Security Auditing

OWASP Top 10 auditing systematically checks codebases, configurations, and APIs for common security gaps using structured vulnerability scanning. This Skill applies aligned checks across input validation, authentication, authorization, data protection, and API security to identify and guide remediation of security misconfigurations and policy violations.

Input validation auditing enforces data sanitization and type validation to prevent injection attacks and malformed data processing. This Skill reviews how applications handle untrusted input, ensuring validation occurs before processing and that encoding prevents bypass.

Authentication and authorization review assesses session management, permission controls, and access policies. This Skill evaluates token handling, role-based access enforcement, and credential protection to identify privilege escalation and unauthorized access risks.

Data protection auditing verifies encryption at rest and in transit, key management practices, and sensitive data handling. This Skill checks whether applications protect data confidentiality and integrity across storage and network boundaries.

Audit logging tracks authentication attempts, authorization decisions, and sensitive data access with sufficient detail for forensic analysis. This Skill guides logging configuration to record who accessed what, when, and with what outcome for compliance and breach investigation.

Yes. API security auditing covers rate limiting configuration, API key and OAuth management, CORS policy validation, and security header deployment. This Skill checks whether APIs implement controls that prevent abuse, enforce authentication, and restrict cross-origin requests appropriately.