avav25 OWASP Coverage
OWASP maintains two top-10 catalogs relevant to modern application security: the long-standing Web Application Top 10 (2021 is the current edition) and the GenAI/LLM Top 10 (2025) for AI-integrated systems. Any security audit or security gate that touches AI/LLM components must cover both.
OWASP Top 10 Web Application Security Risks (2021)
The 2021 edition is the current canonical reference until OWASP publishes a new edition.
| # | Category | What it covers | Common mitigations |
|---|---|---|---|
| A01 | Broken access control | Missing authorization, IDOR, privilege escalation, CORS misconfig | Deny-by-default, server-side enforcement, RBAC/ABAC, owner checks on every resource |
| A02 | Cryptographic failures | Weak/absent encryption, weak hashing, plaintext PII | TLS 1.2+, AES-GCM, Argon2id/bcrypt for passwords, no MD5/SHA1 for security, rotate keys |
| A03 | Injection | SQLi, NoSQLi, command injection, LDAP, XSS | Parameterized queries, ORM, input validation, contextual output encoding, CSP for XSS |
| A04 | Insecure design | Missing threat model, missing rate limits, business-logic flaws | Threat modeling, secure design patterns, abuse-case testing |
| A05 | Security misconfiguration | Default creds, verbose errors, missing hardening, open S3 buckets | Hardening baselines, CIS benchmarks, infra-as-code review, least-privilege defaults |
| A06 | Vulnerable and outdated components | Known-CVE libs, EOL runtimes, unpatched base images | SCA (Snyk/osv-scanner/Trivy), dependency pinning, automated update PRs, EPSS/KEV gating |
| A07 | Identification and authentication failures | Weak passwords, missing MFA, session fixation, credential stuffing | MFA, rate-limit auth, strong session IDs, secure cookies, lockout policies |
| A08 | Software and data integrity failures | Unsigned artifacts, insecure deserialization, CI/CD tampering | Sigstore Cosign, SLSA provenance, signed releases, safe deserialization |
| A09 | Security logging and monitoring failures | No audit log, no alerting, no incident detection | Structured audit logs, SIEM, alerting on anomalies, log integrity protection |
| A10 | Server-side request forgery (SSRF) | Server fetches attacker-controlled URLs, cloud-metadata access | URL allowlists, block link-local/metadata IPs, network egress policy |
OWASP GenAI / LLM Top 10 (2025)
Applies to any AI/LLM component: agent harness, prompt template, LLM API integration, RAG pipeline, vector store, agentic workflow.
| # | Category | What it covers | Common mitigations |
|---|---|---|---|
| LLM01 | Prompt injection (direct + indirect) | Attacker controls input or retrieved content to override system instructions | Untrusted-content wrapping, system/user separation, output validation, allowlist tool use |
| LLM02 | Sensitive information disclosure | Model emits PII, secrets, training data, or system prompts | Output filtering, redaction, data minimization at training/RAG ingest |
| LLM03 | Supply-chain vulnerabilities (model + data) | Poisoned models, tampered training data, malicious adapters | Signed models, provenance attestation, verified registries, integrity hashes |
| LLM04 | Data and model poisoning | Adversarial fine-tune data, RAG corpus tampering | Source vetting, data integrity checks, evaluation drift monitoring |
| LLM05 | Improper output handling | Treating model output as trusted; emitting unsanitized HTML/code/SQL | Encode/sanitize at sink, never eval() model output, sandbox executed code |
| LLM06 | Excessive agency | Agent has more tools/permissions than needed; over-broad write access | Tool allowlists, least-privilege scopes, human-in-the-loop for destructive ops |
| LLM07 | System prompt leakage | System prompt extracted via prompt injection or model behavior | No secrets in system prompt, separate config from prompt, treat as semi-public |
| LLM08 | Vector and embedding weaknesses | RAG corpus injection, embedding inversion, cross-tenant leakage | Tenant isolation, ACL at retrieval, embedding-content validation, query filtering |
| LLM09 | Misinformation | Hallucinated facts, fabricated citations, over-confident output | Citations + grounding, RAG with verified sources, confidence calibration, user disclosure |
| LLM10 | Unbounded consumption | Token/cost/compute exhaustion via crafted inputs | Per-user quotas, max-token limits, rate limits, cost monitoring |
Cite the v2025 OWASP LLM PDF: https://genai.owasp.org/llm-top-10/ for traceability.
Special-case mitigation patterns
Prompt injection (LLM01) — untrusted content wrapping
Wrap any model-retrieved or user-supplied text in clear delimiters and instructions that downstream content is data, not instructions. Validate the model's response against the expected shape (JSON schema, regex, tool-call structure). The untrusted-content-wrapping rule in this plugin enforces this for subagent spawns.
Excessive agency (LLM06) — least-privilege tools
Default to read-only tool surfaces for any agent processing untrusted input. The security-engineer agent in this plugin is read-only by frontmatter (disallowedTools: Write, Edit). Write/Edit access requires an explicit phase with user approval.
Supply-chain failures (A08 / LLM03)
Treat artifact integrity and model provenance the same: signed artifacts (Cosign), build provenance (SLSA), and signed model attestations. See @supply-chain-security for tooling detail.
When this applies
| Workflow | Apply this knowledge |
|---|---|
/security-audit |
Verify findings cover all 10 web categories; if any AI/LLM component is present, also verify all 10 GenAI categories |
/code-review (security gate) |
Spot-check line-level changes against most-likely categories (A01, A03, A05, A07 for typical web code; LLM01, LLM05, LLM06 for agent code) |
/security-scan |
Map scanner findings (Semgrep, Snyk, osv-scanner) to the OWASP categories so the report speaks the canonical language |
/architecture-design (security review step) |
Threat-model the design against each category; flag missing controls (e.g., no rate limiting → A04 insecure design + LLM10 unbounded consumption) |
Integration
- Used by:
/security-audit,/code-review,/security-scan,/architecture-design - Companion knowledge:
@supply-chain-security(depth on A06 + A08 + LLM03),prompt-engineering(LLM01 mitigation patterns),context-engineering(untrusted-content wrapping) - External references:
- OWASP Web Top 10 (2021): https://owasp.org/Top10/
- OWASP GenAI/LLM Top 10 (2025): https://genai.owasp.org/llm-top-10/
- NIST SP 800-53 control mapping: https://nvd.nist.gov/800-53
- OpenSSF Scorecard: https://securityscorecards.dev