owasp-top10-review

Run a category-by-category assessment that walks all ten OWASP Top 10:2025 categories, records evidence of controls for each, and maps existing security findings onto the taxonomy. The output is a coverage matrix showing which categories are adequate and which have gaps.

The 2025 edition moved Security Misconfiguration to #2, introduced Software Supply Chain Failures at #3, and added Mishandling of Exceptional Conditions at #10. SSRF is no longer a standalone category and is assessed as a sub-check under other categories.

A security review hunts individual vulnerabilities bottom-up for a delivered ticket, while an OWASP Top 10 assessment works top-down to prove coverage across all ten categories. The assessment maps existing findings onto the framework rather than re-deriving them.

Yes, the assessment degrades gracefully and derives findings directly from the codebase when no prior security reviews exist. With existing reports, it maps their findings onto categories and supplements with newly discovered issues.

Bug-hunting passes reliably under-probe insecure deserialization, security logging gaps, fail-open error handling, and SSRF because these require targeted searches rather than route-by-route inspection. The assessment actively greps for patterns like pickle, yaml.load, broad except clauses, and backend fetches of user-controlled URLs.

Do not use it for reviewing a single delivered ticket, which belongs to a per-ticket security review, or for assessing the model surface of an LLM application, which belongs to the OWASP LLM Top 10 review. It also does not replace deep bug-hunting or threat modeling.