Israeli AppSec Scanner

Security scanning and compliance guidance tailored for Israeli web applications. This skill covers the full spectrum of application security, from OWASP Top 10 verification to Israeli Privacy Protection Authority (PPA) compliance, with special attention to Hebrew/RTL-specific attack vectors.

OWASP Top 10 version note (2025-2026). The checklist below is keyed to OWASP Top 10 2021. OWASP Top 10 2025 was published and re-shaped the categories: A01 now subsumes SSRF (no separate A10:SSRF entry), A03 is the new Software Supply Chain Failures, A05 is now Injection (down from A03), A09 was renamed Security Logging and Alerting Failures, and a new A10 covers Mishandling of Exceptional Conditions. When auditing in 2026, treat the 2021 numbering below as a working scaffold and cross-walk findings to the 2025 list at https://owasp.org/Top10/2025/ before reporting.

OWASP Top 10 Checklist (Israeli Context)

Work through each category systematically. For each finding, note the severity (Critical/High/Medium/Low) and provide a remediation recommendation.

A01: Broken Access Control

• Verify all API endpoints enforce authentication (check Next.js middleware, NestJS guards)
• Confirm role-based access control covers admin, user, and anonymous roles
• Test that Hebrew URL paths cannot bypass route-based authorization
• Check for Insecure Direct Object References (IDOR) on user-facing resources
• Verify CORS configuration restricts origins to expected Israeli domains
• Ensure JWT tokens are validated server-side, not just client-side
• Test directory traversal with Hebrew-encoded path segments (%D7%90 etc.)