owasp-securitylisted

# OWASP Security Knowledge Detection-first reference for security-sensitive code review, and the operating guide to the Forge plugin's own security guards. The tables below are the **triage layer** — one detection signal per category, kept inline so this skill is useful the moment it preloads into the security agent. When a signal fires, open the matching `reference/*.md` for the vulnerable→fixed code. This skill covers guidance for **any** stack a Forge user builds in (TypeScript/JS, Python, Rust, Go, …). Examples are illustrative, not tied to any one codebase. ## How to use this skill 1. Scan the diff/codebase against the **detection signals** below (grep the patterns). 2. On a hit, open the linked reference for the remediation pattern. 3. Before reporting, run the **Security Review Checklist** (§ below). 4. Filter results through **False Positive Filters** — do not report noise. 5. If a write/command was **blocked** by a Forge guard, jump to **Forge security controls** for the reason + correct fix. ## OWASP Top 10:2025 — detection signals Full vulnerable→fixed code: [reference/owasp-top10.md](reference/owasp-top10.md). | ID | Category | Grep for | |----|----------|----------| | A01 | Broken Access Control | routes without auth middleware; queries using user IDs with no ownership filter; missing role checks; `origin: "*"` | | A02 | Cryptographic Failures | `secret\|password\|key\|token` literals in source (not env); MD5/SHA1 on passwords; `Math.random()`/`random.r