ai-security-review

Prompt file imported from TrevorPLam/prompts (.windsurf/workflows/ai-security-review.md). Copyright stays with the author.

AI/LLM Security Review Workflow

This workflow provides a comprehensive security review process for AI and LLM integrations, ensuring compliance with OWASP GenAI security standards.

Step 1: Input Security Assessment

Evaluate how user inputs are handled before reaching AI models:

1. Input Validation

   • Check for proper schema validation using Zod or similar
   • Verify input sanitization and encoding
   • Ensure length limits and character restrictions
   • Validate file uploads and content types

2. Prompt Injection Prevention

   • Review prompt templating and escaping mechanisms
   • Check for instruction following techniques
   • Verify user input separation from system prompts
   • Test for prompt injection attempts

Step 2: Model Security Review

Assess the security of AI model interactions:

1. API Security

   • Verify API key storage and rotation
   • Check for proper authentication headers
   • Review rate limiting implementation
   • Validate request signing and verification

2. Output Validation

   • Check for content filtering and sanitization
   • Verify output schema validation
   • Review harmful content detection
   • Ensure no sensitive data leakage

Step 3: Data Privacy Compliance

Ensure compliance with privacy regulations:

1. Data Handling

   • Review data retention policies
   • Check for PII detection and redaction
   • Verify consent management
   • Assess data residency requirements

2. Third-party Services

   • Review data sharing with AI providers
   • Check for privacy policy compliance
   • Verify data processing agreements
   • Assess cross-border data transfers

Step 4: Operational Security

Review operational aspects of AI deployments:

1. Monitoring and Logging

   • Check for comprehensive audit trails
   • Review anomaly detection mechanisms
   • Verify cost monitoring and alerts
   • Assess performance monitoring

2. Incident Response

   • Review AI-specific incident procedures
   • Check for model failure fallbacks
   • Verify containment strategies
   • Assess communication protocols

Step 5: Testing and Validation

Comprehensive testing of AI security measures:

1. Security Testing

   • Perform prompt injection testing
   • Test for data leakage scenarios
   • Verify rate limiting effectiveness
   • Test authentication bypass attempts

2. Adversarial Testing

   • Test with malicious inputs
   • Verify model behavior under stress
   • Check for prompt jailbreaking
   • Test for model hallucination impacts

Security Checklist

Input Security

• All user inputs validated with schemas
• Prompt injection defenses implemented
• Input sanitization and encoding in place
• File upload security configured

Model Security

• API keys properly secured and rotated
• Output validation and filtering active
• Rate limiting and cost controls configured
• Error handling doesn't expose secrets

Data Privacy

• PII detection and redaction implemented
• Consent management configured
• Data retention policies enforced
• Cross-border data compliance verified

Operational Security

• Comprehensive audit logging active
• Anomaly detection configured
• Cost monitoring and alerts set
• Incident response procedures defined

Testing

• Security testing completed
• Adversarial testing performed
• Penetration testing conducted
• Regular security reviews scheduled

Critical Security Issues (Stop Deployment)

• No prompt injection protection - Immediate security risk
• API keys in client code - Credential exposure
• No output validation - Content security risk
• Missing audit logging - Compliance and security risk
• No rate limiting - Cost and DoS risk

Tools and Commands

Security Testing

# Prompt injection testing
npm run test:prompt-injection

# API security scanning
npm run audit:api

# Dependency vulnerability check
npm audit --audit-level moderate

# SBOM generation
npm run sbom

Monitoring Setup

# AI-specific monitoring
npm install @opentelemetry/api-ai

# Cost tracking
npm install ai-cost-monitor

# Anomaly detection
npm install anomaly-detector

Documentation Requirements

1. AI Security Policy - Document all security measures
2. Data Processing Agreement - For third-party AI services
3. Incident Response Plan - AI-specific procedures
4. Compliance Documentation - Privacy and regulatory compliance

Review Frequency

• Pre-deployment: Full security review
• Quarterly: Security assessment update
• After incidents: Post-mortem and improvements
• Model updates: Security impact assessment

Remember: AI security is an ongoing process, not a one-time checklist. Regular reviews and updates are essential as threats evolve.