fix-vuln

/fix-vuln

Fix a specific vulnerability class in provided code, with root cause analysis, the corrected implementation, and verification guidance.

Trigger

Use when you have identified (or suspect) a specific vulnerability in code and need to fix it correctly. Appropriate for:

• Remediating findings from a security audit or penetration test
• Fixing a vulnerability reported through a bug bounty program
• Correcting a pattern flagged by a SAST tool
• Learning the proper fix for a specific vulnerability class
• Verifying that a proposed fix actually resolves the vulnerability

Input

• Code containing the vulnerability: The specific code to fix
• Vulnerability class: What type of vulnerability to fix. Examples:
  • "SQL injection in the search function"
  • "XSS in the comment display"
  • "Path traversal in the file download endpoint"
  • "Insecure deserialization in the session handler"
  • "Hardcoded credentials in the database config"
  • "Missing authorization check on the admin endpoint"
  • "Weak password hashing with MD5"
• Additional context (optional): Framework, deployment environment, constraints on the fix

Process

1. Vulnerability confirmation -- Analyze the provided code to confirm the vulnerability exists and understand its exact nature. If the code is not actually vulnerable, explain why.

2. Root cause identification -- Determine the fundamental cause:

   • Is it a missing control? (no authorization check)
   • Is it a wrong API choice? (string concatenation instead of parameterized query)
   • Is it a configuration issue? (security feature disabled)
   • Is it a logic flaw? (checking condition incorrectly)
   • Is it a design issue? (architecture that makes security hard)

3. Impact assessment -- Explain what an attacker can achieve by exploiting this vulnerability:

   • Data theft, modification, or destruction
   • Authentication bypass or privilege escalation
   • Remote code execution
   • Denial of service
   • Information disclosure