1
# OWASP Quick Checklist
2
3
A fast pass mapped to the OWASP Top 10 (2021) categories, for use before shipping code
4
that touches auth, data access, or external input. Not exhaustive — see `RULES.md` for
5
the underlying rules this checklist samples from.
6
7
- [ ] **A01 Broken Access Control** — every endpoint/mutation checks the current actor
8
      owns/may access the specific resource, not just that they're logged in.
9
- [ ] **A02 Cryptographic Failures** — no secrets in code/logs; passwords hashed with
10
      bcrypt/scrypt/argon2; TLS used for data in transit; no home-grown crypto.
11
- [ ] **A03 Injection** — all queries parameterized; no string-built SQL/shell
12
      commands from untrusted input; template auto-escaping intact.
13
- [ ] **A04 Insecure Design** — authz/rate-limit/abuse considerations were part of the
14
      design, not bolted on after; default-deny on new capabilities.
15
- [ ] **A05 Security Misconfiguration** — no debug mode/verbose errors in production
16
      paths; default credentials changed; unnecessary features/ports disabled.
17
- [ ] **A06 Vulnerable & Outdated Components** — new/bumped dependencies checked for
18
      known CVEs and maintenance status.
19
- [ ] **A07 Identification & Authentication Failures** — session tokens are
20
      secure/httpOnly/sameSite where applicable; no auth bypass paths left from
21
      debugging; brute-force protection on login/reset flows.
22
- [ ] **A08 Software & Data Integrity Failures** — no untrusted deserialization; CI/CD
23
      and dependency sources are verified, not arbitrary.
24
- [ ] **A09 Logging & Monitoring Failures** — security-relevant events (auth failures,
25
      access-control denials) are logged without leaking secrets/PII; logs are
26
      actually reachable by someone who'd act on them.
27
- [ ] **A10 Server-Side Request Forgery (SSRF)** — any server-side "fetch this URL"
28
      feature validates/restricts the target (no fetching internal/metadata
29
      endpoints from user-supplied URLs).
30