security-review

Security Review

OWASP Top 10 Checklist

Review every application against the current OWASP Top 10. For each category, apply the specific mitigation:

• A01 Broken Access Control: Enforce access control on the server side, never rely on client-side checks. Deny by default. Validate that the authenticated user has permission to access the requested resource on every request. Implement CORS restrictively. Disable directory listing. Log and alert on repeated access control failures.
• A02 Cryptographic Failures: Classify data by sensitivity. Encrypt sensitive data at rest (AES-256) and in transit (TLS 1.2+). Never use MD5 or SHA-1 for passwords. Use bcrypt, argon2, or scrypt for password hashing. Do not store sensitive data in URLs, logs, or error messages. Rotate encryption keys on a defined schedule.
• A03 Injection: Use parameterized queries or prepared statements for all database access. Apply input validation with allowlists, not blocklists. Use ORM methods instead of raw SQL where possible. Escape output contextually (HTML, URL, JavaScript, CSS). Apply Content-Security-Policy headers to mitigate XSS.
• A04 Insecure Design: Conduct threat modeling during design phase, not after implementation. Define security requirements alongside functional requirements. Use secure design patterns (e.g., separate privilege levels, fail securely). Create abuse cases alongside use cases.
• A05 Security Misconfiguration: Remove default credentials and unused features. Apply hardening guides for all frameworks and servers. Disable detailed error messages in production. Review cloud storage permissions (S3 buckets, GCS). Automate configuration verification in CI.
• A06 Vulnerable and Outdated Components: Maintain an inventory of all dependencies and their versions. Run npm audit, pip safety check, cargo audit, or equivalent in CI. Subscribe to security advisories for critical dependencies. Remove unused dependencies. Pin dependency versions and review updates before merging.
• A07 Identification and Authentication Failures: Enforce strong password policies (minimum 12 characters, no common passwords). Implement MFA. Use constant-time comparison for credentials. Rate-limit login attempts. Do not expose whether an account exists in error messages.
• A08 Software and Data Integrity Failures: Verify the integrity of downloaded dependencies (checksums, lock files). Use signed commits for releases. Validate CI/CD pipeline configuration against tampering. Do not deserialize untrusted data without validation. Use Subresource Integrity (SRI) for CDN assets.
• A09 Security Logging and Monitoring Failures: Log authentication events (success and failure), access control failures, input validation failures, and server-side errors. Include timestamp, user ID, IP, and action in every log entry. Do not log sensitive data (passwords, tokens, PII). Send alerts for anomalous patterns. Retain logs for at least 90 days.
• A10 Server-Side Request Forgery (SSRF): Validate and sanitize all client-supplied URLs. Use allowlists for permitted domains and IP ranges. Block requests to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 169.254.169.254). Disable HTTP redirects in server-side requests or validate each redirect target.