security-review

Solid

OWASP secure design review for code and architecture. Checks input validation, authentication, authorization, data protection.

Code & Development 46 stars 3 forks Updated yesterday MIT

Install

View on GitHub

Quality Score: 87/100

Stars 20%

Recency 20%

100

Frontmatter 20%

Documentation 15%

100

Issue Health 10%

License 10%

100

Description 5%

100

Skill Content

# Security Review Language-agnostic security review based on OWASP Secure by Design. ## Checklist (OWASP Top 10:2025) *Updated to OWASP Top 10:2025 (released January 2025). Previous 2021 edition had different groupings.* ### A01:2025 — Broken Access Control - [ ] Least privilege enforced (users get minimum permissions needed) - [ ] Authorization checked on EVERY request (not just the first) - [ ] CORS restrictive (not `*`) - [ ] Directory listing disabled - [ ] Rate limiting on API/controller access ### A02:2025 — Cryptographic Failures - [ ] Data encrypted at rest and in transit (TLS 1.2+) - [ ] No secrets in code, logs, or error messages - [ ] PII identified and classified in threat model - [ ] Passwords hashed with bcrypt/argon2 (never MD5/SHA1) - [ ] Cryptographic algorithms current (no deprecated ciphers) ### A03:2025 — Injection - [ ] All user input validated (type, length, range, format) - [ ] Parameterized queries for ALL data access (never string concatenation) - [ ] Input allowlisting preferred over denylisting - [ ] Output encoded based on context (HTML, JS, URL, CSS — covers XSS) - [ ] Content Security Policy configured ### A03b:2025 — Software Supply Chain Failures *(new in 2025)* - [ ] SBOM (Software Bill of Materials) maintained for critical dependencies - [ ] Build integrity verified (reproducible builds, signed artifacts) - [ ] Dependency provenance checked (not just version, but source authenticity) - [ ] Transitive dependencies audited (not just dire...

Details

Author: haabe
Repository: haabe/mycelium
Created: 5 months ago
Last Updated: yesterday
Language: Python
License: MIT

Similar Skills

Semantically similar based on skill content — not just same category

Code & Development Listed

security-review

Review a change for secrets, authorization and attack surface against OWASP ASVS + Top 10.

2 Updated 1 weeks ago

georgesmomo

Code & Development Listed

security-review

Use when reviewing code for security vulnerabilities, performing a security audit, or checking for OWASP Top 10 issues — covers injection flaws, broken access control, cryptographic failures, secrets exposure, dependency vulnerabilities, and language-specific pitfalls for Python, TypeScript/JavaScript, and Go.

1 Updated 6 days ago

andr-ca

Code & Development Featured

owasp-security

Reviews code for security vulnerabilities and guides secure implementation using OWASP Top 10:2025, ASVS 5.0, the OWASP Top 10 for LLM Applications (2026), and the OWASP Top 10 for Agentic Applications (2026). Use when reviewing code or a diff for security issues, implementing authentication, authorization, sessions, or cryptography, handling untrusted input, files, or URLs, hardening config, dependencies, or CI, or building LLM and AI agent features.

367 Updated yesterday

agamm