owasp-security

# Comprehensive OWASP Security Skills A developer-focused security reference covering six OWASP standards for securing web applications, APIs, mobile apps, containers, and AI/LLM systems. Each section provides concise detection guidance, key requirements, and mitigation strategies. ## Quick Navigation 1. [OWASP Top 10 (2021)](#section-1-owasp-top-10-2021) 2. [OWASP ASVS 5.0](#section-2-owasp-asvs-50-application-security-verification-standard) 3. [OWASP MASVS v2.1.0](#section-3-owasp-masvs-v210-mobile-security) 4. [OWASP API Security Top 10](#section-4-owasp-api-security-top-10-2023) 5. [OWASP Kubernetes Top 10](#section-5-owasp-kubernetes-top-10-2022) 6. [OWASP Agentic Applications 2026](#section-6-owasp-agentic-applications-2026) --- ## Section 1: OWASP Top 10 (2021) The OWASP Top 10 represents the most critical security risks in web applications. ### A01: Broken Access Control **Detection:** URLs with direct ID references (`/user/1234/orders`); client-side only enforcement; missing authorization checks. **Mitigation:** Enforce server-side authorization for every sensitive operation; verify user ownership of resources; implement default-deny principle. **Example:** ```javascript // INSECURE: No authorization check app.get('/users/:id/orders', (req, res) => { const orders = db.query('SELECT * FROM orders WHERE user_id = ?', req.params.id); res.json(orders); }); // SECURE: Authorization check app.get('/users/:id/orders', (req, res) => { if (req.user.id !== parseIn...