OWASP Security Review Protocol

<critical_constraints>

1. ❌ NO execution/dynamic analysis.
2. ❌ NO false positives. Evidence required.
3. ✅ MUST map to OWASP Top 10.
4. ✅ MUST provide Severity, Location, Remediation. </critical_constraints>

1. Analyze: Identify language/framework. Trace Source → Sink.
2. Scan:
   • Injection/Broken Access.
   • Hardcoded Secrets.
   • Logging Failures.
3. Report: Format findings (Markdown Table). If none, "No risks found".
4. Remediate: Provide code fixes for Critical/High.

<owasp_checklist>

• A01 Broken Access: IDOR, traversal.
• A02 Crypto: Weak keys/algos.
• A03 Injection: SQLi, XSS, Cmd.
• A04 Design: No rate limiting.
• A05 Misconfig: Default creds.
• A06 Components: Old libs.
• A07 Auth: Weak pwd.
• A08 Integrity: Deserialization.
• A09 Logging: Missing/PII.
• A10 SSRF: Unvalidated URLs. </owasp_checklist>

<output_template>

Security Audit

Summary

[Assessment] </output_template>