reviewer-harness 1.6.0 → 1.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/skills/api-security.md +7 -0
- package/skills/owasp-top10.md +37 -0
package/package.json
CHANGED
package/skills/api-security.md
CHANGED
|
@@ -35,3 +35,10 @@ Apply these 12 rules to every endpoint. If a rule doesn't apply, say why.
|
|
|
35
35
|
- [ ] Inputs are schema-validated
|
|
36
36
|
- [ ] No secrets in URLs or logs
|
|
37
37
|
- [ ] Auth endpoints are rate-limited
|
|
38
|
+
|
|
39
|
+
### Learn more (official sources)
|
|
40
|
+
- OWASP API Security Top 10: https://owasp.org/API-Security/
|
|
41
|
+
- OWASP Cheat Sheet Series (API Security): https://cheatsheetseries.owasp.org/
|
|
42
|
+
- OWASP Web Security Testing Guide: https://github.com/OWASP/wstg
|
|
43
|
+
- Practice on a vulnerable API: https://github.com/OWASP/crAPI
|
|
44
|
+
- Prevent committing secrets: https://github.com/awslabs/git-secrets
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: owasp-top10
|
|
3
|
+
description: OWASP Top 10 web security risks — check every app against these before shipping. The industry standard for web security.
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
## Skill: owasp-top10
|
|
7
|
+
|
|
8
|
+
When to use: building, reviewing, or auditing any web application or API.
|
|
9
|
+
|
|
10
|
+
The OWASP Top 10 is the industry-standard list of the most critical web security risks. Check every app against these before shipping.
|
|
11
|
+
|
|
12
|
+
### The 10 risks (2021 edition)
|
|
13
|
+
1. **Broken Access Control.** Users can act outside their permissions. Fix: deny by default; check ownership on every request; never rely on client-side hiding.
|
|
14
|
+
2. **Cryptographic Failures.** Sensitive data exposed or weakly protected. Fix: encrypt in transit (TLS) and at rest; use strong algorithms; never store plain-text secrets.
|
|
15
|
+
3. **Injection.** Untrusted data sent to an interpreter (SQL, NoSQL, OS, LDAP). Fix: parameterized queries; validate and sanitize all input; least-privilege DB accounts.
|
|
16
|
+
4. **Insecure Design.** Missing or ineffective security controls by design. Fix: threat-model new features; use secure design patterns; write abuse cases.
|
|
17
|
+
5. **Security Misconfiguration.** Default configs, open cloud storage, verbose errors, missing headers. Fix: hardened configs; remove defaults; minimal error details; security headers.
|
|
18
|
+
6. **Vulnerable Components.** Outdated libraries with known CVEs. Fix: inventory dependencies; patch promptly; remove unused packages.
|
|
19
|
+
7. **Authentication Failures.** Weak login, session, or credential handling. Fix: MFA where possible; strong password policy; secure session management; rate-limit logins.
|
|
20
|
+
8. **Software & Data Integrity Failures.** Unverified updates, CI/CD tampering, insecure deserialization. Fix: verify signatures; secure pipelines; avoid deserializing untrusted data.
|
|
21
|
+
9. **Logging & Monitoring Failures.** Breaches go undetected. Fix: log auth events, input validation failures, and access-control denials; alert on anomalies; retain logs securely.
|
|
22
|
+
10. **Server-Side Request Forgery (SSRF).** App fetches attacker-chosen URLs. Fix: validate and whitelist URLs; block internal network access; disable unused URL schemas.
|
|
23
|
+
|
|
24
|
+
### Quick check before shipping
|
|
25
|
+
- [ ] Access control tested (try accessing another user's data)
|
|
26
|
+
- [ ] No secrets in code, logs, or URLs
|
|
27
|
+
- [ ] All inputs validated; queries parameterized
|
|
28
|
+
- [ ] Dependencies up to date; no known CVEs
|
|
29
|
+
- [ ] Auth endpoints rate-limited; sessions secure
|
|
30
|
+
- [ ] Errors don't leak stack traces or internals
|
|
31
|
+
- [ ] Security headers set (CSP, HSTS, X-Frame-Options)
|
|
32
|
+
|
|
33
|
+
### Learn more
|
|
34
|
+
- OWASP Top 10: https://owasp.org/Top10/
|
|
35
|
+
- Cheat Sheet Series: https://cheatsheetseries.owasp.org/
|
|
36
|
+
- Test your app: https://github.com/OWASP/wstg
|
|
37
|
+
- Practice: https://github.com/juice-shop/juice-shop
|