OWASP Quick Checklist
A fast pass mapped to the OWASP Top 10 (2021) categories, for use before shipping code
that touches auth, data access, or external input. Not exhaustive — see RULES.md for
the underlying rules this checklist samples from.
- A01 Broken Access Control — every endpoint/mutation checks the current actor owns/may access the specific resource, not just that they're logged in.
- A02 Cryptographic Failures — no secrets in code/logs; passwords hashed with bcrypt/scrypt/argon2; TLS used for data in transit; no home-grown crypto.
- A03 Injection — all queries parameterized; no string-built SQL/shell commands from untrusted input; template auto-escaping intact.
- A04 Insecure Design — authz/rate-limit/abuse considerations were part of the design, not bolted on after; default-deny on new capabilities.
- A05 Security Misconfiguration — no debug mode/verbose errors in production paths; default credentials changed; unnecessary features/ports disabled.
- A06 Vulnerable & Outdated Components — new/bumped dependencies checked for known CVEs and maintenance status.
- A07 Identification & Authentication Failures — session tokens are secure/httpOnly/sameSite where applicable; no auth bypass paths left from debugging; brute-force protection on login/reset flows.
- A08 Software & Data Integrity Failures — no untrusted deserialization; CI/CD and dependency sources are verified, not arbitrary.
- A09 Logging & Monitoring Failures — security-relevant events (auth failures, access-control denials) are logged without leaking secrets/PII; logs are actually reachable by someone who'd act on them.
- A10 Server-Side Request Forgery (SSRF) — any server-side "fetch this URL" feature validates/restricts the target (no fetching internal/metadata endpoints from user-supplied URLs).