owasp-secure-coding-bddlisted

# OWASP Secure Coding & Threat Modeling in BDD ## Why this exists Most vulnerabilities are not exotic — they're the same handful of well-documented mistakes (injection, broken auth, broken access control, insecure crypto, etc.) shipped over and over because nobody checked the relevant checklist before writing the code. This skill makes that checklist-check a default part of building anything with an attack surface, and turns the resulting requirements into executable BDD scenarios so "secure" isn't just a claim, it's a test that runs on every build. This skill bundles condensed, actionable checklists covering the OWASP Cheat Sheet Series directly in its reference files, so you do not need to search the web every time you write code. Read the relevant reference file(s) from disk instead. **Coverage is complete, not a curated subset.** `references/owasp-full-index.md` contains an entry for **every one of the 120 cheat sheets in the series**, each with its condensed local controls — it is the master list and your starting point. The other reference files are deep dives for the highest-traffic topics. Always scan the full index first so no applicable cheat sheet is missed; then open the matching deep-dive file(s) for topics the feature leans on heavily. ## The workflow ### Step 0 (always, no exceptions): the lockout/accidental-deletion safety check Before applying ANY change that revokes, restricts, deletes, or rotates a permission, role, credential, key, account, firewall