# Outside input reaching sensitive actions

Prompt · Testing and security · T03

Follows input from outsiders to the places it can do harm.

## Prompt

```text
Trace every external input from entry point to sensitive operation. Investigate authorization gaps, injection risks, unsafe parsing, and tenant isolation failures.
```

**What it returns:** Each path: entry point, checks along the way, sensitive operation, and the missing check if any, with file:line.

**Skip it when:** Never skip for anything that holds other people's data or money.

**Tools:** Repository access.

**Changes:** Changes nothing

**Sessions:** Look first, then fix in a new session

## Related

- [Security checks that fail open](https://atlasscope.dev/prompts/security-checks-that-fail-open): Finds security checks that let people in when something goes wrong.
- [Settings that differ in production](https://atlasscope.dev/prompts/settings-that-differ-in-production): Finds settings that behave differently in production than anyone expects.
- [Hidden data anyone can read](https://atlasscope.dev/prompts/hidden-data-anyone-can-read): Finds data sent to the browser that the screen hides but anyone can read.

Source: https://atlasscope.dev/prompts/outside-input-reaching-sensitive-actions