OWASP Top 10 2021 Application Review

This page summarizes how Hygiara addresses the OWASP Top 10 2021 categories at an application-design level.

Scope

The review covers the Hygiara web app, REST API, authentication flows, organization scoping, queued review execution, and report-generation workflow.

Findings

A01 Broken Access Control

Hygiara scopes projects, reviews, findings, connections, API keys, and organization settings to the current organization. Organization membership and policies control user access.

A02 Cryptographic Failures

Azure client secrets and temporary access tokens are encrypted at rest through model casts. Production should continue to enforce TLS and secure cookie settings.

A03 Injection

Laravel validation, query builders, and resource serialization are used for normal request handling. User-controlled path-like inputs should continue to pass through explicit validation.

A04 Insecure Design

The product separates UI access, REST API keys, and MCP OAuth access. MCP is read-only, reducing risk when AI clients inspect review context.

A05 Security Misconfiguration

Production configuration should keep debug disabled, secure cookies enabled, and environment secrets outside source control.

A06 Vulnerable and Outdated Components

Composer and npm dependencies should be monitored and updated as part of normal maintenance.

A07 Identification and Authentication Failures

Hygiara supports password authentication, email verification, organization membership, and two-factor authentication.

A08 Software and Data Integrity Failures

Queued jobs and report generation rely on server-side code paths and scoped records. Deployment pipelines should continue to build from trusted source.

A09 Security Logging and Monitoring Failures

Application logs capture review execution, Azure access failures, and job failures. Production should route logs to central monitoring.

A10 Server-Side Request Forgery

Azure API calls target known Microsoft endpoints and review-controlled resource identifiers. Any future user-supplied URLs should be explicitly allowlisted.