security-review-owasp-bean-validation

What problem does it solve?

This Skill helps security reviewers spot missing, weak, or inconsistently triggered Bean Validation controls that allow unsafe input to reach sensitive Java business logic.

Core Features & Use Cases

• Constraint coverage review: Checks whether externally controlled fields have the right size, format, range, and structure constraints.
• Trigger-point analysis: Verifies that validation actually runs at controllers, service boundaries, nested object graphs, and other trust boundaries.
• Validator safety review: Flags risky regex patterns, fail-open custom validators, and validation code that mixes business logic with enforcement.
• Use case: Review a REST API or service layer to find where malformed DTOs, nested beans, or custom constraints could bypass intended input controls.

Quick Start

Ask Copilot to review the selected Java validation flow for missing constraints, trigger points, regex safety, and custom validator behavior with the Bean Validation skill.