OWASP Top 10:2025 — Code-Level Security

Tactical security patterns for Kotlin, Go, Java, and Node.js on NAIS, aligned with the 2025 OWASP Top 10.

Complements @security-champion-agent (architecture-level threat modeling) and the security-review skill (scanning tools).

Full code examples for each category: see examples.md in this skill directory.

A01: Broken Access Control (incl. SSRF)

// ❌ IDOR — trusts user-supplied ID without ownership check
get("/api/vedtak/{id}") {
    val vedtak = vedtakRepository.findById(call.parameters["id"]!!.toLong())
    call.respond(vedtak)
}