security-review

Solid

OWASP secure design review for code and architecture. Checks input validation, authentication, authorization, data protection.

Code & Development 41 stars 3 forks Updated today MIT

Install

View on GitHub

Quality Score: 86/100

Stars 20%

Recency 20%

100

Frontmatter 20%

Documentation 15%

100

Issue Health 10%

License 10%

100

Description 5%

100

Skill Content

# Security Review Language-agnostic security review based on OWASP Secure by Design. ## Checklist (OWASP Top 10:2025) *Updated to OWASP Top 10:2025 (released January 2025). Previous 2021 edition had different groupings.* ### A01:2025 — Broken Access Control - [ ] Least privilege enforced (users get minimum permissions needed) - [ ] Authorization checked on EVERY request (not just the first) - [ ] CORS restrictive (not `*`) - [ ] Directory listing disabled - [ ] Rate limiting on API/controller access ### A02:2025 — Cryptographic Failures - [ ] Data encrypted at rest and in transit (TLS 1.2+) - [ ] No secrets in code, logs, or error messages - [ ] PII identified and classified in threat model - [ ] Passwords hashed with bcrypt/argon2 (never MD5/SHA1) - [ ] Cryptographic algorithms current (no deprecated ciphers) ### A03:2025 — Injection - [ ] All user input validated (type, length, range, format) - [ ] Parameterized queries for ALL data access (never string concatenation) - [ ] Input allowlisting preferred over denylisting - [ ] Output encoded based on context (HTML, JS, URL, CSS — covers XSS) - [ ] Content Security Policy configured ### A03b:2025 — Software Supply Chain Failures *(new in 2025)* - [ ] SBOM (Software Bill of Materials) maintained for critical dependencies - [ ] Build integrity verified (reproducible builds, signed artifacts) - [ ] Dependency provenance checked (not just version, but source authenticity) - [ ] Transitive dependencies audited (not just dire...

Details

Author: haabe
Repository: haabe/mycelium
Created: 3 months ago
Last Updated: today
Language: Python
License: MIT

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Listed

owasp-security

Review code being written or modified against the OWASP Top 10:2025 and ASVS secure-coding requirements, catching vulnerability classes before they ship. Works in any language or stack. Use when writing authentication or authorization logic, handling user input, adding API endpoints, choosing cryptographic operations, processing file uploads, or making any change that touches a trust boundary. Complements secret-scan (which finds credentials) and dependency-audit (which checks packages) with line-level vulnerability review.

4 Updated today

KhaledSaeed18

Code & Development Listed

owasp-security

Use when reviewing code for security vulnerabilities, implementing authentication/authorization, handling user input, or discussing web application security. Covers OWASP Top 10:2025, ASVS 5.0, and Agentic AI security (2026).

1 Updated yesterday

Bbk-man

DevOps & Infrastructure Solid

owasp

Security review against OWASP Top 10:2025, ASVS 5.0, and Agentic AI risks. Use when user says 'review for security', 'is this secure', 'check for vulnerabilities', 'review auth/authorization', 'check input handling', or when writing cryptography, session management, or AI agent code.

6 Updated 5 days ago

anmolnagpal