owasp-reviewlisted

**Version**: 1.0 **Created**: 2026-03-21 **Last Updated**: 2026-03-23 **Authors:** Ömer Ufuk --- # /owasp-review — On-Demand Security Audit ## When to Use Invoke `/owasp-review` before merging any feature that touches: - Authentication or authorization logic - File I/O or path handling - Subprocess execution (`exec.Command`, shell invocations) - External HTTP calls or API integrations - Dependency updates (`go.mod`, `go.sum`, `package.json`) - Agent definitions, skill definitions, or prompt templates - Template rendering with user-controlled input - Configuration loading from external sources ## Invocation ```bash /owasp-review ``` Spawns the `security-reviewer` agent against `git diff main...HEAD`. The agent runs the full 6-step Investigation Protocol (understand, build, dependency audit, OWASP scan, ASI scan, pattern search) and produces a `SECURITY_APPROVED` or `SECURITY_BLOCKED` verdict. --- ## OWASP Top 10:2025 Reference | ID | Name | What to Check | |----|------|---------------| | A01 | Broken Access Control | Deny by default. Enforce authorization server-side on every request. Verify object ownership — never trust client-supplied IDs. Disable directory listing. | | A02 | Security Misconfiguration | Harden all configs. Disable debug mode and default credentials in production. Minimize installed features and frameworks. Review cloud/container permissions. | | A03 | Software Supply Chain Failures [NEW] | Lock dependency versions in `go.sum` / `package-lock.json