OWASP web security review

Created by CodeCraft LLC

Perform cross-stack security reviews of web apps, APIs, and mobile backends aligned with the OWASP Top 10 and ASVS

Product and technology names are trademarks of their respective owners, used only to identify what this skill covers. CodeCraft LLC is not affiliated with or endorsed by them.

by Jace (@jamick)v1.1.0 · updated 2026-10-16Report copyright infringement

Description

Perform cross-stack security reviews of web apps, APIs, and mobile backends aligned with the OWASP Top 10 and ASVS — broken access control and IDOR, security misconfiguration, supply-chain risks, cryptographic failures, injection (SQL, command, XSS, template), insecure design, authentication and session flaws, data integrity (webhooks, deserialization, CI), logging and alerting, exceptional-condition handling, SSRF, open redirects, file uploads, rate limiting, CSP and security headers, and secrets management. Use whenever the user asks for a security review, audit, pentest-style check, OWASP alignment, "is this secure", pre-launch hardening, or reviews auth, payments, uploads, or admin features — in any language or framework.

#security#owasp#web#review

Included with all-access

$15.00 value as a single download

AiSkillz is in preview: browse the catalogue now - skill downloads and subscriptions open soon.

All skills are included with the all-access subscription

Changelog

v1.1.0Oct 16, 2026Latest

Added

references/owasp-fix-patterns.md: code-level fix patterns for each OWASP Top 10 category - merged from the former owasp-top-10-web skill.
references/security-headers-and-cors.md: security headers and CORS (CSP rollout with nonces, HSTS, Permissions-Policy, credentialed CORS, cookie attributes) - merged from the former web-security-headers skill.

v1.0.2Oct 3, 2026

Changed

Checked against the official documentation (October 2026).
Confirmed the categories match the final OWASP Top 10:2025 and added the official A01-A10 numbering for citing findings.

v1.0.1Oct 3, 2026

Changed

Added a trademark notice to the README.

v1.0.0Oct 2, 2026

Added

First release.