securitylisted

# Security ## OWASP Top 10 (2021) — Quick Reference | # | Category | What to check | |---|----------|--------------| | A01 | Broken Access Control | Is authorization enforced on every endpoint? | | A02 | Cryptographic Failures | Are secrets encrypted at rest and in transit? | | A03 | Injection | Is all input sanitized or parameterized? | | A04 | Insecure Design | Is the threat model documented? | | A05 | Security Misconfiguration | Are defaults changed? Debug off in prod? | | A06 | Vulnerable Components | Are dependencies up to date? | | A07 | Auth & Session Failures | Are sessions invalidated on logout? Token expiry set? | | A08 | Software Integrity Failures | Are supply-chain dependencies verified? | | A09 | Logging & Monitoring Failures | Are security events logged without leaking PII? | | A10 | SSRF | Are outbound URLs allowlisted? | ## Input Validation Validate all input at system boundaries. Never trust data from: HTTP request body, query parameters, headers, cookies, or environment variables passed by external systems. **Rules:** - Validate type, format, length, and range - Reject unknown fields — do not silently ignore them - Use allowlists (accept known-good), not blocklists (reject known-bad) - Validate at the API layer before it reaches the service layer ```kotlin // Spring Boot — Bean Validation data class CreateUserRequest( @field:NotBlank @field:Email val email: String, @field:Size(min = 8, max = 72) val password: String, @field:Size(max = 100