Perform a repository security analysis focused on the OWASP Top 10. Before starting the analysis, research the latest official OWASP Top 10 list/version and use that as the baseline for all findings. Use this structured workflow:

Scope and attack surface discovery:

Identify components with real external attack surface first (for example: public HTTP endpoints, API gateways, auth flows, admin interfaces, file upload paths, webhook handlers, message consumers, third-party integration points, CI/CD and deployment entry points).
Mark each component as internet-exposed, internal-only, or local-only.
Focus deep analysis on internet-exposed and high-impact internal components.

Asset and trust-boundary mapping:

Document sensitive assets (credentials, tokens, PII, financial data, signing keys, internal services).
Identify trust boundaries and data flows across components.
Highlight where untrusted input crosses boundaries.

OWASP Top 10 assessment:

Assess the discovered attack-surface components against the latest OWASP Top 10 categories.
For each category, check relevant code, configuration, dependency manifests, build settings, and runtime hardening.
Distinguish between confirmed findings, likely findings, and assumptions when evidence is incomplete.

Risk rating and prioritization:

Prioritize by exploitability, potential impact, exposure, and ease of abuse.
Use a clear criticality level per finding: Critical, High, Medium, Low.
Include at least one practical mitigation proposal per finding.

Validation and coverage check:

owasp-top-10-analysis