security-and-owasp
Secure coding standards based on the OWASP Top 10 2025, with anti-patterns, detection regexes, framework fixes and LLM security guidance.
- Kind
- Rules
- Works with
- GitHub Copilot
- Source
- Awesome Copilot @ d85f762d6e52
- Path
- instructions/security-and-owasp.instructions.md
- License
- MIT
- Jobs
- Guardrails, Review
InstallCopy it from the source repository, or sign in and let the assistant adapt it for your project.
# Security Standards Comprehensive security rules for web application development. Every anti-pattern includes a severity classification, detection method, OWASP 2025 reference, and corrective code examples. **Severity levels:** - **CRITICAL** — Exploitable vulnerability. Must be fixed before merge. - **IMPORTANT** — Significant risk. Should be fixed in the same sprint. - **SUGGESTION** — Defense-in-depth improvement. Plan for a future iteration. --- ## OWASP Top 10 — 2025 Quick Reference | # | Category | Key Mitigation | |---|----------|----------------| | A01 | Broken Access Control | Auth middleware on every endpoint, RBAC, ownership checks | | A02 | Security Misconfiguration | Security headers, no debug in prod, no default credentials | | A03 | Software Supply Chain Failures *(NEW)* | `npm audit`, lockfile integrity, SBOM, SLSA provenance | | A04 | Cryptographic Failures | Argon2id/bcrypt for passwords, TLS everywhere, no secrets in code | | A05 | Injection | Parameterized queries, input validation, no raw HTML with user input | | A06 | Insecure Design | Threat modeling, secure design patterns, abuse case testing | …