A template and demo for generating comprehensive security reports with executive summaries, prioritized findings, remediation steps, and testing guidance for engineering and security teams.
For a complete security overview, this document demonstrates how to generate an executive summary suitable for senior leadership (CTO, CISO). It highlights overall posture, prioritized findings, and high-level remediation steps — serving as a roadmap for engineering teams and security reviewers.
Below is a standard, ready-to-use template for a comprehensive security report. Save this file to audits/comprehensive-security-report.md in your repository. This executive summary is intentionally high-level — pair it with detailed technical audits and remediation code before making changes in production.
Copy
Based on our complete security audit, generate a comprehensive security report:## Executive Summary— Overall security posture (Critical/High/Medium/Low) — Number of vulnerabilities by severity — Immediate actions required## Critical Vulnerabilities (Fix Immediately)[List with CVE references if applicable]## High Priority Issues (Fix within 1 week)[Detailed list with code locations]## Medium Priority Issues (Fix within 1 month)[List with recommendations]## Low Priority Issues (Fix in next release)[List of improvements]## Security Recommendations1. Implementation priorities2. Security tools to adopt3. Process improvements4. Training needs## Compliance Checklist- OWASP Top 10 coverage- PCI DSS (if handling payments)- GDPR (if handling EU data)- SOC 2 requirements## Code ExamplesProvide secure code examples for each vulnerability type found.## Testing GuideInclude curl commands or test scripts to verify each fix.
This report is a high-level roadmap. It should always be paired with detailed technical audits, test cases, and human review before rolling changes into production.
A standard automated walkthrough will produce a TODO list while scanning the codebase and configuration. Use this checklist as a starting point for manual validation and prioritization.Example checklist items:
Copy
# Example interactive audit notes / TODOsUpdate Todos Read existing logging and monitoring security audit Analyze codebase structure and identify security-relevant files Examine authentication and authorization mechanisms Review input validation and sanitization Check for SQL injection vulnerabilities Assess session management security Review error handling and information disclosure Check dependencies for known vulnerabilities Analyze configuration security Generate comprehensive security report
Common tooling examples and quick invocations:
Copy
# Dependency scanningnpm audit --json# or for yarn usersyarn audit --json# Static analysis examplesnpm run lintnpx semgrep --config auto
Inspect configuration and environment files for secrets and sensitive values. Redact any findings before committing reports:
Copy
# Example .env entries found during audit (redact before committing)JWT_SECRET=your_jwt_secret_key_hereDB_USER=your_db_userDB_PASSWORD=your_db_password
Never commit secrets to source control. Use secret management solutions such as:
Use this concise view to communicate risk and priorities to leadership. Pair it with technical remediation tasks for developers.
Severity
Count
Recommended action
Critical
3
Fix immediately; emergency patching and credential rotation
High
4
Address within 1 week; apply mitigations and monitoring
Medium
4
Plan fixes within 1 month; add validation and controls
Low
1
Schedule for next release; improve observability
Example overall posture: 9.2 / 10 (lower is better; this is an example score from an automated assessment). Below are representative excerpts and prioritized items with locations and impacts.
[List critical items here with CVE references when applicable. Example items include exposed credentials, insecure defaults, and cleartext secrets. Provide direct remediation steps and code pointers.]
Include practical test commands and small scripts in the detailed audit to validate each fix. Example curl checks:
Verify HTTPS redirection and headers:
Copy
curl -I https://your-app.example.com# Check for Strict-Transport-Security, Content-Security-Policy, X-Frame-Options
Test rate limiting:
Copy
# run multiple rapid requests and expect 429 after thresholdfor i in {1..50}; do curl -s -o /dev/null -w "%{http_code}\n" https://your-app.example.com/login; done
Check token revocation and logout:
Copy
# after logout, previously issued token should be rejectedcurl -H "Authorization: Bearer <old_token>" https://your-app.example.com/protected
Include unit and integration tests for each fix (input validation, error handling, logging behavior).
Guidance on using LLMs for code and security reviews
LLMs can speed up audits and generate remediation suggestions, but they are not a replacement for human expertise.
LLMs may reproduce insecure or dated patterns (e.g., embedding secrets, weak defaults).
Always validate LLM outputs with static analyzers, dynamic tests, and human review.
Combine LLM findings with automated scanners (SCA/SAST/DAST) and security engineers before production rollout.
Do not deploy code generated solely by an LLM without a human security review and appropriate testing. LLMs can suggest insecure defaults or repeat bad practices.
This comprehensive report is a high-level executive summary and prioritization tool. Pair it with granular technical audits and remediation code.
Keep secrets out of source control and use a secrets manager for all environments.
Store this generated report as audits/comprehensive-security-report.md in your repository for traceability.
Repository with prompts used for course material: https://github.com/JeremyMorgan/Claude-Code-Reviewing-PromptsThank you — future lessons will cover automated remediation, CI/CD security testing, and advanced vulnerability validation techniques.
