OWASP Security Skill

Apply OWASP thinking for all features, especially input handling, authentication, and data access.

10 Core Security Principles

1. Secure the weakest link — identify and harden the most vulnerable component first.
2. Defence in depth — layer multiple security controls; never rely on a single barrier.
3. Fail securely — on error, default to denying access, not granting it.
4. Least privilege — grant only the minimum permissions necessary; deny by default.
5. Compartmentalise — isolate components so a breach in one doesn't compromise all.
6. Keep it simple — complex security is hard to audit and easy to break.
7. Promote privacy — collect only necessary data; protect it at every layer.
8. Hiding secrets is hard — assume secrets in code will leak; use env vars and secret managers.
9. Be reluctant to trust — verify inputs, identities, and systems; trust nothing by default.
10. Use community resources — prefer well-tested libraries over custom implementations.

Input Handling