Web app security review for Python and Node (OWASP Top 10 2021)

What it does

Reviews the source code of Python (Flask, Django, FastAPI) and Node (Express, Next.js API routes) web apps against the OWASP Top 10 (2021). The bundled scripts do the mechanical sweep; the agent verifies and judges.

• Route inventory (route_inventory.py): lists Flask, FastAPI, Django (urls.py plus views), DRF, Express and Next.js (pages/api and app/**/route.ts) routes with method, path, handler, file:line and hints for auth, CSRF exemption and rate limiting. Flags state-changing routes with no auth hint and similar review targets
• Risk pattern scan (sec_scan.py), about 30 rule types: SQL built by concatenation or f-strings, shell execution, eval, template injection, NoSQL operator injection, XSS sinks (|safe, dangerouslySetInnerHTML, innerHTML and more), path traversal, SSRF, pickle and yaml.load, open redirects, missing or disabled CSRF protection, cookies without Secure/HttpOnly/SameSite, CORS *, debug mode, weak random for tokens, MD5 and fast hashes for passwords, JWT without signature verification or alg none, hardcoded SECRET_KEY (masked), mass assignment, XXE
• A single-file taint heuristic checks whether request data reaches the sink and sets a confidence level (high/medium/low)
• Output as console text, JSON, a Markdown report draft and SARIF. Inline suppression comments and a baseline file for re-reviews
• Manual checklist per OWASP category (authorization and IDOR, insecure design, vulnerable components) plus framework quick checks
• Fix guides per rule with before/after code for Python and Node and the regression test to add
• Triage guide and report template: common false positives, common blind spots, severity rubric, findings report template, and a worked example with real output

How to use

python scripts/route_inventory.py path/to/app --md routes.md
python scripts/sec_scan.py path/to/app --json scan.json --md scan-draft.md --fail-on never

The agent checks each finding in the code (confirmed, likely, needs runtime check, false positive), walks the checklist for authorization and design issues, and writes a report with fix code. Works with Claude, Codex, Hermes Agent and Cursor.

Requirements

• Python 3 (standard library only). Read-only, no network access
• Dependency vulnerability checks need pip-audit or npm audit available separately (the review works without them)

Caveats

• Static pattern matching has false positives and false negatives. No findings is not proof of security
• Data-flow tracking is a simple single-file heuristic. Cross-file flows, broken authorization (IDOR) and business logic flaws are not found by the scripts and rely on the agent following the checklist
• Route auth status is inferred from names
• No live attack testing (penetration testing) is performed
• The sample app in examples/ is deliberately vulnerable; never deploy it