owasp-security

原文涵盖的主题

• Comprehensive OWASP Security Skills
• Quick Navigation
• Section 1: OWASP Top 10 (2021)
• A01: Broken Access Control
• A02: Cryptographic Failures
• A03: Injection (SQL, Command, NoSQL)
• A04: Insecure Design
• A05: Security Misconfiguration

A developer-focused security reference covering six OWASP standards for securing web applications, APIs, mobile apps, containers, and AI/LLM systems. Each section provides concise detection guidance, key requirements, and mitigation strategies. 1. OWASP Top 10 (2021) 2. OWASP ASVS 5.0 3. OWASP MASVS v2.1.0 4. OWASP API Security Top 10 5. OWASP Kubernetes Top 10 6. OWASP Agentic Applications 2026 -- The OWASP Top 10 represents the most critical security risks in web applications. Detection: URLs with direct ID references (/user/1234/orders); client-side only enforcement; missing authorization checks. Mitigation: Enforce server-side authorization for every sensitive operation; verify user ownership of resources; implement default-deny principle. Example: Checklist: ☐ Authorization on server for all sensitive ops ☐ Default-deny policy ☐ No ID-based obscurity ☐ Whitelist allowed fields -- Detection: Sensitive data in plaintext; weak encryption (DES, ECB); missing TLS; hardcoded secrets in code. Mitigation: Always use HTTPS/TLS; encrypt data at rest with AES-256; store secrets in environment variables or vaults; mask sensitive logs. Example: Checklist: ☐ HTTPS enforced ☐ AES-256 encrypt

这里只展示节选，请以完整原文和当前要求为准。