owasp-top10listed

# OWASP Top 10 Prevention Most real-world breaches exploit a short, well-known list of weaknesses. This package is the deep reference: each category gets its root cause, the default defense, and a vulnerable-vs-fixed example. Category deep-dives live in `references/`, side-by-side fixes in `examples/`, and a runnable heuristic scanner in `scripts/`. > Based on the OWASP Top 10 (2021). The list shifts over time, but the underlying defenses are durable. ## The list (and the one-line defense for each) | # | Category | Default defense | |---|---|---| | A01 | **Broken Access Control** | Enforce authorization server-side on every action; deny by default; check ownership (stop IDOR). | | A02 | **Cryptographic Failures** | TLS in transit; encrypt sensitive data at rest; hash passwords with argon2/bcrypt; never roll your own crypto. | | A03 | **Injection** (SQL/cmd/XSS) | Parameterize queries; context-aware output encoding; never concatenate untrusted input. | | A04 | **Insecure Design** | Threat-model before building; secure-by-design defaults; abuse-case thinking. | | A05 | **Security Misconfiguration** | Harden defaults; disable debug in prod; least-privilege; remove unused features. | | A06 | **Vulnerable Components** | Inventory dependencies; patch on a schedule; scan for CVEs (see `vuln-scanner` agent). | | A07 | **Auth Failures** | Strong session handling, MFA, rate-limit logins, no credential stuffing surface (see `secure-auth`). | | A08 | **Software & Data Integrity** | V