# Owasp Security Standards > Use when reviewing code for security vulnerabilities, implementing authentication/authorization, handling user input, or discussing web application security. Covers OWASP Top 10:2025, ASVS 5.0, secure code patterns, and code review checklists. For language-specific quirks see language-security skill. For AI agent security see agentic-ai-security skill. - Skill: `tomevault-io/owasp-security-standards` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/owasp-security-standards` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/owasp-security-standards/raw - Safety review: pending (external: skill-scanner WARNING, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/owasp-security-standards --- # OWASP Security Standards Apply these security standards when writing or reviewing code. ## Quick Reference: OWASP Top 10:2025 | # | Vulnerability | Key Prevention | |---|---------------|----------------| | A01 | Broken Access Control | Deny by default, enforce server-side, verify ownership | | A02 | Security Misconfiguration | Harden configs, disable defaults, minimize features | | A03 | Supply Chain Failures | Lock versions, verify integrity, audit dependencies | | A04 | Cryptographic Failures | TLS 1.2+, AES-256-GCM, Argon2/bcrypt for passwords | | A05 | Injection | Parameterized queries, input validation, safe APIs | | A06 | Insecure Design | Threat model, rate limit, design security controls | | A07 | Auth Failures | MFA, check breached passwords, secure sessions | | A08 | Integrity Failures | Sign packages, SRI for CDN, safe serialization | | A09 | Logging Failures | Log security events, structured format, alerting | | A10 | Exception Handling | Fail-closed, hide internals, log with context | ## Security Code Review Checklist When reviewing code, check for these issues: ### Input Handling - [ ] All user input validated server-side - [ ] Using parameterized queries (not string concatenation) - [ ] Input length limits enforced - [ ] Allowlist validation preferred over denylist ### Authentication & Sessions - [ ] Passwords hashed with Argon2/bcrypt (not MD5/SHA1) - [ ] Session tokens have sufficient entropy (128+ bits) - [ ] Sessions invalidated on logout - [ ] MFA available for sensitive operations ### Access Control - [ ] Check for framework-level auth middleware (e.g., Next.js middleware.ts, proxy.ts, Express middleware) before flagging missing per-route auth - [ ] Authorization checked on every request - [ ] Using object references user cannot manipulate - [ ] Deny by default policy - [ ] Privilege escalation paths reviewed ### Data Protection - [ ] Sensitive data encrypted at rest - [ ] TLS for all data in transit - [ ] No sensitive data in URLs/logs - [ ] Secrets in environment/vault (not code) ### Error Handling - [ ] No stack traces exposed to users - [ ] Fail-closed on errors (deny, not allow) - [ ] All exceptions logged with context - [ ] Consistent error responses (no enumeration) ## Secure Code Patterns ### SQL Injection Prevention ```python # UNSAFE cursor.execute(f"SELECT * FROM users WHERE id = {user_id}") # SAFE cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,)) ``` ### Command Injection Prevention ```python # UNSAFE os.system(f"convert {filename} output.png") # SAFE subprocess.run(["convert", filename, "output.png"], shell=False) ``` ### Password Storage ```python # UNSAFE hashlib.md5(password.encode()).hexdigest() # SAFE from argon2 import PasswordHasher PasswordHasher().hash(password) ``` ### Access Control ```python # UNSAFE - No authorization check @app.route('/api/user/') def get_user(user_id): return db.get_user(user_id) # SAFE - Authorization enforced @app.route('/api/user/') @login_required def get_user(user_id): if current_user.id != user_id and not current_user.is_admin: abort(403) return db.get_user(user_id) ``` ### Error Handling ```python # UNSAFE - Exposes internals @app.errorhandler(Exception) def handle_error(e): return str(e), 500 # SAFE - Fail-closed, log context @app.errorhandler(Exception) def handle_error(e): error_id = uuid.uuid4() logger.exception(f"Error {error_id}: {e}") return {"error": "An error occurred", "id": str(error_id)}, 500 ``` ### Fail-Closed Pattern ```python # UNSAFE - Fail-open def check_permission(user, resource): try: return auth_service.check(user, resource) except Exception: return True # DANGEROUS! # SAFE - Fail-closed def check_permission(user, resource): try: return auth_service.check(user, resource) except Exception as e: logger.error(f"Auth check failed: {e}") return False # Deny on error ``` ## ASVS 5.0 Key Requirements ### Level 1 (All Applications) - Passwords minimum 12 characters - Check against breached password lists - Rate limiting on authentication - Session tokens 128+ bits entropy - HTTPS everywhere ### Level 2 (Sensitive Data) - All L1 requirements plus: - MFA for sensitive operations - Cryptographic key management - Comprehensive security logging - Input validation on all parameters ### Level 3 (Critical Systems) - All L1/L2 requirements plus: - Hardware security modules for keys - Threat modeling documentation - Advanced monitoring and alerting - Penetration testing validation ## Related Skills - **Language-specific security quirks**: See `language-security` skill for 20+ language-specific vulnerability patterns - **AI agent security**: See `agentic-ai-security` skill for OWASP Agentic AI Top 10 2026 - **Full OWASP report**: See `OWASP-2025-2026-Report.md` in this directory for detailed descriptions of all categories ## When to Apply This Skill Use this skill when: - Writing authentication or authorization code - Handling user input or external data - Implementing cryptography or password storage - Reviewing code for security vulnerabilities - Designing API endpoints - Configuring application security settings - Handling errors and exceptions - Working with third-party dependencies --- > Source: [AlexDevFlow/Claude10XD](https://github.com/AlexDevFlow/Claude10XD) — distributed by [TomeVault](https://tomevault.io).