security-review-owasp-injection-prevention

To review untrusted input for OWASP injection prevention risks, trace attacker-controlled data across validation, normalization, binding, serialization, and execution paths to identify where it reaches dangerous interpreters or privileged state mutations without strict control.

An injection prevention security review analyzes code, configuration, architecture, and operational controls to find flaws where attacker-controlled input reaches interpreters, binders, redirect targets, or privileged state changes without strict validation.

Prioritize injection vulnerabilities during code review by focusing on exploitability, ranking direct code execution, query manipulation, privilege mutation, and attacker-controlled routing higher than superficial formatting issues.

Report injection prevention findings as severity-ordered, evidence-backed results that include confirmed flaws, review gaps, passed checks, and a final assessment aligned directly to OWASP Injection Prevention guidance.

This injection review covers configuration and architecture in addition to code, evaluating untrusted input crossing into selectors, binders, redirect targets, serialization paths, and privileged state mutations across the entire system.