security-reviewlisted

# Security Review This skill operationalises the OWASP mandate in this harness's own instructions: "Ensure your code is free from security vulnerabilities outlined in the OWASP Top 10." Work through this checklist for every production-tier code review; prioritise findings as P0 (must fix before merge) or P1 (fix within the sprint). External reference: [OWASP Top 10 (2021)](https://owasp.org/Top10/). --- ## A01 — Broken Access Control **What to look for:** Missing authentication checks, insecure direct object references (IDOR), privilege escalation paths, CORS misconfiguration. ```python # WRONG: fetches any record by ID — no ownership check def get_document(doc_id: int) -> Document: return db.query(Document).filter_by(id=doc_id).first() # RIGHT: scope to the authenticated user def get_document(doc_id: int, current_user: User) -> Document: doc = db.query(Document).filter_by(id=doc_id, owner_id=current_user.id).first() if doc is None: raise NotFoundError() return doc ``` **Checklist:** - Every route/handler checks that the caller owns or is permitted to access the resource it requests. - Admin/privileged endpoints require an explicit role check, not just authentication. - CORS `Access-Control-Allow-Origin: *` is not set on endpoints that return sensitive data. --- ## A02 — Cryptographic Failures **What to look for:** Hardcoded secrets, weak algorithms (MD5, SHA-1, DES), HTTP instead of HTTPS for sensitive data, secrets logged. ```python