owasp-security

1# Comprehensive OWASP Security Skills
2 
3A developer-focused security reference covering six OWASP standards for securing web applications, APIs, mobile apps, containers, and AI/LLM systems. Each section provides concise detection guidance, key requirements, and mitigation strategies.
4 
5## Quick Navigation
6 
71. [OWASP Top 10 (2021)](#section-1-owasp-top-10-2021)
82. [OWASP ASVS 5.0](#section-2-owasp-asvs-50-application-security-verification-standard)
93. [OWASP MASVS v2.1.0](#section-3-owasp-masvs-v210-mobile-security)
104. [OWASP API Security Top 10](#section-4-owasp-api-security-top-10-2023)
115. [OWASP Kubernetes Top 10](#section-5-owasp-kubernetes-top-10-2022)
126. [OWASP Agentic Applications 2026](#section-6-owasp-agentic-applications-2026)
13 
14---
15 
16## Section 1: OWASP Top 10 (2021)
17 
18The OWASP Top 10 represents the most critical security risks in web applications.
19 
20### A01: Broken Access Control
21**Detection:** URLs with direct ID references (`/user/1234/orders`); client-side only enforcement; missing authorization checks.
22**Mitigation:** Enforce server-side authorization for every sensitive operation; verify user ownership of resources; implement default-deny principle.
23**Example:**
24```javascript
25// INSECURE: No authorization check
26app.get('/users/:id/orders', (req, res) => {
27  const orders = db.query('SELECT * FROM orders WHERE user_id = ?', req.params.id);
28  res.json(orders);
29});
30// SECURE: Authorization check
31app.get('/users/:id/orders', (req, res) => {
32…