vulnerability-scanner

原文涵盖的主题

• Vulnerability Scanner
• 🔧 Runtime Scripts
• 📋 Reference Files
• 1. Security Expert Mindset
• Core Principles
• Threat Modeling Questions
• 2. OWASP Top 10:2025
• Risk Categories

Think like an attacker, defend like an expert. 2025 threat landscape awareness. Execute for automated validation: | Script | Purpose | Usage | |--------|---------|-------| | scripts/securityscan.py | Validate security principles applied | python scripts/securityscan.py | | File | Purpose | |------|---------| | checklists.md | OWASP Top 10, Auth, API, Data protection checklists | -- | Principle | Application | |-----------|-------------| | Assume Breach | Design as if attacker already inside | | Zero Trust | Never trust, always verify | | Defense in Depth | Multiple layers, no single point | | Least Privilege | Minimum required access only | | Fail Secure | On error, deny access | Before scanning, ask: 1. What are we protecting? (Assets) 2. Who would attack? (Threat actors) 3. How would they attack? (Attack vectors) 4. What's the impact? (Business risk) -- | Rank | Category | Think About | |------|----------|-------------| | A01 | Broken Access Control | Who can access what? IDOR, SSRF | | A02 | Security Misconfiguration | Defaults, headers, exposed services | | A03 | Software Supply Chain 🆕 | Dependencies, CI/CD, build integrity | | A04 | Cryptographic Failures | Weak crypto, expo

这里只展示节选，请以完整原文和当前要求为准。