security-review-owasp

Apply the OWASP Top 10:2025 checklist covering broken access control, injection, cryptographic failures, and security misconfiguration. Check input validation, parameterized queries, password hashing with Argon2 or bcrypt, and fail-closed error handling on every reviewed file.

Separate trusted instructions from untrusted user data using clear delimiters or structured roles, and never concatenate user input into system prompts. Treat all LLM output as untrusted before it reaches SQL, shell, HTML, or tool calls.

The OWASP Agentic AI list covers goal hijacking, tool misuse, identity and privilege abuse, memory poisoning, and rogue agents. Mitigate with least-privilege tools, short-lived scoped credentials, sandboxed code execution, and human approval for destructive actions.

Yes, a references file documents per-language pitfalls for 20 languages including Python pickle, Java ObjectInputStream, PHP type juggling, Ruby YAML.load, and C buffer overflows. Read only the section for the language being reviewed.

ASVS 5.0 Level 1 applies to all applications and requires 12-character passwords, breached password checks, and rate limiting. Level 2 adds MFA and key management for sensitive data; Level 3 adds hardware security modules and penetration testing for critical systems.