owasp-security

# OWASP Security Best Practices Skill Apply these security standards when writing or reviewing code. **Reference files** (load on demand): - [`reference/languages.md`](reference/languages.md) — per-language security quirks with unsafe/safe examples for 20+ languages. - [`reference/owasp-report.md`](reference/owasp-report.md) — comprehensive deep-dive on every OWASP 2025–2026 standard. ## Quick Reference: OWASP Top 10:2025 | # | Vulnerability | Key Prevention | |---|---------------|----------------| | A01 | Broken Access Control | Deny by default, enforce server-side, verify ownership | | A02 | Security Misconfiguration | Harden configs, disable defaults, minimize features | | A03 | Software Supply Chain Failures | Lock versions, verify integrity, audit dependencies | | A04 | Cryptographic Failures | TLS 1.2+, AES-256-GCM, Argon2/bcrypt for passwords | | A05 | Injection | Parameterized queries, input validation, safe APIs | | A06 | Insecure Design | Threat model, rate limit, design security controls | | A07 | Authentication Failures | MFA, check breached passwords, secure sessions | | A08 | Software or Data Integrity Failures | Sign packages, SRI for CDN, safe serialization | | A09 | Security Logging and Alerting Failures | Log security events, structured format, alerting | | A10 | Mishandling of Exceptional Conditions | Fail-closed, hide internals, log with context | ## Before Reporting a Finding A pattern match is not a vulnerability. The most common failure mode in au...