Security Auditor — OWASP Top 10 (2021) Detailed Checklist

Externalized from the agent definition per the few-shot-examples rule (#1587).

The agent definition keeps the 10-category gate index + delegation routing inline;

these are the full per-category checkboxes the auditor works through during an audit.

Delegation notes mark where deep findings hand off to a specialist agent/skill.

1. A01: Broken Access Control

• [ ] Proper authorization checks
• [ ] No direct object reference vulnerabilities
• [ ] Proper CORS configuration
• [ ] No privilege escalation paths

2. A02: Cryptographic Failures (deep findings → `applied-cryptographer`)

• [ ] Sensitive data encrypted at rest (this checklist verifies it IS encrypted; the choice of primitive delegates)
• [ ] TLS/HTTPS for data in transit (verify TLS 1.2+; cipher suite selection delegates if non-standard)
• [ ] Strong cryptographic algorithms (flag deprecated: MD5, SHA-1 as KDF, DES, RC4, CBC-without-MAC; primitive choice for replacement → applied-cryptographer)
• [ ] Proper key management (verify keys are not hardcoded; key separation architecture → applied-cryptographer)

3. A03: Injection

• [ ] Parameterized queries (no SQL injection)
• [ ] Input validation and sanitization
• [ ] No command injection vulnerabilities
• [ ] Safe templating (no XSS)

4. A04: Insecure Design

• [ ] Threat modeling performed
• [ ] Security requirements defined
• [ ] Defense in depth implemented
• [ ] Fail-secure by default

5. A05: Security Misconfiguration

• [ ] Security headers configured (CSP, HSTS, etc.)
• [ ] Default credentials changed
• [ ] Error messages don't leak information
• [ ] Unnecessary features disabled

6. A06: Vulnerable and Outdated Components (deep supply-chain trust → `supply-chain-trust` skill)

• [ ] Dependencies up to date
• [ ] No known CVEs in dependencies
• [ ] Supply chain security validated (CVE-clean is a baseline; deeper attestation/repro-build/snapshot-pinning delegates)
• [ ] Software bill of materials (SBOM) (this checklist verifies SBOM exists; pinning depth and trust-boundary inventory delegates)

7. A07: Identification and Authentication Failures

• [ ] Strong password requirements
• [ ] MFA available/required
• [ ] Session management secure
• [ ] No credential stuffing vulnerabilities

8. A08: Software and Data Integrity Failures (chain-of-trust review → `secure-bootstrap-reviewer`)

• [ ] CI/CD pipeline secure (deep chain-of-trust audit delegates; this checklist verifies basics: branch protection, signed commits, no token in logs)
• [ ] Code signing implemented (this verifies signatures exist; key custody, rotation, "verify the verifier" delegates)
• [ ] Integrity checks for updates (this verifies checks exist; bootstrap-chain integrity for portable systems delegates)
• [ ] No deserialization vulnerabilities (stays here — application-code altitude)

9. A09: Security Logging and Monitoring Failures

• [ ] Security events logged
• [ ] Sensitive data not logged
• [ ] Log monitoring and alerting
• [ ] Incident response procedures

10. A10: Server-Side Request Forgery (SSRF)

• [ ] URL validation for external requests
• [ ] Network segmentation
• [ ] Allowlist for external services
• [ ] No user-controlled URLs