\n
\n *Not a promo.. I mean why would anyone promote something free, actually looking to get some contributors to help us seal sone holes of ai-coded products and encourage founders of ai-written products to respect security and privacy.*<\/p>\n
So, here it goes.. Nowadays many of us are building with Claude Code, Copilot, Cursor, Codex, Gemini, or any AI coding assistant, this is worth running against your project. – To be honest, I did think of building a tool around this, but it doesn’t sound nice to monetize on vulnerabilities for me, nor do I see much logic having a ‘blackbox’ that allegedly scans your projects. We’re talking about security here, so IMO such things should be open source and allow contributions.<\/p>\n
And of course – my good friend AI helped me speed up the shipment of this repo \ud83d\ude42<\/p>\n
Some of most common things that appear :<\/p>\n
JWT secrets set to “secret” or “changeme”<\/p>\n
API keys in NEXT_PUBLIC_ env vars, fully exposed to the browser
\nUser input going directly into system prompts via string interpolation
\nVector databases using one shared namespace for all users \u2014 any user’s RAG query can
\nsurface another user’s documents
\nAgents handed child_process access with no scope restrictions<\/p>\n
These aren’t obscure edge cases, this is how most of AI-generated code comes out, if you allow it to produce HUGE chunks instead of targeted and controlled ai-coding. Even knowing tons about security and vulnerabilities, having AI write code might still expose you to some common cases. <\/p>\n
The problem with existing references<\/p>\n
OWASP, NIST, and CWE are good. They were written for a world where developers wrote most of their code by hand. They don’t cover MCP tool poisoning, cross-agent prompt injection, or what happens when your agent’s long-term memory accepts unsanitized writes. Ok, that’s not entirely true – today AI-generated code is allover the place, so we see more and more tools to review the code, etc, but many are paid and\/or complicated which is an entry barrier for a vibe coder.<\/p>\n
What I and few AIs shipped<\/p>\n
A 258-item checklist across 17 categories, with a detection method for every item: static grep or AST pattern, runtime test, or config inspection. Severity rated. 33 items in Category 6 specifically cover LLM integration vulnerabilities that don’t appear elsewhere.<\/p>\n
More usefully: a companion prompt.md that turns the full checklist into a structured codebase scan you can run in one command.<\/p>\n
Running it<\/p>\n
From your project root, with Claude Code installed:<\/p>\n
claude “$(curl -s https:\/\/raw.githubusercontent.com\/a-leks\/genai-app-security-checklist\/main\/prompt.md)”<\/p>\n
Enter fullscreen mode<\/p>\n
Exit fullscreen mode<\/p>\n
With Gemini CLI:<\/p>\n
gemini “$(curl -s https:\/\/raw.githubusercontent.com\/a-leks\/genai-app-security-checklist\/main\/prompt.md)”<\/p>\n
Enter fullscreen mode<\/p>\n
Exit fullscreen mode<\/p>\n
The model reads your codebase, runs all 258 checks, and returns a markdown report with severity, file path, line number, code snippet, and a specific remediation for each finding.<\/p>\n
What the output looks like<\/p>\n
### (6.1) Prompt injection \u2014 user input in system prompt
\n– Severity: Critical
\n– File: app\/api\/chat\/route.ts
\n– Line: 34
\n– Snippet:
\n const systemPrompt = `You are a helpful assistant. User context: ${req.body.userBio}`
\n– Remediation: Move user-supplied content to the user message role, never system.
\n Strip prompt control characters before passing any user string to the model.<\/p>\n
Enter fullscreen mode<\/p>\n
Exit fullscreen mode<\/p>\n
The LLM-specific items worth knowing<\/p>\n
6.26 \u2014 MCP tool poisoning. If your agent uses third-party MCP servers, tool results from those servers enter the agent’s context as trusted input. An attacker who controls one of those servers can inject instructions through it.<\/p>\n
6.27 \u2014 Agent memory poisoning. Whatever your agent writes to long-term memory gets read back in future sessions. If malicious content reaches that memory store, it executes next time the agent retrieves it.<\/p>\n
6.30 \u2014 Cross-agent prompt injection. In multi-agent systems, output from Agent A becomes input to Agent B. If an attacker can influence Agent A’s output, Agent B processes the attack payload without knowing its origin is untrusted.<\/p>\n
Where to find it<\/p>\n
https:\/\/github.com\/a-leks\/genai-app-security-checklist<\/p>\n
Apache 2.0. Contributions welcome \u2014 especially new LLM attack patterns with detection methods and real-world references.<\/p>\n