VanaraVANARAagentsSubscribe — $10/mo
freeskillv2.0.0✓ verified

owasp-top10

A deep prevention reference for the OWASP Top 10 web risks — broken access control, injection, crypto failures, insecure design, SSRF and more — with vulnerable-vs-fixed code, edge cases, and a runnable naive-vulnerability scanner.

$npx vanara install owasp-top10

Free & open source (Apache-2.0) — view the source on GitHub.

Overview

Most real-world breaches exploit a short, well-known list of weaknesses. This package is the deep reference: each category gets its root cause, the default defense, and a vulnerable-vs-fixed example. Category deep-dives live in references/, side-by-side fixes in examples/, and a runnable heuristic scanner in scripts/.

What it covers

Details

Tier
Free
Version
2.0.0
Depth
4 references · 2 examples · 1 runnable scripts
Verification
1/1 runnable checks passing ✓
Runs on
Your own Claude Code — no API keys
api-paginationImplement correct, fast API pagination — cursor vs offset trade-offs, opaque cursor encoding, stable sort keys, page-size limits, total-count costs, and consumer-side iteration that survives inserts, deletes, and retries. With runnable cursor checks.app-store-optimizationHow to optimize an app-store listing (ASO) for discovery and conversion — title, subtitle, keywords, screenshots, icon, ratings, and the metadata that drives installs. A deep reference with worked Apple and Google listings and a runnable listing linter.audit-loggingDesign tamper-evident audit logs that satisfy security and compliance — what to record (who/what/when/where/outcome), what to never log (secrets/PII), structured immutable events, hash-chaining for tamper-evidence, retention, and access control. A deep reference with runnable validation.background-jobsDesign background job systems that don't lose or double work — enqueue-after-commit, retry policies with jitter, idempotent handlers, visibility timeouts, priority lanes, scheduled and recurring jobs, worker scaling, and observability for async work. With a runnable retry-policy check.backup-and-recoveryDesign and operate a tested backup and disaster-recovery strategy — the 3-2-1 rule, RPO/RTO targets, full vs incremental vs differential, point-in-time recovery, encryption, offsite/immutable copies, retention, and the restore drills that prove a backup actually works.c4-diagrammingDocument software architecture with the C4 model (Context, Container, Component, Code) as text-based diagrams in version control. Covers the four abstraction levels, notation discipline, when to draw each level (and when to stop), supplementary diagrams, and Mermaid/Structurizr tooling.
← All skills