security-weblisted

# Web / Backend Security — OWASP Top-10 (2025) + 2026 Practice A practical playbook for hardening server-side code. Anchored on **OWASP Top-10 (2025)** — released November 2025, the current standard, replaces the 2021 list. Targets the project's stack — Go+Fiber business backend + Python+FastAPI AI adapter + PostgreSQL — with concrete code per category. ## When to Use This Skill - Writing or reviewing any backend route / handler / middleware. - Adding a new third-party SDK / dependency. - Setting up TLS / HSTS / CSP headers. - Auditing existing code for OWASP categories. - Pre-launch security review. - Investigating a security incident or pentest finding. For client-side mobile hardening, see `security-mobile`. For auth specifically, see `auth-patterns`. ## OWASP Top-10 (2025) — Per Category The full per-category walk-through with concrete defenses + code samples is in [references/owasp-top-10.md](references/owasp-top-10.md). The skim summary, in 2025 ranking order: | ID | Category | 2021 → 2025 change | Top defense | |---|---|---|---| | A01 | **Broken Access Control** | same #1 | Default deny; use case asserts ownership; multi-tenant via Postgres RLS | | A02 | **Security Misconfiguration** | ↑ from #5 to #2 | Security headers; no DEBUG in prod; default admin paths protected; least-privilege containers | | A03 | **Software Supply Chain Failures** | renamed + expanded from "Vulnerable & Outdated Components" (was #6) | SBOM per release; pin commits not tags in CI; OIDC s