# Sandstorm > Use this checklist when auditing application code, configuration, and deployment surfaces. - Skill: `tomevault-io/sandstorm` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/sandstorm` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/sandstorm/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/sandstorm --- # OWASP Top 10 Review Checklist Use this checklist when auditing application code, configuration, and deployment surfaces. ## Focus areas - Broken access control - Cryptographic failures - Injection - Insecure design - Security misconfiguration - Vulnerable and outdated components - Identification and authentication failures - Software and data integrity failures - Security logging and monitoring failures - Server-side request forgery ## Audit guidance For each relevant category: 1. Identify the vulnerable file, endpoint, or configuration surface. 2. Explain the concrete risk instead of naming the category only. 3. Add the likely CWE when you can support it from the evidence. 4. Suggest the smallest credible remediation or validation step. Prefer high-signal findings over long speculative lists. --- > Source: [tomascupr/sandstorm](https://github.com/tomascupr/sandstorm) — distributed by [TomeVault](https://tomevault.io).