# Security Audit

> OWASP Top 10 security checklist

- Skill: `hongmaple0820/security-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add hongmaple0820/security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hongmaple0820/security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: hongmaple0820 (https://skillmd.com/u/hongmaple0820)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/hongmaple0820/security-audit

---


# Security Audit Checklist

OWASP Top 10 vulnerability review.

## A01: Broken Access Control

- [ ] Authorization checks on all endpoints
- [ ] No IDOR vulnerabilities
- [ ] Role-based access enforced

## A02: Cryptographic Failures

- [ ] Secrets in environment variables
- [ ] HTTPS enforced
- [ ] Strong encryption algorithms

## A03: Injection

- [ ] Parameterized SQL queries
- [ ] Input sanitized
- [ ] No command injection

## A04: Insecure Design

- [ ] Threat modeling done
- [ ] Security architecture reviewed

## A05: Security Misconfiguration

- [ ] Default credentials removed
- [ ] Error messages sanitized
- [ ] Debug mode disabled

## A06: Vulnerable Components

- [ ] Dependencies audited
- [ ] No known CVEs

## A07: Auth Failures

- [ ] Strong password policy
- [ ] Session management secure
- [ ] MFA available

## A08: Data Integrity

- [ ] Input validated
- [ ] Integrity checks on critical data

## A09: Logging Failures

- [ ] Security events logged
- [ ] Logs don't contain secrets

## A10: SSRF

- [ ] URL validation on external requests
- [ ] No arbitrary URL acceptance