Tool-Agnostic Security Remediation Recipes
Prompts, toolsets, and patterns that are not tied to a specific agent live here. Treat General as the default shelf: recipes should be usable by any workflow that can read the prompt, fetch the JSON, or attach the MCP context.
What usually lives here
- Triage frameworks - the decision trees and checklists your team uses when a new finding lands.
- Guardrail patterns - repeated ideas for keeping automation safe, such as scoped credentials, dry-run gates, and review policies.
- Review checklists - what a human should look at when reviewing a machine-generated PR.
- PR templates - the body your workflow should fill in when it opens a PR.
- Commit-message conventions - style rules automation should follow when committing.
- Python helper toolsets - small scripts and checks that prepare evidence, normalize scanner output, or validate a recipe result.
When this is the right folder
Put a recipe here when the finding class, evidence question, or helper toolset matters more than the product used to run it. Product-specific packaging can be mentioned inside the recipe, but the reusable guidance belongs in General.
Browse entries
Every entry carries its author, team, and maturity. Click any card for the full prompt.
Compliance standards
Browse 39 source-backed compliance and assurance recipes with framework scope, version status, official references, and evidence requirements for review.
OWASP Top 10:2025 — repo audit
developmentAudit a repository against the current OWASP Top 10:2025 web application risks and return a prioritized, read-only report with file-level evidence.
OWASP Top 10:2025 — remediate
developmentTurn one current OWASP Top 10:2025 web application finding into a bounded, tested, reviewer-ready remediation pull request or an explicit triage note.
SAST finding — triage and fix
developmentA tool-agnostic prompt that takes a single SAST finding and either opens a reviewer-ready PR (true positive, fixable), opens a suppression PR with justification and an expiry …
Base image — bump and rebuild
developmentUse an AI coding agent to remediate one base-image or OS-package CVE, rebuild and rescan the container, verify the fix, and return a scoped pull request or triage note.
Source code audit - attack surface map
developmentA tool-agnostic source-code audit recipe that asks an agent to map where untrusted input enters a repository, where privileged actions happen, and which trust boundaries deserve …
Compromised package — cache quarantine
developmentA tool-agnostic prompt that takes a "this package is malicious" advisory and runs the eviction across the org's registries, caches, and mirrors — quarantining the artifact, …
Source code audit - auth and tenant boundaries
developmentA focused source-code audit recipe for authorization, tenant isolation, object ownership, and privilege-boundary mistakes. It is designed for code review sessions where the …
CVE intelligence intake gate
developmentProcess one CVE intelligence signal through source validation, finding classification, recipe routing, and bounded agent handoff before remediation.
Source code audit - injection and unsafe sinks
developmentAudit source-to-sink data flows for SQL injection, shell execution, SSRF, XSS, unsafe deserialization, path traversal, XXE, and LLM tool calls.
Agent session — telemetry-driven kill rules
developmentA tool-agnostic prompt that takes a workflow's run telemetry and a draft set of decision rules, and produces (a) a vetted rule pack the session monitor can load and (b) a …
Source code audit - secrets and data exposure
developmentA source-code audit recipe for finding places where secrets, tokens, credentials, regulated data, or customer content can leak through code, logs, telemetry, prompts, artifacts, …
Source code audit - dependency and build integrity
developmentA source-code audit recipe for dependency hygiene, lockfile integrity, build and CI trust boundaries, generated artifacts, package publishing, and release provenance.
Classic Vulnerable Default Security Recipes
Browse agent-ready security recipes for replacing unsafe defaults such as pickle, unsafe YAML, JNDI, JWT `none`, XXE, polymorphic deserialization, `eval`, and similar language and framework patterns.
Crypto & DeFi Security Recipes
Tool-agnostic prompts for securing cryptocurrency payment flows, wallet operations, and DeFi protocol controls.
Code Hygiene Recipes
Bounded audit and remediation recipes for code correctness, maintainability, lifecycle safety, and diagnostic debt across major ecosystems.