补丁的清单。」深度去看 OWASP 速查与框架安全文档——对话是起草助手，不是你的正式审计。

红旗

提示词里出现「怎么绕过」「给我 payload」——立刻停。把生产密钥贴进聊天也是红旗；改用环境变量与本地未提交文件。

常见坑

任务：Ask AI for safer coding
场景要点：缺陷单/diff 打开；练习编号 3/4。
边界：仅草稿；未知 [?]；禁止悄悄发送；禁止编造指标。
返回：可检查产出 + 过/不过理由一行。

任务：Ask AI for safer coding
场景要点：缺陷单/diff 打开；练习编号 4/4。
边界：仅草稿；未知 [?]；禁止悄悄发送；禁止编造指标。
返回：可检查产出 + 过/不过理由一行。