ai-saas-security-review

Conduct an AI SaaS security review by mapping code changes across six threat layers—identity, authorization, input, AI, action, and observability—to produce structured findings with severity definitions and actionable fixes.

Security checks for AI prompt injection must validate direct and indirect injection vectors via memory or file uploads, scan tool-output injection paths, and detect jailbreak patterns using a structured threat model.

Audit multi-tenant authorization and Row Level Security (RLS) by applying production hardening checklists to verify data isolation, validate webhook signatures, and ensure strict tenant boundary enforcement across endpoints.

Yes, you can use an OWASP-style checklist to secure LLM flows by evaluating classical web risks like XSS, CSRF, and file upload vulnerabilities alongside AI-specific threats such as system-prompt extraction and tool-output injection.

Structure security findings for merge-blocking decisions by categorizing threats into distinct layers and assigning CRITICAL or HIGH severity ratings with concrete reproduction steps and mitigation guidance.

Protect admin surfaces and validate webhooks by executing production hardening procedures that enforce rate limiting, implement strict webhook signature verification, and apply secret scanning checklists across the application.