OWASP Top 10 Security Checklist

Priority: P0 (CRITICAL)

Always-Apply Rules

Apply these on every code write, not during dedicated security reviews:

• No IDOR: Filter every resource query by owner_id or tenantId alongside any user-supplied ID. findById(params.id) without owner filter immediate P0.
• No wildcard CORS: Restrict to explicit allowlisted origins — never Access-Control-Allow-Origin: * on authenticated routes.
• No full entity return: Always project to DTO — never serialize raw ORM output to API response.
• No plaintext secrets in mobile: Never store tokens in SharedPreferences/UserDefaults — use Keychain/Keystore.

Context-Specific Checklist

Activate when: writing security-sensitive features, reviewing PRs, or doing codebase audits.

Mark each item: ✅ not affected | ⚠️ needs review | 🔴 confirmed finding.

P0 finding caps Security score at 40/100.

Apply framework-specific security skills alongside this checklist. See references/owasp-web.md, references/owasp-api.md, and references/owasp-mobile.md for full detection signals.

OWASP Web Application Top 10 (2021)

ID	Risk	Key Detection Signal
A01	Broken Access Control	findById(params.id) without owner filter. Route without @authorize.
A02	Cryptographic Failures	Weak hash (MD5/SHA1) for passwords. HTTP URL hardcoded. No TLS.
A03	Injection	String concat in DB queries. Unsanitized input to templates. XSS.
A04	Insecure Design	No rate limiting on auth. Missing input validation at entry points.
A05	Security Misconfiguration	CORS *. Debug mode in prod. Missing security headers (CSP, HSTS).
A06	Vulnerable Components	CVE in dependency audit. Unreviewed new direct dependency.
A07	Auth Failures	JWT without expiry. No session invalidation on logout.
A08	Data Integrity Failures	Unverified JWT/cookie. Deserialization of untrusted input.
A09	Logging & Monitoring	No audit log on: deletion, password change, privilege escalation.
A10	SSRF	HTTP client with user-controlled URL and no allowlist.

OWASP API Security Top 10 (2023)

ID	Risk	Key Detection Signal
API1	Broken Object Level Auth (BOLA)	Resource by user-supplied ID without AND owner_id = currentUser.
API2	Broken Authentication	JWT missing exp. Token not revoked on logout. Bearer in URL.
API3	Broken Property Level Auth	Full ORM entity returned. No DTO projection. Mass assignment.
API4	Unrestricted Resource Consumption	No server-enforced limit/pageSize. No throttle on heavy ops.
API5	Broken Function Level Auth	Admin route reachable without role guard.
API6	Unrestricted Business Flow	No verification on OTP/checkout/password-reset flows.
API8	Security Misconfiguration	Stack trace in response. CORS * on authenticated routes.
API9	Improper Inventory Management	Deprecated/undocumented endpoints still reachable.
API10	Unsafe API Consumption	Third-party response used without schema validation.

OWASP Mobile Top 10 (2024)

ID	Risk	Key Detection Signal
M1	Improper Credential Usage	API keys in BuildConfig, Info.plist, hardcoded in source.
M2	Inadequate Supply Chain	Unverified SDKs, pods, or packages without lock files.
M3	Insecure Auth/AuthZ	Biometric-only auth without server validation. Local role checks.
M4	Insufficient I/O Validation	WebView loadUrl with user data. Intent data used unvalidated.
M5	Insecure Communication	No cert pinning. cleartextTrafficPermitted=true. ATS exceptions.
M6	Inadequate Privacy	Location/contacts without justification. PII in analytics.
M7	Insufficient Binary Protection	No obfuscation. android:debuggable=true. No root detection.
M8	Security Misconfiguration	Exported components. Backup enabled. Debug endpoints.
M9	Insecure Data Storage	Tokens in SharedPreferences/UserDefaults vs Keychain/Keystore.
M10	Insufficient Cryptography	Hardcoded encryption keys. Deprecated algorithms (DES, RC4).

References

• OWASP Web App — Full Detection Signals
• OWASP API — Full Detection Signals
• OWASP Mobile — Full Detection Signals

Canonical response anchors

• Additional task-grounded exact anchors: rate limit, IDOR/BOLA, DTO projection

Remediation anchors

• Remediation anchors: DTO projection, CORS, opaque session, JWT expiry, rate limiting