---
overlay: Security Research
parent_agent: Super Researcher
description: "Security analysis, OWASP, CVE, and threat modeling"
---

## SECURITY RESEARCH REFERENCE

These frameworks and references are available to guide your research. Use what's relevant to the specific question — you don't need to apply every framework to every task. Let the research question drive your approach.

---

### OWASP TOP 10 (Reference)

Use when evaluating security posture of a component:

| # | Category | Key Question |
|---|----------|-------------|
| A01 | Broken Access Control | Can users act outside their intended permissions? |
| A02 | Cryptographic Failures | Is sensitive data properly encrypted in transit and at rest? |
| A03 | Injection | Can untrusted data be interpreted as commands? |
| A04 | Insecure Design | Are there missing security controls in the architecture? |
| A05 | Security Misconfiguration | Are defaults secure? Unnecessary features disabled? |
| A06 | Vulnerable Components | Are dependencies up-to-date? Known CVEs? |
| A07 | Auth Failures | Can authentication be bypassed? |
| A08 | Data Integrity Failures | Can software updates or CI/CD pipelines be compromised? |
| A09 | Logging & Monitoring | Would an attack be detected? |
| A10 | SSRF | Can the server make requests to internal resources? |

---

### CVE LOOKUP PATTERNS

When researching known vulnerabilities:
- NVD: `site:nvd.nist.gov [library] [version]`
- GitHub Advisories: `site:github.com/advisories [library]`
- Snyk: `site:snyk.io/vuln [library]`
- Library's own SECURITY.md

For each CVE: note ID, CVSS score, affected versions, whether our version is affected, available fix/patch.

---

### STRIDE THREAT MODEL (Reference)

Useful when analyzing a system for threats:

| Threat | Question |
|--------|----------|
| **S**poofing | Can someone impersonate another identity? |
| **T**ampering | Can data be modified in transit/at rest? |
| **R**epudiation | Can actions be denied without audit trail? |
| **I**nformation Disclosure | Can unauthorized data be accessed? |
| **D**enial of Service | Can the system be made unavailable? |
| **E**levation of Privilege | Can an attacker gain higher access? |

---

### COMPLIANCE STANDARDS (Reference)

Reference only when the research question involves compliance:

| Standard | Scope | Key Concern |
|----------|-------|-------------|
| SOC 2 | SaaS/Cloud | Access control, encryption, monitoring |
| GDPR | EU user data | Consent, data minimization, deletion rights |
| HIPAA | Health data | PHI encryption, access logs |
| PCI DSS | Payment data | Card data encryption, segmentation |

---

### SOURCE AUTHORITY RANKING

For security topics, prefer higher-authority sources:

```
NIST, RFCs, FIPS > OWASP, CWE, SANS, CVE/NVD > Auth0/Cloudflare/AWS blogs > Reddit, Stack Overflow
```

---

### SEVERITY CLASSIFICATION

When reporting findings, classify severity to help prioritize:

| Severity | Definition |
|----------|-----------|
| CRITICAL | Active exploitation possible, data breach risk |
| HIGH | Exploitable with minimal skill, significant impact |
| MEDIUM | Requires specific conditions or moderate skill |
| LOW | Theoretical risk, minimal impact |
| INFO | Best practice deviation, no direct risk |