Summary

# ===== A01 Broken Access Control =====
# Symptom: ownership checks missing; users see / mutate other users data.
# Fix:     scope queries to current user. RBAC for admin actions.
# Test:    every endpoint has a test that a non-owner gets 403.

# ===== A02 Cryptographic Failures =====
# Symptom: weak hashes, plaintext storage, predictable randomness, no TLS.
# Fix:     argon2id for passwords; AES-GCM for symmetric; TLS everywhere;
#          secrets in a vault.
# Test:    grep for sha1/md5 on credentials; openssl s_client checks TLS config.

# ===== A03 Injection =====
# Symptom: SQLi, NoSQLi, command, LDAP, OS injection.
# Fix:     parameterise EVERY query; whitelist non-parameterisable parts;
#          argv lists not shell strings for child processes.
# Test:    each list/search/login endpoint has SQLi canary payloads.

# ===== A04 Insecure Design =====
# Symptom: no abuse model, missing rate limits, weak business rules.
# Fix:     threat-model new features; rate-limit money-touching paths;
#          idempotency keys.
# Test:    can a single user hammer N requests/sec? Should they?

# ===== A05 Security Misconfiguration =====
# Symptom: debug mode in prod, default creds, open S3 buckets.
# Fix:     CIS benchmarks; baked-into-deploy config; CI checks for known bad
#          values; security headers (CSP, HSTS, X-Frame, Referrer-Policy).
# Test:    a deploy that ships APP_DEBUG=true fails CI.

# ===== A06 Vulnerable & Outdated Components =====
# Symptom: deps with public CVEs, 18-month-old lockfile.
# Fix:     Dependabot/Renovate; weekly composer/npm audit; emergency patch SLA.
# Test:    composer audit is green; SBOM is generated on every build.

# ===== A07 Identification & Authentication Failures =====
# Symptom: weak passwords accepted, no MFA, no session rotation.
# Fix:     argon2id; password strength validator; TOTP/WebAuthn for MFA;
#          session.regenerate() on password / role change.
# Test:    login rate limit + 'session id changes after password update' test.

# ===== A08 Software & Data Integrity Failures =====
# Symptom: unsigned updates, untrusted deserialisation, broken CI/CD trust.
# Fix:     signed commits + signed releases; Subresource Integrity for CDN
#          scripts; never deserialise untrusted data with Python pickle / Java.
# Test:    a third-party script without integrity attribute is flagged in review.

# ===== A09 Security Logging & Monitoring Failures =====
# Symptom: auth events not logged, no alert on spikes.
# Fix:     structured 'auth_failure' / 'auth_success' / 'admin_action' logs;
#          alert on > N failed logins per minute per IP; 90+ day retention.
# Test:    50 wrong passwords in 5 minutes pages on-call.

# ===== A10 Server-Side Request Forgery (SSRF) =====
# Symptom: endpoints that fetch a user-supplied URL.
# Fix:     resolve URL, block RFC1918 + 169.254 + link-local; only https on 443;
#          disable redirects; AWS IMDSv2.
# Test:    posting http://169.254.169.254/ returns 400.

# ===== Cross-cutting habits =====
# - Treat patch latency as the metric (MTTP < 7 days critical)
# - Bug bounty programme or annual paid pen test
# - Threat model new features (STRIDE on the data flow, 20 min)
# - Tabletop incident drills quarterly
# - Make every Top 10 a unit test in the security suite

# ===== Realistic 'small team' posture =====
# - All queries parameterised, enforced by Semgrep in CI
# - argon2id for passwords + MFA option
# - Rules + App Check on Firebase / equivalents on other backends
# - Dependabot + weekly review of CVE alerts
# - CSP + HSTS + secure cookies as default headers
# - Logging + Sentry + alerting on auth_failure spikes
# - Backups (off-host, encrypted, restore-tested) for every DB
# - Documented incident playbook (see owasp/incident lesson)
#
# This is reachable in one quarter for a small product team.

# ===== Self-test =====
# - Can a non-owner read another user's data via id manipulation?    A01
# - Are passwords hashed with anything other than argon2id/bcrypt?    A02
# - Is any DB query built by string concatenation?                    A03
# - Does any money-touching endpoint lack rate limiting?              A04
# - Does any deployed config have a debug flag on?                    A05
# - Have you patched critical CVEs in the last 7 days?                A06
# - Does session id change on auth events?                            A07
# - Is every external script integrity-pinned?                        A08
# - Are auth failures logged + alerted?                               A09
# - Can an endpoint fetch an arbitrary URL?                           A10
#
# 'Yes' to any of the questions you DON'T want a 'yes' to is a finding.

// Next: OWASP API Top 10, MASVS for mobile, LLM Top 10.