Security code review using OWASP Top 10:2025 standards. Use when reviewing auth code, payment logic, user input handling, or when someone says "security review", "check for vulnerabilities", "OWASP check", or "is this code secure?".
Perform a security review of the code or PR described below using OWASP Top 10:2025 standards.
Target: $ARGUMENTS
| # | Vulnerability | Key Prevention |
|---|---|---|
| A01 | Broken Access Control | Deny by default, enforce server-side, verify ownership |
| A02 | Security Misconfiguration | Harden configs, disable defaults, minimize features |
| A03 | Supply Chain Failures | Lock versions, verify integrity, audit dependencies |
| A04 | Cryptographic Failures | TLS 1.2+, AES-256-GCM, Argon2/bcrypt for passwords |
| A05 | Injection | Parameterized queries, input validation, safe APIs |
| A06 | Insecure Design | Threat model, rate limit, design security controls |
| A07 | Auth Failures | MFA, check breached passwords, secure sessions |
| A08 | Integrity Failures | Sign packages, SRI for CDN, safe serialization |
| A09 | Logging Failures | Log security events, structured format, alerting |
| A10 | Exception Handling | Fail-closed, hide internals, log with context |
For secure code patterns (Go, JavaScript/TypeScript), see references/secure-code-patterns.md.
For agentic AI security and ASVS 5.0 requirements, see references/agentic-ai-security.md.
| Situation | Action |
|---|---|
| Code language not covered in patterns | Apply OWASP principles generically; note the gap |
| Minified/bundled code | Flag as unreviewable; request source |
| No auth code found | Confirm auth is handled elsewhere; don't assume secure |
| Third-party library vulnerability | Check CVE databases; note version and known issues |
| Insufficient context | List assumptions made; request clarification |