reviewing-security
OWASP Top 10-based security review and vulnerability detection. Use when reviewing code for security issues, performing vulnerability analysis, or when user mentions security, OWASP, XSS, SQL injection, セキュリティ, 脆弱性.
Installation
Suivez les instructions du dépôt pour votre agent. Consultez les fichiers et dépendances avant l’installation.
Voir la source ↗GuidesInstructions
Security Review
Detection (OWASP Top 10)
| ID | Category | Pattern | Fix |
|---|---|---|---|
| A01 | Broken Access Control | Missing auth, IDOR, path traversal | Auth middleware, ownership check |
| A02 | Cryptographic Failures | password: 'plaintext' |
bcrypt/argon2 hashing |
| A03 | Injection | db.query(\SELECT...${id}`)` |
Parameterized query, ORM |
| A03 | Injection | exec(\ping ${host}`)` |
Input validation, library instead |
| A03 | XSS | dangerouslySetInnerHTML={{ __html }} |
Default escaping, DOMPurify |
| A05 | Security Misconfiguration | cors({ origin: '*' }) |
Explicit origin allowlist |
| A05 | Security Misconfiguration | cookie: {} (no options) |
secure, httpOnly, sameSite: 'strict' |
| A09 | Logging Failures | logger.info({ password }) |
Exclude sensitive fields |
| A10 | SSRF | fetch(userInputUrl) |
URL validation, allowlist |
Confidence Threshold
Report only when confidence >80%. Include: file:line, exploit scenario, fix recommendation.
References
| Topic | Scope | File |
|---|---|---|
| Basic | A01, A02, A07 | references/owasp-basic.md |
| Injection | A03 | references/owasp-injection.md |
| Advanced | A04-A06, A08-A10 | references/owasp-advanced.md |
| Cloud | IAM, IaC, CI/CD | references/cloud-infrastructure.md |
Exemples
Consultez les exemples du dépôt source.
Voir la source ↗Historique source
- Date d’indexation
- 2026-01-20
- Mise à jour de l’index
- 2026-01-26
- Branch
- main
Les dates concernent ce répertoire. Consultez le dépôt pour l’historique du code.
GitHub ↗chat Comments (0)
Sign in to join the discussion and leave a comment.
No comments yet. Be the first to share your thoughts!