owasp-security

# OWASP Security Apply these standards when writing or reviewing code. For a review, follow the workflow below. **Reference files** (read the one the task needs, and only the section you need): - [`reference/review-checklist.md`](reference/review-checklist.md): coverage checklist for every Top 10 category, plus LLM and agent checks. Read during step 3 of a review. - [`reference/languages.md`](reference/languages.md): per-language pitfalls with unsafe/safe examples for 20+ languages. Read the section for the language under review. - [`reference/config-and-supply-chain.md`](reference/config-and-supply-chain.md): A02 and A03 in Dockerfiles, Kubernetes, Terraform, framework config, security headers, lockfiles, and CI/CD. Read when the change touches config, IaC, dependencies, or pipelines. - [`reference/owasp-report.md`](reference/owasp-report.md): attack vectors, mitigations, and worked examples for every Top 10:2025, ASVS 5.0, LLM Top 10, and Agentic item. About 1100 lines: jump to the section you need. ## Security Review Workflow Copy this checklist into your response and tick it off as you go: ``` Security Review Progress: - [ ] Step 1: Map entry points and trust boundaries - [ ] Step 2: Load the references this code needs - [ ] Step 3: Sweep for candidate issues - [ ] Step 4: Triage every candidate - [ ] Step 5: Report findings ``` **Step 1: Map entry points and trust boundaries.** List where attacker-controlled data enters: routes and handlers, headers and cookies, up...