Security audit checklist

OWASP Top 10 checks and STRIDE threat modeling

Each OWASP check item includes a corresponding tool command or code pattern; each STRIDE dimension has two concrete verification questions.

OWASP Top 10 check commands

# A01 Broken Access Control — check for missing authorization decorators
semgrep --config=p/owasp-top-ten src/

# A02 Cryptographic Failures — detect weak algorithms
bandit -r . -t B303,B304,B305,B413

# A03 Injection — SQL string concatenation
semgrep --pattern 'db.query("..." + $X)' --lang python src/

# A05 Security Misconfiguration — container image vulnerabilities
trivy image --severity HIGH,CRITICAL myapp:latest

# A06 Vulnerable Components — dependency scan
trivy fs --security-checks vuln .

# A07 Authentication Failures — weak password hashing
bandit -r . -t B303,B324

# A09 Insufficient Logging — missing audit log
grep -rn "except:" src/ | grep -v "log\."

Vulnerable vs Secure code comparison

// ❌ Dangerous: string-concatenated SQL (A03 Injection)
const sql = `SELECT * FROM users WHERE id = ${req.params.id}`;
db.query(sql);

// ✅ Secure: parameterized query
db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);

// ❌ Dangerous: MD5 password storage (A02 Cryptographic Failures)
const hash = crypto.createHash('md5').update(password).digest('hex');

// ✅ Secure: bcrypt with cost factor ≥ 12
const hash = await bcrypt.hash(password, 12);

STRIDE threat modeling — 6 dimensions

• Spoofing: Do service-to-service calls use mTLS or signed JWT? Are password-reset links bound to a one-time token?
• Tampering: Do DB writes verify resource ownership? Are webhook payloads verified with HMAC-SHA256?
• Repudiation: Do critical operations have immutable audit logs with user IDs? Are audit logs tamper-proof (no delete after write)?
• Information Disclosure: Do error responses expose stack traces or internal paths? Do list endpoints restrict results to authorized records?
• Denial of Service: Do expensive endpoints have rate limiting and timeouts? Do file uploads enforce size and type limits?
• Elevation of Privilege: IDOR: does the backend verify IDs cannot access other users' data? Are admin functions enforced at the DB layer with dedicated roles?

Finding severity and scan tool commands

Severity ties to release blocking and SLAs; keep definitions consistent within a repo and map them to OWASP or an internal risk matrix in the report.

# semgrep: custom rule scanning (can run in CI)
semgrep --config=p/security-audit \
        --config=p/secrets \
        --json -o report.json src/

# bandit: Python source code security scan
bandit -r src/ -f json -o bandit-report.json \
  -ll  # report medium and above only

# trivy: container image and filesystem scan
trivy image --severity HIGH,CRITICAL \
            --format json \
            --output trivy-report.json \
            myapp:$(git rev-parse --short HEAD)

# trivy: dependency vulnerabilities (sbom mode)
trivy fs --security-checks vuln,secret \
         --format cyclonedx \
         --output sbom.json .

Audit execution flow

  [ Confirm scope + threat-model entry ]
        │
        ▼
  ┌─────────────┐     Checklist: auth / input / data / integrations / ops
  │ Walk items  │──── Each row: status, evidence (path/config/commit), notes
  └─────────────┘
        │
        ▼
  ┌─────────────┐     Map severity; Critical/High mark blockers + SLA
  │ Roll up     │──── Owners: app / platform / compliance; link Finding IDs
  │  findings   │
  └─────────────┘
        │
        ▼
  ┌─────────────┐     Track to closure; log exception review dates
  │ Retest &    │──── Deliverables: audit summary + open findings
  │  closeout   │
  └─────────────┘

Audit report JSON template (Finding structure)

{
  "finding_id": "VV-SEC-API-0001",
  "severity": "High",
  "title": "GraphQL endpoint missing depth limit, vulnerable to DoS",
  "cwe": "CWE-400",
  "owasp": "A05:2021-Security Misconfiguration",
  "description": "POST /graphql accepts unbounded query nesting depth; an attacker can craft a 100-level deep query to exhaust CPU. No depthLimit set at src/graphql/server.ts:42.",
  "reproduction": "curl -X POST /graphql -d '{users{posts{comments{author{posts{...}}}}}}' triggers 100% CPU.",
  "recommendation": "Add graphql-depth-limit with maxDepth=7; also add query cost analysis.",
  "evidence": "src/graphql/server.ts:42, load test recording ./evidence/gql-dos.mp4",
  "responsible_domain": "application",
  "estimated_effort": "2h",
  "sla_days": 14,
  "status": "open"
}

Finding ID format

Stable IDs ease references across PRs, tickets, and retests. Format {PREFIX}-SEC-{AREA}-{4-digit-seq} (prefix and area are uppercase letters and digits only).