OWASP Security Review Protocol

<critical_constraints>

1. ❌ NO execution/dynamic analysis.
2. ❌ NO false positives. Evidence required.
3. ✅ MUST map to OWASP Top 10.
4. ✅ MUST provide Severity, Location, Remediation. </critical_constraints>

1. Analyze: Identify language/framework. Trace Source → Sink.
2. Scan:
   • Injection/Broken Access.
   • Hardcoded Secrets.
   • Logging Failures.
3. Report: Format findings (Markdown Table). If none, "No risks found".
4. Remediate: Provide code fixes for Critical/High.