OWASP Security

Coverage

• The OWASP Top 10 (2021) categories: A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable Components, A07 Identification and Authentication Failures, A08 Software and Data Integrity Failures, A09 Security Logging and Monitoring Failures, A10 Server-Side Request Forgery
• Detection patterns per category: the code shapes that signal vulnerability and the grep / static-analysis queries that surface them
• Mitigation patterns per category: parameterised queries, output encoding, principle-of-least-privilege access checks, secure defaults, dependency pinning, input allowlisting, structured logging
• Threat modelling: the four-question STRIDE-lite (what are we building, what could go wrong, what are we doing about it, did we do a good job) for new features
• The AI-generated code premium: vulnerabilities specifically common in LLM-authored code (1.7-2.74× rate per published research) and what to look for
• Severity grading and disclosure: when a finding is critical, high, medium, or informational, and how to communicate fixes without leaking exploitable detail
• Defence in depth: why a single mitigation is insufficient, and how to layer controls
• The auth invariants that recur: authentication separated from authorisation, every privileged action checked, sessions invalidated on logout, secrets never in code or logs

Philosophy

Security is not a feature; it is a property of the system that erodes silently unless actively maintained. The OWASP Top 10 is not a checklist to memorise — it is a vocabulary for naming the most-common ways software fails. A reviewer who can name "this is A03 Injection" and "this is A07 Identification Failure" can communicate findings to teammates, prioritise against industry data, and reach mitigations that are already documented and known to work.

The most expensive security bug is the one you didn't notice was a security bug. Most live vulnerabilities started life as a perfectly reasonable-looking line of code that the author did not recognise as a security-relevant decision. The point of this skill is to enrich your default reading of code with a security lens — not as a separate review pass, but as a way of seeing every input, every boundary, and every privileged action.