owasp-security-review

| # | Category | Key risk | Avg incidence |

| A01 | Broken Access Control | Unauthorized data access, privilege escalation, SSRF, CSRF | 3.74% | | A02 | Security Misconfiguration | Default creds, verbose errors, missing hardening, XXE | 3.00% | | A03 | Software Supply Chain Failures | Vulnerable/malicious dependencies, compromised build pipelines | 5.72% |

| A04 | Cryptographic Failures | Weak algorithms, hardcoded keys, missing encryption, weak hashing | 3.80% | | A05 | Injection | SQLi, XSS, command injection, LDAP/XPath/EL injection | 3.08% | | A06 | Insecure Design | Missing threat modeling, business logic flaws, insufficient controls | 1.86% |

根据 OWASP Top 10:2025（十大最关键的 Web 应用程序安全风险）审查代码和架构。在以下情况下使用：(1) 检查代码是否存在安全漏洞，(2) 根据 OWASP 类别审核功能或代码库，(3) 为已识别的漏洞提供修复指南，(4) 编写新代码并需要安全编码模式。触发器：“安全审查”、“OWASP 审核”、“检查漏洞”、“安全检查表”、“此代码安全吗”、“安全审查”、“修复漏洞”。 来源：jgamaraalv/ts-dev-kit。