Security audit guidelines for web applications and REST APIs based on OWASP Top 10 and web security best practices. Use when checking code for vulnerabilities, reviewing auth/authz, auditing APIs, or before production deployment.

OWASP Security Check Comprehensive security audit patterns for web applications and REST APIs. Contains 20 rules across 5 categories covering OWASP Top 10 and common web vulnerabilities. When to Apply Use this skill when: Auditing a codebase for security vulnerabilities Reviewing user provided file or folder for security issues Checking authentication/authorization implementations Evaluating REST API security Assessing data protection measures Reviewing configuration and deployment settings Before production deployment After adding new features that handle sensitive data How to Use This Skill 1. Identify application type Web app, REST API, SPA, SSR, or mixed 2. Scan by priority Start with CRITICAL rules, then HIGH, then MEDIUM 3. Review relevant rule files Load specific rules from @rules/ directory 4. Report findings Note severity, file location, and impact 5. Provide remediation Give concrete code examples for fixes Audit Workflow Step 1: Systematic Review by Priority Work through categories by priority: 1. CRITICAL : Authentication & Authorization, Data Protection, Input/Output Security 2. HIGH : Configuration & Headers 3. MEDIUM : API & Monitoring Step 2: Generate Report Format findings as: Severity : CRITICAL HIGH MEDIUM LOW Category : Rule name File : Path and line number Issue : What's wrong Impact : Security consequence Fix : Code example of remediation Rules Summary Authentication & Authorization (CRITICAL) broken access control @rules/broken access control.md Check for missing authorization, IDOR, privilege escalation. authentication failures @rules/authentication failures.md Check for weak authentication, missing MFA, session issues. Data Protection (CRITICAL) cryptographic failures @rules/cryptographic failures.md Check for weak encryption, plaintext storage, bad hashing. sensitive data exposure @rules/sensitive data exposure.md Check for PII in logs/responses, error messages leaking info. data integrity failures @rules/data integrity failures.md Check for unsigned data, insecure deserialization. secrets management @rules/secrets management.md Check for hardcoded secrets, exposed env vars. Input/Output Security (CRITICAL) injection attacks @rules/injection attacks.md Check for SQL, XSS, NoSQL, Command, Path Traversal injection. ssrf attacks @rules/ssrf attacks.md Check for unvalidated URLs, internal network access. file upload security @rules/file upload security.md Check for unrestricted uploads, MIME validation. redirect validation @rules/redirect validation.md Check for open redirects, unvalidated redirect URLs. Configuration & Headers (HIGH) insecure design @rules/insecure design.md Check for security anti patterns in architecture. security misconfiguration @rules/security misconfiguration.md Check for default configs, debug mode, error handling. security headers @rules/security headers.md Check for CSP, HSTS, X Frame Options, etc. cors configuration @rules/cors configuration.md Check for overly permissive CORS. csrf protection @rules/csrf protection.md Check for CSRF tokens, SameSite cookies. session security @rules/session security.md Check for cookie flags, JWT issues, token storage. API & Monitoring (MEDIUM HIGH) api security @rules/api security.md Check for REST API vulnerabilities, mass assignment. rate limiting @rules/rate limiting.md Check for missing rate limits, brute force prevention. logging monitoring @rules/logging monitoring.md Check for insufficient logging, sensitive data in logs. vulnerable dependencies @rules/vulnerable dependencies.md Check for outdated packages, known CVEs. Common Vulnerability Patterns Quick reference of patterns to look for: User input without validation : req.json() → immediate use Missing auth checks : Routes without authorization middleware Hardcoded secrets : Strings containing "password", "secret", "key" SQL injection : String concatenation in queries XSS : dangerouslySetInnerHTML , .innerHTML Weak crypto : md5 , sha1 for passwords Missing headers : No CSP, HSTS, or security headers CORS wildcards : Access Control Allow Origin: with credentials Insecure cookies : Missing Secure, HttpOnly, SameSite flags Path traversal : User input in file paths without validation Severity Quick Reference Fix Immediately (CRITICAL): SQL/XSS/Command Injection Missing authentication on sensitive endpoints Hardcoded secrets in code Plaintext password storage IDOR vulnerabilities Fix Soon (HIGH): Missing CSRF protection Weak password requirements Missing security headers Overly permissive CORS Insecure session management Fix When Possible (MEDIUM): Missing rate limiting Incomplete logging Outdated dependencies (no known exploits) Missing input validation on non critical fields Improve (LOW): Missing optional security headers Verbose error messages (non production) Suboptimal crypto parameters

owasp-security-check