OWASP Web Application Security

When to Use

• Security code reviews
• Implementing authentication or authorization
• Handling user input from untrusted sources
• Building or auditing web API endpoints
• Configuring CORS, CSP, or other security headers
• Managing secrets, tokens, or credentials in code
• Setting up rate limiting or brute force protection

When NOT to Use

• General code style or formatting reviews with no security implications
• Non-web applications such as CLI tools, batch scripts, or desktop utilities
• Performance optimization tasks where security is not the concern
• Infrastructure-level security (firewall rules, network segmentation)