Cheatsheet

# OWASP Top 10 (2021), as a review checklist

## A01 Broken Access Control
- Symptom: object-level permission missing; tenant isolation broken
- Defence: deny-by-default; verify ownership on EVERY read AND write
- Ask: 'Does this endpoint check that the resource belongs to the caller?'

## A02 Cryptographic Failures
- Symptom: TLS off, weak ciphers, plaintext storage, predictable randomness
- Defence: TLS everywhere, AES-GCM / ChaCha20-Poly1305, argon2/bcrypt for passwords,
            secrets in a vault, secrets.token_bytes / crypto.randomBytes for randomness
- Ask: 'Is anything sensitive stored or transmitted without strong encryption?'

## A03 Injection
- Symptom: SQLi, NoSQLi, command, LDAP, OS injection
- Defence: parameterised queries everywhere; safe templating; argv lists not shell strings
- Ask: 'Is ANY part of this query/command built from user input by concatenation?'

## A04 Insecure Design
- Symptom: missing rate limits, no abuse model, weak business-logic rules
- Defence: threat-model the feature; rate-limit money-touching paths; idempotency keys
- Ask: 'What is the abuse case here, and what stops it?'

## A05 Security Misconfiguration
- Symptom: open S3 buckets, debug=true in prod, default creds, verbose errors
- Defence: CIS benchmarks; least-privilege IAM; ship the same config to staging & prod
- Ask: 'Does this work because of a default that would not be set in a fresh tenant?'

## A06 Vulnerable & Outdated Components
- Symptom: deps with known CVEs (the Log4Shell class)
- Defence: SBOM in CI, Dependabot/Renovate, fast emergency patch path
- Ask: 'When did this last get an upgrade PR and who reviewed it?'

## A07 Identification & Authentication Failures
- Symptom: weak password rules, no MFA, predictable session ids, broken logout
- Defence: argon2id, MFA (TOTP / WebAuthn), session rotation on auth change
- Ask: 'After logout, can the prior session id still do anything?'

## A08 Software & Data Integrity Failures
- Symptom: unsigned updates, build pipelines without provenance, insecure deserialisation
- Defence: signed commits + signed releases, SLSA-aware CI, do not deserialise untrusted data
- Ask: 'How do we verify the binary running in prod matches what code-review approved?'

## A09 Security Logging & Monitoring Failures
- Symptom: auth events not logged, no centralised log, no alerts on anomalies
- Defence: log auth + key business actions to a SIEM; alert on auth-fail spikes
- Ask: 'If an attacker tried this five times in five seconds, would anyone know?'

## A10 Server-Side Request Forgery (SSRF)
- Symptom: server-fetches-user-URL endpoints (image previewers, webhooks)
- Defence: deny RFC1918 / 169.254 ranges; whitelist protocols/ports; AWS IMDSv2
- Ask: 'Does this server-side fetch resolve the host before fetching, and block private ranges?'

# Cross-cutting habits
- Threat model new features (STRIDE on the data flow diagram, 20 minutes)
- Patch latency is the metric to optimise (MTTP < 7 days for critical)
- Run a bug bounty programme or a paid pentest annually
- Tabletop incident drills quarterly — the playbook is only as good as the last rehearsal

// Deny-by-default | Parameterise | Encode | TLS + argon2id | SBOM
// Threat model | Headers | Rate-limit | Log + alert | Principle of least privilege