OWASP Top 10 Review skill for Claude Code

# OWASP Top 10:2025 — detailed checks and safe equivalents

Read the section for a category when the sweep in SKILL.md produced hits, or when the
stack is unfamiliar. Each section: what to look for, framework-specific traps, the fix.

## A01 Broken Access Control (includes SSRF)

Look for:
- Object fetched by ID from the request with no owner/tenant predicate.
- Authorization in the controller for some actions but not siblings (e.g. `update` checks,
  `delete` does not). Compare handlers in the same resource side by side.
- Bulk/list endpoints that filter correctly but export/download endpoints that do not.
- Role checks on string compare of a client-supplied claim or header (`X-User-Role`).
- Path-based checks that can be bypassed by case, trailing slash, `;`, or encoded `/`.
- CORS: `Access-Control-Allow-Origin` reflecting the request `Origin` with
  `Access-Control-Allow-Credentials: true`.
- SSRF: server fetches a user-supplied URL (webhooks, image import, PDF rendering,
  link previews, OIDC discovery URLs).

Safe patterns:
- Scope queries through the principal: `current_user.invoices.find(id)` (Rails),
  `Invoice.objects.filter(account=request.user.account).get(pk=pk)` (Django),
  `where: { id, tenantId: session.tenantId }` (Prisma).
- Central policy layer (Pundit, django-rules, CASL, OPA) with default deny; one test per
  action per role.
- SSRF: allowlist destinations; otherwise resolve DNS, reject private, loopback,
  link-local (169.254.0.0/16, fd00::/8, ::1), and re-check after every redirect; disable
  redirects or cap them; use IMDSv2 on AWS.

## A02 Security Misconfiguration

Look for: `DEBUG=True`, Flask `debug=True`, Spring Boot actuator endpoints exposed
(`management.endpoints.web.exposure.include=*`), Express without `app.disable('x-powered-by')`
(minor), default admin passwords in seeds used in prod, stack traces rendered to users,
directory listing enabled, XML parsers with external entities enabled.

XXE fixes:
- Python: use `defusedxml` instead of `xml.etree`/`lxml` for untrusted XML.
- Java: `factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`.
- .NET: `XmlReaderSettings { DtdProcessing = DtdProcessing.Prohibit }`.

## A03 Software Supply Chain Failures

Look for: missing lockfile, `npm install` instead of `npm ci` in CI, `pip install` without
hashes or pins in Docker builds, GitHub Actions referenced by mutable tag (`@v3`) for
third-party actions, `curl | sh` in Dockerfiles, packages with install scripts from
unknown publishers. Hand deeper analysis to the supply-chain-audit skill.

## A04 Cryptographic Failures

Look for:
- Password hashing with anything other than argon2id, scrypt, bcrypt, or PBKDF2 with a
  high iteration count.
- Tokens, reset codes, session IDs from non-CSPRNG sources.
  Safe: `secrets.token_urlsafe(32)` (Python), `crypto.randomBytes(32)` / `crypto.randomUUID()`
  (Node), `SecureRandom` (Java).
- AES-ECB, AES-CBC without a MAC, static IVs/nonces, keys in source.
- TLS verification disabled (`verify=False`, `rejectUnauthorized: false`,
  `InsecureSkipVerify: true`).
- Sensitive data stored unencrypted where policy requires encryption at rest.
Hand design questions to cryptography-basics.

## A05 Injection

SQL:
- Unsafe: f-strings, `%`, `+`, template literals into `execute`, `query`, `raw`, `whereRaw`,
  `sequelize.query`, `knex.raw`, JPA `createQuery` with concatenation.
- Identifiers (column names in `ORDER BY`, table names) cannot be parameterized — map
  user input through an allowlist dict.

NoSQL:
- Mongo queries built from raw JSON bodies allow operator injection (`{"$ne": null}`).
  Validate types (string expected → reject objects) or use `mongo-sanitize`-style
  stripping of `$`-prefixed keys.

OS command:
- Never `shell=True` with input. Use argument arrays: `subprocess.run(["convert", path, out])`,
  `execFile("convert", [path, out])`. Still validate that `path` cannot start with `-`
  (option injection); pass `--` before positional args when the tool supports it.

XSS:
- React: `dangerouslySetInnerHTML`, `href={userUrl}` (javascript: URLs), server-rendered
  JSON in `<script>` without escaping `<`.
- Vue `v-html`, Angular `bypassSecurityTrust*`, Jinja `|safe`, Django `mark_safe`,
  Rails `html_safe`/`raw`, Handlebars `{{{ }}}`, EJS `<%-`.
- Fix: keep auto-escaping, sanitize HTML with DOMPurify (client) or a maintained server
  sanitizer (bleach is deprecated; prefer `nh3` in Python), validate URL schemes.

Template injection (SSTI): user input passed as the template itself
(`render_template_string(user_input)`, `new Function`, `eval`).

## A06 Insecure Design

Look for business-logic flaws a scanner cannot find:
- Price, quantity, discount, or role accepted from the client.
- State machines that allow skipping steps (pay → ship without paid check).
- No per-account and per-IP limits on login, OTP, password reset, signup, invite, export.
- Race conditions on balances, coupons, inventory (check-then-act without a lock or
  conditional update).
Fix with server-side recomputation, explicit state transitions, rate limits, and
atomic conditional updates (`UPDATE ... SET balance = balance - :x WHERE balance >= :x`).

## A07 Authentication Failures

Look for: session ID not regenerated after login, logout that does not invalidate the
server session, password reset tokens that do not expire or are reusable, different
error messages or timing for unknown user vs wrong password, MFA that can be skipped by
calling the next endpoint directly, JWT accepted without signature/exp/aud checks. Hand
depth to auth-sessions and jwt-handling.

## A08 Software or Data Integrity Failures

Unsafe deserialization of untrusted data:
- Python `pickle`, `shelve`, `yaml.load` without `SafeLoader`, `jsonpickle`.
- Java `ObjectInputStream`, XStream without allowlist, Jackson default typing.
- PHP `unserialize`, Ruby `Marshal.load`, `YAML.load` (use `YAML.safe_load`).
- .NET `BinaryFormatter` (obsolete; removed from .NET 9 runtime).
Fix: use JSON with schema validation; sign data you must round-trip (HMAC) and verify
before parsing. Webhooks: verify signatures with constant-time compare.

## A09 Security Logging and Alerting Failures

Check that these events are logged with user ID, IP, timestamp, and request ID: login
success/failure, MFA events, password change/reset, permission denials, admin actions,
input validation failures on sensitive endpoints. Check that passwords, tokens, full card
numbers, and session cookies are never logged (search logger calls near `password`,
`token`, `authorization`).

## A10 Mishandling of Exceptional Conditions

Look for:
- `try: check_permission() except: pass` — fail-open authorization.
- Default branches that grant access (`else: return True`).
- Errors returning raw exception text or stack traces to clients.
- Unbounded reads (request bodies, decompression, regex on attacker input — ReDoS).
- Partial failures that leave inconsistent state (charged but not recorded).
Fix: fail closed, catch narrowly, return generic messages with a correlation ID, set
body/size/time limits.