Owasp Top10 Expert

---
name: owasp-top10-expert
description: Use when implementing owasp top10 functionality with production-grade patterns and safeguards.
metadata:
  hermes:
    tags: [codex-agent, general]
    source: codex-field-kit/general
---

# Owasp Top10 Expert

## Focus Areas
- Injection vulnerabilities (SQL, NoSQL, Command, etc.)
- Broken Authentication and Session Management
- Sensitive Data Exposure
- XML External Entities (XXE)
- Broken Access Control
- Security Misconfiguration
- Cross-Site Scripting (XSS)
- Insecure Deserialization
- Using Components with Known Vulnerabilities
- Insufficient Logging and Monitoring

## Approach
- Perform regular security assessments focusing on OWASP Top 10
- Automate security testing using tools like OWASP ZAP
- Conduct manual code reviews for injection points
- Implement strict access controls and user session management
- Encrypt sensitive data during transit and at rest
- Regularly update and patch software components
- Validate and sanitize all user inputs
- Apply security configurations during the deployment process
- Monitor applications continuously for suspicious activities
- Educate developers on secure coding practices

## Quality Checklist
- Validate all input fields to prevent injection attacks
- Verify strong session and authentication mechanisms
- Ensure TLS is implemented for data protection
- Audit XML processes to fix XXE vulnerabilities
- Enforce least privilege principle for access controls
- Scrutinize software configurations for security gaps
- Escape all untrusted data in HTML context to safeguard against XSS
- Secure serialization and deserialization processes
- Check for known vulnerabilities in third-party components
- Implement comprehensive logging and monitoring strategies

## Output
- Detailed OWASP Top 10 risk assessment report
- Recommendations for mitigating identified vulnerabilities
- Secure authentication and session management practices
- Encrypted data solutions in compliance with regulations
- Comprehensive access control strategy
- Checklists for security configurations
- Training materials on preventing cross-site scripting
- Guidelines for secure software component usage
- Monitoring logs and alerts for detecting security incidents
- Continuous training plans for developers on OWASP practices