owasp-securitylisted

# OWASP Security Best Practices Apply these security standards when writing or reviewing code. For deeper material, load on demand: - [references/language-security-quirks.md](references/language-security-quirks.md): language-specific pitfalls and unsafe/safe patterns for 20 languages (JS/TS, Python, Java, C#, PHP, Go, Ruby, Rust, Swift, Kotlin, C/C++, Scala, R, Perl, Bash, Lua, Elixir, Dart, PowerShell, SQL). Read it when reviewing code in a specific language. - [references/llm-agentic-security.md](references/llm-agentic-security.md): OWASP Top 10 for LLM Applications (2025) and Agentic AI security (2026), with checklists and code patterns. Read it when the code calls an LLM, builds a RAG pipeline, or wires up an AI agent with tools. ## Quick Reference: OWASP Top 10:2025 | # | Vulnerability | Key Prevention | |---|---------------|----------------| | A01 | Broken Access Control | Deny by default, enforce server-side, verify ownership | | A02 | Security Misconfiguration | Harden configs, disable defaults, minimize features | | A03 | Supply Chain Failures | Lock versions, verify integrity, audit dependencies | | A04 | Cryptographic Failures | TLS 1.2+, AES-256-GCM, Argon2/bcrypt for passwords | | A05 | Injection | Parameterized queries, input validation, safe APIs | | A06 | Insecure Design | Threat model, rate limit, design security controls | | A07 | Auth Failures | MFA, check breached passwords, secure sessions | | A08 | Integrity Failures | Sign packages, SRI for CDN, saf