AI Coding Agent Codebase Audit & Modernization
A structured audit prompt designed for AI coding agents to evaluate an unfamiliar codebase, identify security anti-patterns, spot performance bottlenecks, and generate prioritized action plans.
Customize & Generate Your Prompt
Adjust the variables below. Your customized prompt updates live in real-time ready to copy with zero setup.
You are performing an exhaustive technical audit of an existing codebase. ### Codebase Context - **Tech Stack**: Next.js 16 (App Router), TypeScript, Tailwind CSS, Prisma, PostgreSQL on Supabase, Upstash Redis - **Primary Audit Priority**: Security Vulnerabilities & Input Validation (OWASP) - **Known Constraints or Non-Negotiable Boundaries**: - Must preserve existing public API contracts and response schemas. - Must not introduce new heavy runtime dependencies. - Must maintain backward compatibility for existing active database rows. ### Audit Directives Analyze the provided architectural files, configuration, and patterns according to this 4-phase framework: 1. **Security & Vulnerability Assessment**: - Check for client-side secret exposure, unvalidated inputs, SQL/NoSQL injection risks, SSRF, and unauthenticated endpoints. - Evaluate authentication boundaries, session handling, and CORS policies. 2. **Performance & Resource Utilization**: - Identify blocking network requests, large bundle culprits, N+1 database queries, and memory leak hazards. - Recommend targeted optimizations (caching, query optimization, asset lazy-loading). 3. **Architecture & Code Maintainability**: - Assess modularity, circular dependencies, type strictness, and error-handling consistency. - Identify legacy patterns that should be deprecated. 4. **Actionable Remediation Matrix**: - Deliver a prioritized Markdown table with columns: [Issue, Severity (Critical/High/Medium/Low), Effort (S/M/L), Recommended Fix]. - Provide code snippets showing before and after implementations for the top 2 highest-impact findings.
How to Use & Customize This Prompt
Fill in your target framework, environment rules, or source metrics in the interactive builder above. The assembled template updates instantly.
Click "Copy Prompt to Clipboard". You can copy the full assembled text or copy system instructions separately.
Refer to the Model Guidance below to choose the highest-performing frontier model or local runtime for this specific task.
Paste into your AI coding tool, chat interface, or local Ollama runtime. Verify syntax, types, and schema compliance against expected output.
Workflow Guidance
- Enter your tech stack details and choose your primary audit priority.
- Add any constraints such as uptime requirements or database preservation rules.
- Feed the prompt to your AI model alongside your repository outline or key route handlers for a comprehensive health audit.
Representative AI Output
Sample output produced when using frontier AI models with the default parameters:
### Prioritized Audit Remediation Matrix | Issue | Severity | Effort | Recommended Fix | | :--- | :--- | :--- | :--- | | Unsanitized search params in SQL query | **Critical** | S | Replace raw template string with parameterized query | | Unbounded in-memory rate limiter | **High** | M | Migrate to atomic Redis sliding window counters | | Uncompressed dynamic images | **Medium** | S | Route through Next.js Image optimization pipeline |
Pro Optimization & Edge-Case Tips
- Run this prompt with your `package.json`, database schemas, and main API route files for the most accurate findings.
- Use the resulting remediation matrix directly in GitHub Issues or Linear tasks for phased team sprints.
- Combine this with automated linting and static analysis tools like ESLint and SonarQube for continuous coverage.
Recommended AI Models for Coding & Full-Stack Engineering
Frontier models tested against Next.js 15, TypeScript 5.6, Supabase, and automated unit test generation.
Claude 3.5 Sonnet
Deep codebase reasoning, complex Next.js App Router rules, and full test suites without omissions.
- Unrivaled understanding of modern React 19 / Next.js Server Components
- Strict compliance with system instructions without skipping edge-case checks
- Generates syntactically complete Vitest and RTL mocks
OpenAI GPT-4o
Rapid iterative debugging, Supabase function logging, and strict JSON output schemas.
- Sub-second first-token latency for fast dev loops
- Excellent function-calling and schema validation reliability
- Accurate regex generation and API endpoint routing
DeepSeek-Coder V2
Local inference and budget-friendly batch refactoring across large file trees.
- 236B MoE architecture competitive with proprietary frontier models
- Strong 128K context window for multi-file dependency trees
- Available via Ollama and vLLM for self-hosted private workflows
Copy your assembled prompt and test immediately with approved frontier models or your own API key.
Also Checkout
Verify AI-generated media, inspect deep image/video provenance, check C2PA cryptographic manifests, and strip sensitive EXIF tags with our 100% private, client-side tools.
AI Media Detector
Verify whether an image or video is AI-generated, check C2PA cryptographic manifests, and detect synthetic provenance markers.
Photo Metadata Viewer
Inspect deep EXIF, IPTC, and XMP metadata, view camera optics and GPS coordinates, and strip metadata to protect your privacy.
Related Tools on SPAUL Hub
More in Developers & Coding
View CategoryNext.js App Router Project Rules & AI Coding Agent Instructions
A comprehensive system prompt that transforms AI coding assistants (Claude 3.7, Cursor, ChatGPT, Gemini) into disciplined Next.js App Router architects. Prevents common hydration traps and enforce strict separation between Server and Client Components.
Supabase Edge Function Debugging & Security Review Prompt
Diagnose runtime errors, CORS header issues, environment variable leakage, and authentication token validation bugs in Supabase Deno Edge Functions.
React Component Refactoring & Unit Test Generation Prompt
Turn bloated, legacy React components with tangled state into modular, accessible, and high-performance components backed by a production-ready test suite.