owasp-security

# Comprehensive OWASP Security Skills

A developer-focused security reference covering six OWASP standards for securing web applications, APIs, mobile apps, containers, and AI/LLM systems. Each section provides concise detection guidance, key requirements, and mitigation strategies.

## Quick Navigation

1. [OWASP Top 10 (2021)](#section-1-owasp-top-10-2021)
2. [OWASP ASVS 5.0](#section-2-owasp-asvs-50-application-security-verification-standard)
3. [OWASP MASVS v2.1.0](#section-3-owasp-masvs-v210-mobile-security)
4. [OWASP API Security Top 10](#section-4-owasp-api-security-top-10-2023)
5. [OWASP Kubernetes Top 10](#section-5-owasp-kubernetes-top-10-2022)
6. [OWASP Agentic Applications 2026](#section-6-owasp-agentic-applications-2026)

---

## Section 1: OWASP Top 10 (2021)

The OWASP Top 10 represents the most critical security risks in web applications.

### A01: Broken Access Control
**Detection:** URLs with direct ID references (`/user/1234/orders`); client-side only enforcement; missing authorization checks.
**Mitigation:** Enforce server-side authorization for every sensitive operation; verify user ownership of resources; implement default-deny principle.
**Example:**
```javascript
// INSECURE: No authorization check
app.get('/users/:id/orders', (req, res) => {
  const orders = db.query('SELECT * FROM orders WHERE user_id = ?', req.params.id);
  res.json(orders);
});
// SECURE: Authorization check
app.get('/users/:id/orders', (req, res) => {
  if (req.user.id !== parseInt(req.params.id)) return res.status(403).json({error: 'Forbidden'});
  const orders = db.query('SELECT * FROM orders WHERE user_id = ?', req.params.id);
  res.json(orders);
});
```
**Checklist:** ☐ Authorization on server for all sensitive ops ☐ Default-deny policy ☐ No ID-based obscurity ☐ Whitelist allowed fields

---

### A02: Cryptographic Failures
**Detection:** Sensitive data in plaintext; weak encryption (DES, ECB); missing TLS; hardcoded secrets in code.
**Mitigation:** Always use HTTPS/TLS; encrypt data at rest with AES-256; store secrets in environment variables or vaults; mask sensitive logs.
**Example:**
```python
# INSECURE: API key in code
api_key = "sk-abc123xyz789"

# SECURE: From environment
import os
api_key = os.getenv("API_KEY")
if not api_key: raise ValueError("API_KEY not set")
```
**Checklist:** ☐ HTTPS enforced ☐ AES-256 encryption at rest ☐ No secrets in code ☐ Sensitive data masked in logs

---

### A03: Injection (SQL, Command, NoSQL)
**Detection:** String concatenation in queries; `exec`, `query`, `run` with user input; no prepared statements.
**Mitigation:** Use parameterized queries; whitelist input; avoid string concatenation; use safe APIs (subprocess.run with list args).
**Example:**
```python
# INSECURE: String concatenation
os.system("tar -czf " + filename + " /var/data")

# SECURE: List-based API
import subprocess
subprocess.run(["tar", "-czf", filename, "/var/data"], check=True)
```
**Checklist:** ☐ Parameterized queries only ☐ No string concat ☐ Whitelist input ☐ Safe subprocess calls

---

### A04: Insecure Design
**Detection:** No threat modeling; missing security controls by design; no authentication/authorization from the start.
**Mitigation:** Implement threat modeling early; design security in from the beginning; use established security libraries/patterns.
**Checklist:** ☐ Threat modeling completed ☐ Security controls in design ☐ Auth/authz from start ☐ Security review in SDLC

---

### A05: Security Misconfiguration
**Detection:** Debug mode enabled; default credentials; verbose error messages; missing security headers; exposed APIs.
**Mitigation:** Disable debug mode; change defaults; hide version info; implement security headers (HSTS, CSP, X-Frame-Options).
**Example:**
```python
# INSECURE: Debug enabled in production
app.debug = True

# SECURE: Debug disabled
app.debug = False
app.config['HSTS_MAX_AGE'] = 31536000
```
**Checklist:** ☐ Debug disabled ☐ Defaults changed ☐ Security headers set ☐ No version disclosure

---

### A06: Vulnerable & Outdated Components
**Detection:** Old versions in package.json/requirements.txt; unpatched frameworks; deprecated libraries.
**Mitigation:** Regularly audit dependencies with `npm audit`, `pip safety`, `Snyk`; remove unused packages; keep frameworks patched.
**Checklist:** ☐ Dependency audits regular ☐ No outdated versions ☐ Unused deps removed ☐ CI/CD security scanning

---

### A07: Authentication Failures
**Detection:** Weak passwords; no MFA; predictable session IDs; weak password reset tokens; no rate limiting on login.
**Mitigation:** Hash passwords (bcrypt/Argon2); implement MFA; generate cryptographically secure session IDs; rate-limit failed attempts.
**Checklist:** ☐ Strong password hashing ☐ MFA available ☐ Secure session IDs ☐ Rate limiting on login

---

### A08: Software/Data Integrity Failures
**Detection:** Unsigned updates; unverified dependencies; unsafe deserialization (pickle, Java ObjectInputStream).
**Mitigation:** Sign and verify all updates; use JSON instead of native serialization; whitelist allowed classes; verify checksums.
**Checklist:** ☐ Updates signed/verified ☐ JSON used for serialization ☐ No unsafe deserialization ☐ Checksums verified

---

### A09: Logging & Monitoring Failures
**Detection:** No security event logging; logs contain secrets; no centralized logging; no alerts for anomalies.
**Mitigation:** Log authentication events, access denials, config changes; centralize logs; implement alerts for suspicious patterns.
**Checklist:** ☐ Security events logged ☐ No secrets in logs ☐ Logs centralized ☐ Alerts for anomalies

---

### A10: Server-Side Request Forgery (SSRF)
**Detection:** App fetches URLs from user input; no URI validation; internal IP ranges accessible.
**Mitigation:** Validate/sanitize URLs; whitelist domains; block internal IP ranges (10.0.0.0/8, 127.0.0.1); use allowlists.
**Checklist:** ☐ URLs validated ☐ Domains whitelisted ☐ Internal IPs blocked ☐ Protocols restricted

---