name: owasp-top-10
description: OWASP Top 10 Web Application Security Risks
category: security
rules:
  - "Validate and sanitize all user input server-side — never trust client-side validation alone"
  - "Use parameterized queries or prepared statements — never concatenate user input into SQL"
  - "Implement proper authentication with secure password hashing (bcrypt/argon2) and session management"
  - "Apply principle of least privilege — users and services should only access what they need"
  - "Never expose sensitive data in error messages, logs, or API responses"
  - "Use HTTPS everywhere — never transmit sensitive data over unencrypted connections"
  - "Validate Content-Type headers and reject unexpected content types"
  - "Implement rate limiting on authentication endpoints and sensitive operations"
  - "Keep dependencies updated and audit for known vulnerabilities regularly"
  - "Encode output contextually (HTML, URL, JavaScript) to prevent XSS"
  - "Use CSRF tokens for state-changing operations"
  - "Never store secrets, API keys, or credentials in source code or client-side storage"