Code review prompt

What most people type

review my code for security issues ```js app.get('/file', (req, res) => { res.sendFile(__dirname + '/uploads/' + req.query.name); }); ```

It works, but the AI has to guess your express and Node.js versions, who can call endpoint and what files are in /uploads, so the first answer usually needs another round. The version below asks for exactly what a professional would deliver.

Review this Express.js route for security issues.

```js
app.get('/file', (req, res) => {
  res.sendFile(__dirname + '/uploads/' + req.query.name);
});
```

Context: [Express and Node.js versions], [who can call this endpoint: public or authenticated users], [what files are stored in /uploads].

For each issue, give:
- The vulnerability and its severity (high, medium or low).
- How it could be exploited, with a short example request.
- A fix, shown as corrected code.

Then give one final version of the route with all fixes applied, and a short list of any other hardening steps worth considering (such as authentication, rate limiting or file type restrictions). If you are unsure whether something is a real risk in this context, say so.

Replace the [brackets] with your details before you send it: Express and Node.js versions, who can call this endpoint: public or authenticated users, what files are stored in /uploads.

Why this version works

• Named the framework and task directly. Makes the review target clear.
• Asked for severity, exploit, and fix per issue. Gives a structured, actionable security review.
• Requested one final corrected route. Delivers usable code on the first try.
• Added context placeholders. Versions and exposure change which risks matter.

What a professional code review prompt covers

• Asks for issues ranked by severity
• Asks for fixed code
• Framework placeholder such as Express version

Best AI model for this prompt

This is a hard reasoning task: security review needs accurate vulnerability spotting; a missed path traversal detail would ruin it. You don't need the most expensive model. The cheapest model at each company that handles it well:

Pay-per-use list prices for this prompt and its expected answer (about 700 tokens). On a monthly chat plan, the same choice shows up as more messages before you hit your limit. See today's AI prices.