WSTG Security Testing

OWASP Web Security Testing Guide methodology: 12 categories, ~109 tests, IDs in the form WSTG-<CAT>-<NN>. Source of truth bundled in data/wstg.json; live: https://owasp.org/www-project-web-security-testing-guide/latest/.

Authorization gate (always first)

Before suggesting or running any active test, confirm the user owns the target or has written permission to test it (pentest engagement, CTF, their own app, staging). If scope is unclear, ask. Default to non-destructive probes; never touch prod data that can't be restored. Defensive self-review and code review need no external auth.

Pick a mode

1. Guide a test — plan + walk an authorized engagement across WSTG categories. Scope → recon (INFO) → per-category tests → findings. Suggest probes from reference/PAYLOADS.md, map each result to a WSTG ID.
2. Self-review my app — defensive. Read the user's code/stack, walk the relevant categories, flag gaps with the Fix guidance from reference/CATEGORIES.md. No live attacking needed.
3. Checklist + reporting — generate a coverage checklist, track verdicts, score it, emit findings. See scripts + REPORTING.md.
4. Code / PR review — review a diff or codebase against the high-signal categories (INPV, ATHN, ATHZ, SESS, CRYP, CLNT, APIT). Flag risky sinks, cite the WSTG ID, give the fix.