Inference Recon

AI helped you build it.
The least it can do is help you secure it.

Don't trust prompts from the internet. That includes this one. Paste it into your AI and ask if it's safe before you run it.

View prompt ↓ 

  


  

    
How to use it

    
    
      
  1. Copy the prompt
    2. 
      
  2. Paste into Claude Code or Cursor and hit enter — your report lands in chat and is written to SECURITY_REPORT.md
    3. 
      
  3. Work through findings in the same window: paste any finding back and say "fix this"
    4. 
    

    
Your AI will ask for permission before it reads your files. That's expected — it's asking to view your code, nothing else. Approve it to continue.

  


  

    
What you get

    
## Scorecard
| Domain           | Grade |
|------------------|-------|
| Code             |   B   |
| Dependencies     |   A   |
| Secrets & Config |   F   |
| Architecture     |   C   |
| Overall          |   F   |

    
Every finding includes the file and line number, a plain-English explanation of what's wrong, how an attacker would use it, and a specific fix.

    
Paste any finding back into your AI and say "fix this" — same tool, same window. You already know how to do this.

  


  

    
Which model?

    
All models will surface the critical and high severity issues that matter. Faster models produce more noise — good for a quick check but may result in less precision. Use the more capable models when precision matters: before launch, before handling payments, or when you need to trust the output.

    

      

        Haiku
        Fast, affordable. Good first pass.
      

      

        Sonnet
        Better precision. Good for most use cases.
      

      

        Opus
        Most thorough. Pre-launch and sensitive codebases.
      

    

  


  

    
After the scan

    
A code scan can only see what's in your files. Your domain, accounts, infrastructure, and provider security are a separate surface this scan cannot see.

    
The Human Guide covers everything else. Most items take under 15 minutes.

    Open the Human Guide →
  


  

    
When you're done fixing

    
Paste the wrap-up prompt in the same window. Your AI reads SECURITY_REPORT.md automatically — no copy-pasting your report. It checks every finding, flags false positives, and generates a feedback block to submit.

    Open the wrap-up prompt →
  


  

    
A note on trust

    
Fix what it finds and you'll be meaningfully more secure than when you started. The patterns it looks for are the ones that actually get apps breached. It won't catch everything — no tool does — but it's a real starting point, not a checkbox.

  


  

    
FAQ

    

      Why is this better than just asking my AI to review my code?
      

        
Structured procedure, stack-specific rules, forced prioritization. Freeform asks produce inconsistent results — this doesn't.

      

    

    

      Can this miss things?
      

        
Yes. Treat the report as a starting point. If it misses things, let us know.

      

    

    

      Does this work on my stack?
      

        
The baseline scan works on any stack with readable source files. Targeted rules for Next.js, Supabase, Stripe, and OpenAI activate automatically on top of that.

      

    

    

      Which agents does this work with?
      

        
Tested on Claude Code, Cursor, and Codex. Should work fine on the others too.

      

    

    

      How does the scoring work?
      

        
Heuristic weights, not academic ones. Directly exploitable findings score higher than theoretical ones.

      

    

    

      Is this a substitute for a professional security audit?
      

        
No. A professional audit covers your team, your processes, your deployment pipeline, and someone actively probing your running application. Different tool, different user.

      

    

    

      Can this hallucinate a finding?
      

        
Yes. The prompt prohibits invented CVE IDs and instructs the model to omit rather than guess when it's uncertain — that reduces it. But it doesn't eliminate it. Confirm anything that matters by reading the flagged code.