OWASP Security

OWASP Security

Apply these standards when writing or reviewing code. For a review, follow the workflow below.

Reference files (read the one the task needs, and only the section you need):

• reference/review-checklist.md: coverage checklist for every Top 10 category, plus LLM and agent checks. Read during step 3 of a review.
• reference/languages.md: per-language pitfalls with unsafe/safe examples for 20+ languages. Read the section for the language under review.
• reference/config-and-supply-chain.md: A02 and A03 in Dockerfiles, Kubernetes, Terraform, framework config, security headers, lockfiles, and CI/CD. Read when the change touches config, IaC, dependencies, or pipelines.
• reference/owasp-report.md: attack vectors, mitigations, and worked examples for every Top 10:2025, ASVS 5.0, LLM Top 10, and Agentic item. About 1100 lines: jump to the section you need.

Security Review Workflow

Copy this checklist into your response and tick it off as you go:

Security Review Progress:
- [ ] Step 1: Map entry points and trust boundaries
- [ ] Step 2: Load the references this code needs
- [ ] Step 3: Sweep for candidate issues
- [ ] Step 4: Triage every candidate
- [ ] Step 5: Report findings

Step 1: Map entry points and trust boundaries. List where attacker-controlled data enters: routes and handlers, headers and cookies, uploads, webhooks, queue consumers, CLI arguments, third-party API responses, and anything an LLM reads or returns. Note where authentication and authorization are enforced; it is often centralized in middleware rather than per route.

Step 2: Load the references this code needs. The language section of languages.md; config-and-supply-chain.md if config, IaC, dependencies, or CI changed; the LLM and Agentic sections of owasp-report.md if the code calls a model or runs an agent.

Step 3: Sweep for candidate issues. Walk review-checklist.md for the categories the code touches. For each candidate, trace the path from an entry point in step 1 to the sink.

Step 4: Triage every candidate with the rubric in "Before Reporting a Finding" below. Drop candidates that fail it, or downgrade them to defense-in-depth. If a candidate's reachability is unclear, go back to step 1 for that input before deciding.

Step 5: Report findings in the format below, highest severity first.