OWASP Top 10 — stopped before the first commit.

The OWASP Top 10 as a baseline

The OWASP Top 10 is the most widely referenced security standard for web application development. It's referenced by PCI-DSS, HIPAA security guidance, SOC 2 auditors, and enterprise security procurement requirements. Demonstrating OWASP Top 10 coverage is increasingly a table-stakes requirement.

Most OWASP Top 10 vulnerabilities are detectable in source code before they become runtime exploits. MergeGuide's detection rules identify the code patterns that create these vulnerabilities — catching them at the point of authorship, not after a penetration test.

All 10 categories covered

• A01 — Broken Access Control: detecting missing authorization checks and privilege escalation patterns
• A02 — Cryptographic Failures: detecting weak encryption and unencrypted sensitive data
• A03 — Injection: SQL, command, LDAP, and OS injection patterns
• A04 — Insecure Design: detecting missing security controls at design checkpoints
• A05 — Security Misconfiguration: debug mode, default credentials, missing headers
• A06 — Vulnerable and Outdated Components: detecting use of known-vulnerable patterns
• A07 — Identification and Authentication Failures: weak auth, hardcoded credentials
• A08 — Software and Data Integrity Failures: detecting unsafe deserialization
• A09 — Security Logging and Monitoring Failures: detecting missing audit logging
• A10 — Server-Side Request Forgery (SSRF): detecting SSRF-enabling code patterns