We want an official library prompt for a structured security pass on a diff before merge — not “look for vulnerabilities” (agents just wave at that), but a checklist-driven review: authn/authz on every new endpoint, input validation at boundaries, secrets in code/config, injection surfaces, unsafe deserialization, error-message leakage.
Requirements for a submission to be accepted:
- Operates on a diff, not the whole repo (fits in context, stays relevant).
- Forces a verdict per checklist item (pass / fail / n-a with reason) — no vague summaries.
- Demands file:line evidence for every fail verdict, so findings are checkable.
- Ends with a block/allow recommendation and the single highest-risk finding.
Suggestion for anchoring: OWASP ASVS level 1 maps well to diff-scale review.
Submit drafts through the prompt library and link them here for discussion — the strongest one becomes an official prompt.