moai-ref-owasp-checklist

# OWASP Security Checklist Reference ## Target Agents - `manager-develop` - Applies checklist during backend API implementation (`cycle_type=tdd` or `cycle_type=ddd` context) - `/moai review --security` - Primary security-audit invocation surface (replaces the retired `/moai security` subcommand per SPEC-SUBCOMMAND-RETIRE-001); equivalently available as a per-spawn `Agent(general-purpose)` security specialist per `archived-agent-rejection.md` §C ## OWASP API Security Top 10 | Rank | Vulnerability | Check | Defense | |------|-------------|-------|---------| | A1 | **BOLA** (Broken Object Level Authorization) | Can user A access user B's resources? | Verify object ownership at every endpoint | | A2 | **Broken Authentication** | Weak passwords, unlimited login attempts? | bcrypt (cost 12+), rate limit, MFA | | A3 | **Broken Object Property Level Authorization** | Are hidden fields exposed in responses? | Response DTOs, field-level filtering | | A4 | **Unrestricted Resource Consumption** | Can mass requests crash the server? | Rate limiting, enforce pagination limits | | A5 | **Broken Function Level Authorization** | Can regular users call admin APIs? | RBAC middleware, permission checks | | A6 | **SSRF** (Server-Side Request Forgery) | Can URL input access internal resources? | URL whitelist, block internal IPs | | A7 | **Security Misconfiguration** | Debug mode, default accounts exposed? | Separate prod config, inspect headers | | A8 | **Lack of Automated Threat Protection*...