owasp-top10

OWASP Top 10 Scan

Scan the codebase for the OWASP Top 10 (2021 edition) most critical web application security risks.

When to Use

• Before every production deployment
• During code reviews touching auth, data access, or user input handling
• As part of periodic security audits
• When preparing for penetration testing

A01: Broken Access Control

Risk: Users acting beyond their intended permissions.

# Missing auth decorators/guards on endpoints
@(Get|Post|Put|Delete|Patch)\(
# Cross-reference: each must have @UseGuards or @Public

# Endpoints marked public that shouldn't be
@Public|@AllowAnonymous|@SkipAuth|@no_auth_required

# Direct object reference without ownership check
params\.id|req\.params\.\w+Id
# Verify: does the handler check ownership before returning data?

A02: Cryptographic Failures

Risk: Weak or missing encryption for sensitive data.

# Weak hash algorithms
(md5|sha1|createHash\('md5'|createHash\('sha1'|hashlib\.md5|hashlib\.sha1)

# Hardcoded secrets
(password|secret|api_key|apiKey|token|credential)\s*[:=]\s*['"][^'"]{8,}['"]

# Weak encryption
(DES|3DES|RC4|RC2|Blowfish)
createCipher\(|createCipheriv\('des|createCipheriv\('rc4

A03: Injection

Risk: Untrusted data sent as part of a command or query.

# Code injection
eval\(|new Function\(|exec\(|execSync\(
subprocess\.call\(.*shell=True|os\.system\(|os\.popen\(

# SQL injection
\$queryRawUnsafe|\$executeRawUnsafe
\.raw\(.*\$\{|\.raw\(.*%s|\.raw\(.*\+\s*
f".*SELECT.*FROM|f".*INSERT.*INTO|f".*UPDATE.*SET|f".*DELETE.*FROM

# XSS
\.innerHTML\s*=|dangerouslySetInnerHTML|document\.write\(
v-html=|ng-bind-html=|\{\{.*\|.*safe\}\}

# Command injection
child_process|spawn\(.*\$\{|exec\(.*\$\{

A04: Insecure Design

Risk: Missing or ineffective security controls by design.

# Missing rate limiting
# Check: do auth endpoints have rate limiting?
@(Post|Put)\(.*login|@(Post|Put)\(.*register|@(Post|Put)\(.*reset

# Missing CSRF protection
# Check: does the framework have CSRF middleware enabled?
csrf|csrfProtection|@csrf_protect