DevOps Security & Hardening AI Prompts
147 free, production-ready DevOps Security & Hardening AI prompts — copy-paste ready for ChatGPT, Claude, or Cursor. Every prompt ships with fill-in placeholders, a worked example, and production-safety notes, so you get a usable answer on the first try.
- DevOps Security & Hardening Intermediate
Linux Server Hardening Prompt
Walk an AI through a CIS-style hardening review of a Linux server — services, users, SSH, kernel parameters, file permissions — with safe, ordered remediation.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Ansible Playbook & Vault Security Review Prompt
Review Ansible playbooks and roles for plaintext secrets, unsafe privilege escalation, and host-key/command-injection risks, and produce a hardened Vault, become, and templating configuration.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Advanced
Consul ACL & Gossip Encryption Hardening Review Prompt
Review a HashiCorp Consul cluster for open ACLs, unencrypted gossip and RPC, and over-broad tokens, and produce a hardened default-deny ACL, TLS, and encryption configuration.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Intermediate
Container Registry Authentication & Access Hardening Review Prompt
Review a container registry and its pull/push credentials for anonymous access, long-lived tokens, and over-broad scopes, and produce a hardened authentication, image-pull-secret, and access-control design.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Intermediate
Elasticsearch / OpenSearch Security Hardening Review Prompt
Review an Elasticsearch or OpenSearch cluster for anonymous access, missing TLS, and over-broad role mappings, and produce a hardened authentication, transport-encryption, and least-privilege RBAC configuration.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Advanced
gRPC TLS, Authentication & Authorization Review Prompt
Review a gRPC service for insecure channels, missing per-call authentication, and absent method-level authorization, and produce a hardened transport, credential, and interceptor design.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Advanced
Kafka mTLS & ACL Authorization Hardening Review Prompt
Review an Apache Kafka cluster for missing encryption-in-transit, weak client authentication, and over-broad ACLs, and produce a least-privilege listener, mTLS, and topic authorization configuration.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Intermediate
Log Redaction & PII/Secret Scrubbing Pipeline Review Prompt
Review a logging pipeline for secrets and PII leaking into logs, and produce a hardened redaction, field-masking, and retention design that scrubs sensitive data before it reaches storage or a SIEM.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Intermediate
osquery Endpoint Threat-Hunting Query Design Prompt
Design osquery scheduled packs and detection queries for defensive endpoint visibility — persistence, suspicious processes, and integrity drift — with tuning to control noise and performance.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Advanced
WebAuthn & Passkey Authentication Hardening Review Prompt
Review a WebAuthn/FIDO2 passkey implementation for weak relying-party settings, missing attestation and user-verification checks, and replay/downgrade gaps, and produce a hardened registration and authentication ceremony.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Advanced
GraphQL API Security Hardening Review Prompt
Review a GraphQL API for the abuse vectors unique to the query model — unbounded depth, introspection exposure, batching amplification, and field-level authorization gaps — and get a hardened schema and gateway config.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Advanced
SAML SSO Assertion Security Review Prompt
Review a SAML single sign-on integration for the assertion-handling flaws that cause authentication bypass — signature validation gaps, XML canonicalization tricks, audience/recipient scoping, and replay — and get a hardened SP configuration.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Advanced
Inbound Webhook HMAC Signature Verification Review Prompt
Review how your service authenticates inbound webhooks (Stripe, GitHub, Slack, custom senders) so forged, replayed, or tampered payloads are rejected before they trigger business logic.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Intermediate
Password Hashing & Credential Storage Review Prompt
Review how an application hashes and stores user passwords and secrets, and produce a hardened credential-storage design using a modern memory-hard KDF with correct parameters, salting, and migration.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Intermediate
Session Cookie Security Hardening Review Prompt
Review how a web application issues and manages session cookies and produce a hardened cookie policy covering Secure, HttpOnly, SameSite, scoping, lifetime, and session-fixation defenses.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Advanced
systemd Service Sandboxing Hardening Review Prompt
Review a systemd unit and produce a hardened, least-privilege sandbox using directives like ProtectSystem, NoNewPrivileges, capability bounding, syscall filtering, and namespace isolation without breaking the service.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Intermediate
Application Secrets Sprawl Discovery Audit Prompt
Audit where an application's secrets actually live (env files, config, container images, CI variables, code) to find sprawl, plaintext exposure, and missing rotation, then design a path to a managed secrets store.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
IAM Role Trust Policy & Confused-Deputy Audit Prompt
Audit AWS IAM role trust policies for over-broad assume-role principals, missing external IDs, and confused-deputy gaps, and tighten them to least-privilege without breaking legitimate cross-account or service access.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Data-Flow & Trust-Boundary Threat Model Prompt
Build a data-flow-diagram-driven threat model for a service — identifying trust boundaries, enumerating threats with STRIDE, and ranking concrete mitigations — to harden the design before attackers find the gaps.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Container Namespace & Cgroup Confinement Review Prompt
Review a container's runtime confinement — namespaces, cgroups, capabilities, user mapping, and mounts — to reduce the host attack surface and prevent a compromised container from escaping or exhausting resources.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Container Image CVE Remediation Plan Prompt
Turn a noisy container image vulnerability scan into a prioritized, action-ready remediation plan that separates base-image fixes from application-dependency fixes and from unfixable noise.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Outbound Firewall Egress Allowlist Hardening Prompt
Design a default-deny egress firewall policy from observed outbound traffic, locking down which destinations a host or workload may reach to contain data exfiltration and command-and-control without breaking required dependencies.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Software Supply-Chain SBOM & Provenance Review Prompt
Review a build's SBOM, signing, and provenance against SLSA to find unsigned artifacts, unverified dependencies, and weak build integrity, then plan the controls that make releases tamper-evident.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
TLS Cipher Suite & Protocol Downgrade Audit Prompt
Audit a service's TLS configuration for weak protocol versions, insecure cipher suites, and downgrade/forward-secrecy gaps, and produce a hardened, compatibility-aware cipher policy.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Ubuntu Server CIS Level 1 Remediation Plan Prompt
Convert a CIS Benchmark Level 1 scan of an Ubuntu/Debian server into a safe, sequenced remediation plan that hardens the host without breaking SSH access or running services.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Cosign Bundle Air-Gapped Verification Prompt
Design offline Sigstore verification using cosign bundles and a mirrored trust root so signed images verify in air-gapped clusters with no reachout to Rekor or Fulcio.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
DAST ZAP Baseline Scan Triage Prompt
Triage OWASP ZAP baseline DAST findings — separate real exploitable issues from header noise and scanner artifacts — and turn the keepers into actionable tickets with verification steps.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Advanced
Envelope Encryption DEK/KEK Architecture Design Prompt
Design an envelope-encryption scheme — per-object data keys wrapped by a KMS-held key-encryption key — with key rotation, caching, and blast-radius limits that survive a key compromise.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Gitleaks Custom Rules & False-Positive Tuning Prompt
Tune a Gitleaks config — custom rules, allowlists, and entropy thresholds — to catch real secrets while cutting the false positives that train developers to ignore the gate.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Advanced
SELinux Targeted Policy Troubleshooting Prompt
Diagnose SELinux denials from audit logs and produce minimal, least-privilege policy fixes — booleans, file contexts, or scoped custom modules — instead of disabling enforcement.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
SLSA Level 3 Hosted-Runner Isolation Review Prompt
Audit a CI build platform against SLSA Build L3 requirements — runner ephemerality, build isolation, and non-falsifiable provenance — and produce the exact gaps to close to reach L3.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
SPIFFE JWT-SVID Cross-Trust-Domain Federation Review Prompt
Review SPIRE federation and JWT-SVID validation across trust domains — audience binding, bundle exchange, and short TTLs — so a workload in one domain can authenticate to another safely.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
DISA STIG OpenSCAP Remediation Triage Prompt
Triage an OpenSCAP STIG scan — separate true failures from false positives and accepted-risk findings — and produce reviewed remediation with the operational blast radius of each fix called out.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
VEX Statement Authoring from CVE Triage Prompt
Turn manual CVE triage decisions into auditable OpenVEX statements with the correct machine-readable justification so scanners go quiet only when there is real evidence.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Intermediate
Certificate Transparency Monitoring for Rogue Cert Detection Prompt
Design Certificate Transparency log monitoring that alerts on unauthorized or mis-issued certificates for your domains
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Cilium FQDN Egress Allowlist and Hubble Observability Prompt
Design Cilium DNS/FQDN-based egress allowlist policies validated against real Hubble flow data to lock down outbound traffic
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
DNSSEC and DANE TLSA Validation Hardening Prompt
Review and harden DNSSEC signing and DANE TLSA records so resolvers and TLS clients reject spoofed responses and rogue certificates
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
kube-bench and Kubescape Cluster Hardening Scan Review Prompt
Interpret kube-bench and Kubescape findings and produce a prioritized remediation plan for control-plane and node CIS hardening
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
OCSP and CRL Certificate Revocation Validation Review Prompt
Review TLS clients and services for correct certificate revocation checking via OCSP stapling and CRL distribution points
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
OSV-Scanner Reachability-Aware CI Dependency Gate Prompt
Design a CI gate using OSV-Scanner that blocks builds on reachable, fixable vulnerabilities while suppressing unreachable noise
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
SSRF and Cloud IMDS Metadata Protection Review Prompt
Review services and cloud instances for SSRF exposure to the metadata endpoint and design defenses against credential theft
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Tetragon TracingPolicy Runtime Enforcement Review Prompt
Design and review Cilium Tetragon TracingPolicy resources that detect and block malicious kernel-level behavior at runtime
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Wazuh Detection Rule and Decoder Tuning Prompt
Tune Wazuh custom rules and decoders to raise true-positive detection while cutting alert noise across endpoints and servers
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
CloudTrail Anomaly Hunting Review Prompt
Threat-hunt across AWS CloudTrail events to surface suspicious IAM, persistence, and exfiltration patterns and turn them into detections
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Container Escape Attack-Surface Review Prompt
Review container and Kubernetes pod specs for configurations that enable host breakout: privileged mode, host mounts, dangerous capabilities, and exposed host namespaces
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Docker Socket Exposure Audit Prompt
Audit where the Docker daemon socket is exposed — mounted into containers, bound over TCP, or shared with CI — and the root-equivalent risk it creates
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
etcd Encryption and Access Hardening Review Prompt
Review Kubernetes etcd for encryption-at-rest gaps, weak client/peer mTLS, exposed endpoints, and missing backup-protection controls
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
npm Lockfile Supply-Chain Audit Prompt
Review a package-lock.json or pnpm-lock.yaml for supply-chain risk: unpinned versions, suspicious registries, install scripts, and dependency confusion exposure
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
S3 Bucket Policy Condition Hardening Review Prompt
Review S3 bucket and access-point policies for over-broad principals, missing TLS/encryption conditions, and confused-deputy exposure
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
SSH known_hosts Host-Key Pinning Audit Prompt
Audit SSH client host-key trust: stale known_hosts entries, disabled StrictHostKeyChecking, weak key algorithms, and missing host-key pinning across a fleet
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Terraform Provider Checksum Verification Prompt
Review the Terraform dependency lock file and provider sourcing for missing checksums, unpinned versions, untrusted mirrors, and supply-chain tampering risk
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Beginner
Unattended-Upgrades Patch Coverage Audit Prompt
Audit Debian/Ubuntu unattended-upgrades and dnf-automatic configuration to confirm security patches actually apply and reboots happen safely
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Core Dump & Exploit-Mitigation Hardening Review Prompt
Audit a Linux host's memory-safety and exploit-mitigation posture — ASLR, core-dump leakage, ptrace scope, executable-stack and RELRO/PIE coverage — to reduce post-compromise impact and stop secrets leaking via crash dumps.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Kernel Module Signing & Blacklist Hardening Review Prompt
Audit a Linux host's kernel-module trust posture — module signature enforcement, lockdown mode, blacklisted/unused drivers, and writable module paths — to block rootkit loading and shrink kernel attack surface.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
LD_PRELOAD & Library-Injection Persistence Audit Prompt
Audit a Linux host for library-injection persistence and hijack risk — LD_PRELOAD, /etc/ld.so.preload, ldconfig path poisoning, and writable RPATH/RUNPATH directories used by privileged binaries.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Beginner
login.defs, umask & Account-Defaults Hardening Review Prompt
Audit Linux account-creation defaults — login.defs, default umask, password aging, UID/GID ranges, and shell/skeleton settings — so every new and existing account inherits a safe, least-privilege baseline.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
NTP & Time-Sync Security Hardening Review Prompt
Audit a host or fleet's time-synchronization setup (chronyd, systemd-timesyncd, ntpd) for spoofable sources, missing authentication, and drift that breaks TLS, MFA, and log correlation.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Package Repository & GPG Signing Trust Review Prompt
Audit apt/yum/dnf repository configuration and GPG/key trust to catch unsigned repos, insecure HTTP mirrors, stale or overly broad signing keys, and gaps that allow malicious package injection.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
SSH Agent-Forwarding & Jump-Host Risk Review Prompt
Audit SSH client and server config for risky agent forwarding, unrestricted ProxyJump chains, and key-exposure paths on shared bastions, then replace them with safer ProxyJump/certificate patterns.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Remote Syslog Forwarding Integrity Review Prompt
Audit rsyslog/journald remote log forwarding for plaintext transport, spoofable sources, gaps that let an attacker tamper with or drop logs, and ensure tamper-evident delivery to a central SIEM.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Beginner
World-Writable Paths & Mount-Option Hardening Review Prompt
Audit a Linux host for world-writable files, sticky-bit gaps, and missing nosuid/nodev/noexec mount options on /tmp, /var/tmp, /dev/shm and removable media to shrink local privilege-escalation and code-execution surface.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Cilium L7 Network Segmentation Policy Prompt
Design Cilium L3/L4/L7 network policies to enforce least-privilege east-west traffic, including HTTP-method and DNS-aware rules and default-deny baselines.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Beginner
Dependency Pinning & Lockfile Integrity Prompt
Harden the software supply chain by enforcing pinned, hash-verified dependencies and lockfile integrity across language ecosystems to block tampering and unexpected upgrades.
- Claude
- Copilot
Open prompt - DevOps Security & Hardening Intermediate
Distroless & Minimal Base Image Migration Prompt
Plan a migration of container images to distroless or minimal bases to shrink attack surface, remove shells and package managers, and cut CVE noise without breaking runtime.
- Claude
- Copilot
Open prompt - DevOps Security & Hardening Intermediate
AWS GuardDuty Threat-Detection Tuning Prompt
Tune AWS GuardDuty findings to reduce noise, enable the right data sources, and route high-severity threats to actionable response without alert fatigue.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Just-in-Time Privileged Access Design Prompt
Design a just-in-time, time-bound privileged access model that replaces standing admin rights with approval-gated, fully audited elevation for humans and pipelines.
- Claude
- Cursor
Open prompt - DevOps Security & Hardening Advanced
Kubernetes Secret Encryption-at-Rest with KMS Prompt
Design encryption at rest for Kubernetes Secrets in etcd using a KMS provider, with envelope encryption, key rotation, and verification that existing secrets get re-encrypted.
- Claude
- Gemini
Open prompt - DevOps Security & Hardening Advanced
PCI-DSS Cardholder Data Environment Scoping Prompt
Define and minimize PCI-DSS scope by mapping cardholder data flows, identifying connected systems, and recommending segmentation to shrink the CDE and audit burden.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Trivy & Grype Scan Policy Gate Design Prompt
Design a CI vulnerability-scanning gate using Trivy and Grype with severity thresholds, ignore policies, and exception governance so builds fail safely on known CVEs.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Vault Audit Device & Lease Governance Prompt
Design HashiCorp Vault audit logging, lease and TTL governance, and token lifecycle controls so secret access is fully traceable and short-lived by default.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Cloud-Init & Instance Bootstrap Hardening Prompt
Audit and harden cloud-init / user-data bootstrap scripts that provision new VM instances — eliminate plaintext secrets, unverified downloads, and over-permissive first-boot configuration.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Data Exfiltration & DLP Controls Design Prompt
Design layered controls that detect and prevent sensitive-data exfiltration — DLP policies, egress monitoring, and access guardrails — without crippling legitimate workflows.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Detection-as-Code Testing & Coverage Prompt
Build a detection-as-code workflow that version-controls, unit-tests, and measures coverage for SIEM/EDR detection rules so blue-team logic ships with the same rigor as application code.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Beginner
Email Authentication SPF/DKIM/DMARC Hardening Prompt
Audit and harden a domain's email authentication — SPF, DKIM, and DMARC — to stop spoofing and phishing that impersonate your organization, then drive DMARC to an enforcing policy safely.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Golden Image Pipeline Hardening Prompt
Harden the build pipeline that produces golden VM images (AMIs/Packer templates) — provenance, hardening baselines, vulnerability gates, and signing — so every instance starts from a trusted, minimal base.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Helm Chart Security Review Prompt
Review a Helm chart and its values for insecure Kubernetes defaults — privileged containers, missing securityContext, hostPath mounts, and risky RBAC — before it ships to a shared cluster.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Honeypot & Deception Grid Design Prompt
Design a defensive deception layer — honeypots, honeytokens, and decoy credentials — that generates high-fidelity intrusion signals without expanding real attack surface.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
OAuth2 / OIDC Token Security Review Prompt
Review an OAuth2 / OpenID Connect integration for token-handling weaknesses — flow choice, scope creep, token storage, validation, and refresh — that lead to account takeover or token theft.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Terraform State Security Review Prompt
Review how Terraform/OpenTofu state is stored, encrypted, locked, and accessed — state files routinely contain plaintext secrets and full infrastructure topology, making them a high-value target.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Cloud Landing Zone Guardrails Review Prompt
Review or design preventive and detective guardrails for a multi-account cloud landing zone — SCPs/org policies, baseline config rules, region/service restrictions, and account vending defaults.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Content Security Policy Design & Review Prompt
Author and tighten a Content-Security-Policy for a web app — kill XSS injection vectors, remove unsafe-inline/unsafe-eval, add nonces/hashes, and roll out via report-only without breaking the page.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Database Security Hardening Review Prompt
Audit and harden a production database (PostgreSQL/MySQL/MongoDB) — authentication, network exposure, encryption, least-privilege grants, and audit logging — without breaking applications.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Git Commit Signing & Verification Rollout Prompt
Design a rollout for signed Git commits and tags — GPG vs SSH vs Sigstore gitsign keys, key custody, branch-protection verification, and CI enforcement — across a developer org.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Rate Limiting & DDoS Resilience Design Prompt
Design layered rate-limiting and abuse-protection defenses for an API or web app — edge/L7 limits, per-identity quotas, bot mitigation, and graceful degradation — to absorb floods without harming real users.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Service Mesh Authorization Policy Review Prompt
Author and review Istio/Linkerd authorization policies — default-deny service-to-service access, identity-based AuthorizationPolicy rules, and JWT/request-level scoping — without breaking traffic.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
SIEM Detection Rule Engineering Review Prompt
Review and tune SIEM detection rules — reduce false positives, map coverage to MITRE ATT&CK, add context for triage, and codify detection-as-code with testing — for a blue-team SOC.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Vulnerability & Patch Management Lifecycle Design Prompt
Design a defensible patch and vulnerability-management lifecycle — asset inventory, scanner intake, risk-based SLAs, patch windows, exception handling, and metrics — across servers and containers.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Backup & Ransomware Resilience Hardening Review Prompt
Audit your backup and recovery posture against ransomware — immutability, air-gap/offline copies, isolated credentials, and tested restores — so an attacker who owns prod can't also destroy your recovery path.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Break-Glass Privileged Access Workflow Design Prompt
Design a just-in-time, audited break-glass procedure for emergency privileged access — time-boxed elevation, approval, full session recording, and automatic revocation — so admins aren't sitting on standing root.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Container Runtime Sandbox Isolation Review Prompt
Evaluate and design stronger workload isolation — gVisor, Kata Containers, microVMs, and user namespaces — for multi-tenant or untrusted-code workloads where shared-kernel containers aren't enough.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Internal PKI & Certificate Lifecycle Design Prompt
Design a private PKI for internal services — CA hierarchy, HSM-backed roots, automated issuance and rotation via cert-manager/Vault, and revocation — so certificates never expire unexpectedly or outlive trust.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Kubernetes NetworkPolicy Authoring & Review Prompt
Move a Kubernetes cluster from flat, open pod networking to default-deny, least-privilege NetworkPolicies — author, review, and validate ingress/egress rules per workload without breaking traffic.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Seccomp & AppArmor Profile Design Prompt
Build tight seccomp and AppArmor/SELinux profiles that shrink a container's kernel attack surface — restricting syscalls, file paths, and capabilities to only what the workload provably needs.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
SLSA Build Provenance Attestation Design Prompt
Raise your build pipeline up the SLSA levels — generate, sign, and verify tamper-evident build provenance so consumers can prove an artifact came from your source via your hardened builder.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
SPIFFE/SPIRE Workload Identity Federation Prompt
Design a SPIFFE/SPIRE deployment that issues short-lived, cryptographic workload identities (SVIDs) across clusters, clouds, and bare metal — replacing long-lived secrets with attested, federated identity.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
STRIDE Threat Modeling Workshop Prompt
Run a structured STRIDE threat-modeling session on a system design — decompose data flows, enumerate threats per trust boundary, rank by risk, and produce prioritized, testable mitigations.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Cosign Keyless Image Admission Verification Prompt
Gate Kubernetes admission on Sigstore cosign signatures and attestations — keyless OIDC signing, policy on issuer/identity, and a fail-closed verifyImages rollout that blocks unsigned images.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
CSPM Cloud Misconfiguration Remediation Prompt
Turn a noisy Cloud Security Posture Management backlog (Prowler, Steampipe, Security Hub, Scout Suite) into a risk-ranked, remediation-ready plan with IaC fixes and guardrails that stop regressions.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
eBPF Security Observability Design Prompt
Design defensive eBPF-based security observability with Tetragon or Tracee — process, file, and network telemetry mapped to detection use-cases — without crippling production performance.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Falco Runtime Threat-Detection Rules Prompt
Author, tune, and triage Falco runtime-security rules that catch real container/host threats — privilege escalation, reverse shells, crypto-miners, secret reads — without drowning on-call in false positives.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
GitHub Actions OIDC Keyless Cloud Auth Prompt
Replace long-lived cloud access keys in CI with GitHub Actions OIDC federation — trust policies scoped to repo/branch/environment, least-privilege roles, and verification that stolen credentials can't be reused.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Kyverno Admission Policy Design Prompt
Design, validate, and roll out Kyverno policies for Kubernetes admission control — validate, mutate, generate, and verifyImages — with Audit-first rollout and CEL where it fits.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
OPA Rego Policy Authoring & Review Prompt
Write, refactor, and unit-test Open Policy Agent Rego policies for admission control, Terraform plan gating, and API authorization — readable, testable, and fail-closed by default.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Beginner
Pre-Commit Secret Scanning Gate Prompt
Stop secrets before they reach git — configure pre-commit and CI secret scanners (gitleaks, detect-secrets, trufflehog) with a baseline, tuned rules, and developer-friendly remediation that doesn't get bypassed.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
HashiCorp Vault Dynamic Secrets Design Prompt
Design short-lived, dynamic secrets in HashiCorp Vault — database, cloud, and PKI engines — with auth methods, lease/TTL strategy, and least-privilege policies that replace long-lived static credentials.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
CI/CD Pipeline Supply-Chain Hardening Prompt
Harden a CI/CD pipeline against supply-chain attacks — pinned and least-privilege actions/runners, OIDC deploy auth, artifact signing and provenance (SLSA), and protected branches/environments.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Cloud Storage Public-Exposure Audit Prompt
Audit object storage (S3, GCS, Azure Blob) for public exposure — bucket policies, ACLs, account-level blocks, and access logging — and produce safe remediation that won't break legitimate access.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Encryption-at-Rest & KMS Key Policy Review Prompt
Review encryption-at-rest coverage and KMS key policies — find unencrypted data stores, over-broad key grants, missing rotation, and weak key separation — then tighten without losing access to data.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Terraform / IaC Misconfiguration Scan Triage Prompt
Triage and remediate findings from tfsec, Checkov, or Trivy IaC scans across Terraform/CloudFormation — separate real risk from noise, write fixes, and add policy-as-code guardrails.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Incident Forensic Logging Readiness Review Prompt
Assess whether your logging and telemetry would actually support a security investigation — coverage, retention, integrity, and time-sync — and close the gaps before an incident, not during one.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Kubernetes RBAC Least-Privilege Review Prompt
Audit Kubernetes RBAC — Roles, ClusterRoles, bindings, and ServiceAccounts — to find overly broad grants, dangerous verbs, and privilege-escalation paths, then tighten to least privilege.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Secrets Management Architecture Design Prompt
Design a centralized secrets-management architecture (Vault or cloud secret manager) — storage, dynamic credentials, access policy, injection, rotation, and break-glass — for an existing stack.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
WAF & OWASP Rule Tuning Review Prompt
Review and tune a Web Application Firewall (ModSecurity/CRS, AWS WAF, Cloudflare) — cut false positives, close coverage gaps against the OWASP Top 10, and roll out rules safely in count-then-block mode.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Workload Identity & Service Account Hardening Prompt
Harden how non-human workloads authenticate to cloud and Kubernetes — replace long-lived keys with federated/workload identity, scope service accounts tightly, and kill standing credentials.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Audit & Logging Policy Design Prompt
Design a defensible audit-logging policy — what security events to capture, tamper-resistant retention, and high-value detection signals — so you can answer 'who did what, when' during an incident.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
auditd Rule-Set Design Prompt
Design a focused, low-noise Linux auditd rule-set that captures the events that actually matter for forensics and compliance without drowning the audit log in irrelevant syscalls.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Bastion / Jump-Host Hardening Review Prompt
Review a bastion/jump host for excess exposure and weak controls, then harden it into a minimal, heavily logged, single-purpose gateway with session recording and tight forwarding rules.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
CIS Benchmark Compliance Assessment Prompt
Interpret CIS Benchmark scan results for Linux hosts or Kubernetes, prioritize the findings that matter, and produce safe remediation with rollback — without breaking workloads chasing a perfect score.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Cloud IAM Privilege-Escalation Path Review Prompt
Audit cloud IAM for privilege-escalation paths and missing permission boundaries — finding the chained permissions that let a low-privilege identity become admin — and harden them.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Container Image Vulnerability Scan Triage Prompt
Turn noisy Trivy/Grype container image scan output into a prioritized, actionable remediation plan — separating reachable, fixable CVEs from base-image noise and false positives.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Dependency CVE Triage & Prioritization Prompt
Turn a noisy dependency vulnerability scan into a ranked, actionable remediation plan using reachability, exploitability, and exposure — instead of chasing every red CVE.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
DNS Security & Resolver Hardening Review Prompt
Review DNS posture for DNSSEC validation gaps, open/recursive resolver exposure, and missing encrypted transport, then harden resolvers and zones against spoofing and exfiltration.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Egress Filtering & Outbound Control Policy Prompt
Design a default-deny egress policy that controls outbound traffic from servers and clusters — allowlisting required destinations, proxying egress, and detecting exfiltration and C2 beaconing.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
fail2ban Brute-Force Protection Tuning Prompt
Review and tune fail2ban jails to stop credential-stuffing and brute-force attempts without locking out legitimate users, with sane bantimes, allowlists, and persistent banning.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
File Integrity Monitoring with AIDE/Tripwire Prompt
Design and tune a file integrity monitoring deployment (AIDE or Tripwire) that detects tampering of critical files while staying quiet about expected churn like logs, caches, and package updates.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Firewall & Network Egress Hardening Review Prompt
Audit and tighten host and cloud firewall rules — nftables/iptables, security groups, NACLs — toward default-deny ingress and controlled egress, eliminating overly broad 0.0.0.0/0 exposure.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Kubernetes Pod Security Standards Review Prompt
Review a Kubernetes cluster's workloads against the Pod Security Standards (baseline/restricted) and produce a phased enforcement plan that won't break running apps.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Kernel Lockdown & Secure Boot Hardening Prompt
Review and harden a Linux host's boot-chain integrity — Secure Boot, kernel lockdown mode, and module signing — so unsigned or malicious code cannot load into the kernel.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Least-Privilege IAM Policy Review Prompt
Right-size over-permissioned cloud IAM — strip wildcard actions, scope resources, eliminate privilege-escalation paths, and replace static keys with short-lived roles, using actual usage data.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
mTLS Service-to-Service Authentication Design Prompt
Design mutual-TLS authentication between internal services — certificate issuance, rotation, trust domains, and enforcement — so workloads prove identity to each other under a default-deny model.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
nftables Firewall Ruleset Review & Rewrite Prompt
Audit a messy iptables/nftables ruleset for gaps, shadowed rules, and default-allow leaks, then produce a clean, default-deny nftables rewrite with stateful tracking and logging.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
PAM & MFA Authentication Policy Review Prompt
Review a Linux host's PAM stack and multi-factor configuration to close authentication gaps — weak password policy, missing MFA, lockout bypasses, and dangerous module ordering.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Beginner
Reverse-Proxy Security Headers Audit Prompt
Audit a reverse proxy (nginx, Caddy, HAProxy, Traefik) for missing or weak HTTP security headers — CSP, HSTS, frame/content-type protections — and produce a hardened, app-aware configuration.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Beginner
Risky Shell Command & Script Review Prompt
Review shell commands, scripts, and pasted one-liners for destructive or unsafe behavior before running them — flagging data loss, privilege misuse, and remote-pipe-to-shell patterns.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Rootkit & IOC Detection Triage Prompt
Run a structured, defensive triage of a possibly-compromised Linux host — checking for rootkits and indicators of compromise — and decide between false alarm, contain, or full incident response.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
SBOM & Sigstore Supply-Chain Verification Prompt
Stand up artifact provenance and signature verification — generate SBOMs, sign with Sigstore/cosign, attach SLSA provenance, and enforce admission policies that reject unsigned or untrusted builds.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Secrets-in-Git History Scanning & Remediation Prompt
Scan a Git repository's full history for leaked secrets and produce a correct remediation plan — rotate first, then purge history and prevent recurrence — without the usual mistakes.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Secrets Rotation Runbook Builder Prompt
Design safe, zero-downtime rotation procedures for credentials, API keys, and certificates — covering dual-key overlap, blast-radius mapping, and verification, including emergency rotation after a leak.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
SOC2 & CIS Evidence-Gathering Automation Prompt
Design automation that continuously collects, timestamps, and stores audit evidence mapped to SOC2 and CIS controls — replacing the last-minute screenshot scramble before an audit.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
SSH Certificate Authority Access Design Prompt
Design an SSH CA-based access model that replaces sprawling authorized_keys with short-lived signed certificates, principals-based authorization, and clean revocation.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
TLS & Certificate Hardening Review Prompt
Audit TLS configuration and certificate lifecycle across endpoints — protocol/cipher selection, cert chain and expiry, OCSP/HSTS, and mTLS — to close weak-crypto and expired-cert exposure.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
WireGuard VPN Hardening Review Prompt
Review a WireGuard (or legacy VPN) configuration for weak peer scoping, over-broad AllowedIPs, missing key rotation, and routing leaks, then harden it to least-privilege access.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Advanced
Zero-Trust Micro-Segmentation Planning Prompt
Plan network micro-segmentation toward a zero-trust model — map flows, define identity-based segments, and design enforcement with default-deny east-west policies.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
CI/CD Secret Exposure Review Prompt
Audit GitHub Actions, GitLab CI, CircleCI, or Jenkins pipelines for secret leaks — logged secrets, exfiltration via unscoped tokens, third-party action risks.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Beginner
Dockerfile Security Review Prompt
AI security review of a Dockerfile — privilege, attack surface, secrets in layers, vulnerable bases, supply-chain risk.
- Claude
- ChatGPT
- Cursor
Open prompt - DevOps Security & Hardening Beginner
SSH Security Audit Prompt
Audit sshd_config, authorized_keys, and SSH client config — flag insecure defaults, weak algorithms, missing controls.
- Claude
- ChatGPT
Open prompt - DevOps Security & Hardening Intermediate
Sudoers & Systemd Services Review Prompt
AI review of /etc/sudoers (and /etc/sudoers.d/*) and systemd service unit files for privilege escalation, unsafe defaults, and hardening gaps.
- Claude
- ChatGPT
Open prompt
About these DevOps Security & Hardening AI prompts
This is a free, curated collection of DevOps Security & Hardening AI prompts for DevOps and platform engineers — prompt templates that turn Claude, ChatGPT, or Cursor into a focused DevOps Security & Hardening assistant. Instead of re-explaining your setup every time, each prompt has fill-in placeholders, a realistic worked example, and explicit safety and back-out notes, so it's safe to use against production DevOps Security & Hardening.
Browse all 147 above, or explore the wider DevOps Security & Hardening prompts and troubleshooting guides, the full DevOps AI prompt library, and run or compare any prompt live in the Prompt Workspace. Hit a production issue instead? Try the free Incident Assistant.