owasp-security-review
Installation
SKILL.md
OWASP Top 10:2025 Security Review
<quick_reference>
Quick reference
| # | Category | Key risk | Avg incidence |
|---|---|---|---|
| A01 | Broken Access Control | Unauthorized data access, privilege escalation, SSRF, CSRF | 3.74% |
| A02 | Security Misconfiguration | Default creds, verbose errors, missing hardening, XXE | 3.00% |
| A03 | Software Supply Chain Failures | Vulnerable/malicious dependencies, compromised build pipelines | 5.72% |
| A04 | Cryptographic Failures | Weak algorithms, hardcoded keys, missing encryption, weak hashing | 3.80% |
| A05 | Injection | SQLi, XSS, command injection, LDAP/XPath/EL injection | 3.08% |
| A06 | Insecure Design | Missing threat modeling, business logic flaws, insufficient controls | 1.86% |
| A07 | Authentication Failures | Credential stuffing, weak passwords, session fixation, missing MFA | 2.92% |
| A08 | Software/Data Integrity Failures | Unsigned updates, insecure deserialization, untrusted CDN code | 2.75% |
| A09 | Security Logging & Alerting Failures | Missing audit logs, no alerting, log injection, sensitive data in logs | 3.91% |
| A10 | Mishandling of Exceptional Conditions | Failing open, info leakage via errors, unchecked return values | 2.95% |