🛡️ Security Engineering — OWASP Top 10 (2021) — Implementation & Testing Guide Demo

• **Backend / full-stack engineers** who want a practical checklist and copyable
• **Tech leads** running secure code review and threat modeling.
• **Security engineers / AppSec** onboarding teams to the Top 10 with real examples.
• **Candidates** preparing for security-focused interviews who want crisp,

# See an injection auth-bypass, then watch the fix resist it:
python3 examples/injection/vulnerable.py
python3 examples/injection/fixed.py

# IDOR + mass assignment, blocked in the fixed version:
python3 examples/access-control/vulnerable.py
python3 examples/access-control/fixed.py

# SSRF: which malicious targets get through, and how the guard blocks them:
python3 examples/ssrf/vulnerable.py
python3 examples/ssrf/fixed.py

# Cryptography: unsalted MD5 vs. salted scrypt + CSPRNG tokens:
python3 examples/crypto/vulnerable.py
python3 examples/crypto/fixed.py

# XSS (syntax-check or run the local demo server):
node --check examples/injection/fixed.js
node examples/injection/fixed.js      # serves http://127.0.0.1:8080/?q=hello

# Prove every fix holds:
python3 -m unittest discover -s tests -v

owasp-security-checklist/
├── README.md                         # This file
├── LICENSE                           # MIT
├── docs/
│   ├── A01-broken-access-control.md            # IDOR, mass assignment, deny-by-default
│   ├── A02-cryptographic-failures.md           # password hashing, KDFs, TLS, CSPRNG
│   ├── A03-injection.md                        # SQLi, command injection, XSS, NoSQL
│   ├── A04-insecure-design.md                  # threat modeling, abuse cases, patterns
│   ├── A05-security-misconfiguration.md        # headers, debug, CORS, XXE
│   ├── A06-vulnerable-and-outdated-components.md  # SBOM, SCA, patch policy
│   ├── A07-identification-and-authentication-failures.md  # sessions, MFA, passwords
│   ├── A08-software-and-data-integrity-failures.md        # deserialization, CI/CD, SRI
│   ├── A09-security-logging-and-monitoring-failures.md    # what to log, alerting, IR
│   ├── A10-server-side-request-forgery.md      # SSRF validation + egress defense
│   ├── secure-coding-quick-reference.md        # one-page use/avoid cheat sheet
│   └── remediation-checklist.md                # checklist + threat model + release gate
├── examples/
│   ├── injection/
│   │   ├── vulnerable.py / fixed.py            # SQL injection auth bypass (sqlite3)
│   │   └── vulnerable.js / fixed.js            # reflected XSS + CSP (Node http)
│   ├── access-control/
│   │   └── vulnerable.py / fixed.py            # IDOR + mass assignment
│   ├── ssrf/
│   │   └── vulnerable.py / fixed.py            # URL guard against metadata/internal
│   └── crypto/
│       └── vulnerable.py / fixed.py            # MD5 vs scrypt; random vs secrets
└── tests/
    └── test_examples.py              # unittest suite proving each fix holds