OWASP Security Review Protocol

<critical_constraints>

• ❌ NO execution/dynamic analysis.

• ❌ NO false positives. Evidence required.

• ✅ MUST map to OWASP Top 10.

• ✅ MUST provide Severity , Location , Remediation . </critical_constraints>

• Analyze: Identify language/framework. Trace Source → Sink.

• Scan:

• Injection/Broken Access.

• Hardcoded Secrets.

• Logging Failures.

• Report: Format findings (Markdown Table). If none, "No risks found".

• Remediate: Provide code fixes for Critical/High.

<owasp_checklist>

• A01 Broken Access: IDOR, traversal.

• A02 Crypto: Weak keys/algos.

• A03 Injection: SQLi, XSS, Cmd.

• A04 Design: No rate limiting.

• A05 Misconfig: Default creds.

• A06 Components: Old libs.

• A07 Auth: Weak pwd.

• A08 Integrity: Deserialization.

• A09 Logging: Missing/PII.

• A10 SSRF: Unvalidated URLs. </owasp_checklist>

<output_template>

Security Audit

Vuln OWASP Sev Loc Desc Fix

Name Cat High File:10 Issue Fix

Summary

[Assessment] </output_template>