code-review
Skill34k starsChanged 29 days agoCC-BY-SA-4.0View on GitHub
Rigorous review of OWASP Cheat Sheet Series pull requests across security correctness, practicality, link and source verification, duplication, and language. Use for any pull request that touches cheatsheets/ or cheatsheets_draft/, or that adds or changes external links or citations.
We split this skill into the rules it gives an agent
12 rules. 0 are common, 11 are distinctive, and 1 is very specific to this project.
0
Common
Most of the 184 edited versions we read keep these.
11
Distinctive
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
Licensed with conditions — read it at the source. We count its rules but don't quote them. Read them on GitHub.
“Common” is measured: kept by at least 6 in 10 of the 184 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Trending
More talk lately.about the whole repository
Who's talking about OWASP/CheatSheetSeries
- Michel Kartner“Créez votre IA Pentest 100% locale et sans censure (LM Studio + AnythingLLM)”YouTube · Jun 1, 2026 · 60k views
- Inside Cloud and Security“CCSP Exam Cram - DOMAIN 2 (2023)”YouTube · Feb 24, 2023 · 43k views
- Inside Cloud and Security“CCSP Exam Cram - DOMAIN 3 (2023)”YouTube · Mar 15, 2023 · 33k views
- Inside Cloud and Security“CCSP Exam Cram - DOMAIN 4 (2023)”YouTube · Mar 25, 2023 · 28k views
- Override“XXE Injection - Explained”YouTube · Apr 23, 2019 · 16k views
The biggest 5 of 65 mentions linking to the repository that our crawl found. Each line is their own headline.
See all 65
Talked about on GitHub, Stack Overflow, YouTube, Hacker News and the web (65 times).
On GitHub · 25
- Jun 12, 2019Sensitive information are being persisted in local storage — aws-amplify/amplify-js116 reactions · 70 comments
- Nov 24, 2025Implement Modern CSRF Protection — django/new-features59 reactions · 12 comments
- Aug 14, 2019[Security][CSRF] Added CSRF CookieStorageInterface — symfony/symfony16 reactions · 15 comments
- May 23, 2019Argon2 Support — bcgit/bc-csharp9 reactions · 2 comments
- Mar 25, 2021Stop telling people not to install security updates — docker/docs8 reactions · 2 comments
20 more on GitHub
- Apr 9, 2020X-XSS-Protection: header should be disabled by default — helmetjs/helmet8 reactions · 17 comments
- Aug 4, 20248.2.2 advice on sessionStorage breaks multi-tab web application use unlike cookies — OWASP/ASVS3 reactions · 40 comments
- Apr 13, 2021XSS protection should be set to 0 by default per updated OWASP recommendation — spring-projects/spring-security3 reactions · 3 comments
- Dec 12, 2018Weak password policy — PrestaShop/PrestaShop3 reactions · 3 comments
- Jul 7, 2025Initial JWT cookie Authentication — INTERSECT-SDK/registry-service2 reactions · 3 comments
- Mar 6, 2020Merge REST Assessment CS into WSTG — OWASP/wstg2 reactions · 16 comments
- May 21, 2019Should mention CORS — shieldfy/API-Security-Checklist2 reactions · 1 comment
- Apr 22, 2019Open Redirect in /authorize inside sample server — go-oauth2/oauth22 reactions · 2 comments
- Sep 10, 2026docs: fix dead link for csrf — envoyproxy/gateway1 reaction · 1 comment
- Jul 30, 2026Policy for AI contributions — OWASP/OCSD1 reaction
- Dec 10, 2019Test TLS server configuration — microsoft/CCF1 reaction · 2 comments
- May 13, 2019【面试篇】寒冬求职之你必须要懂的Web安全 — YvetteLau/Blog1 reaction
- Apr 22, 2019Client Secret, Refresh Token, Access Token are stored in plaintext — go-oauth2/oauth21 reaction · 3 comments
- Jun 14, 2025Plan de sécurisation — DiscoMajor/re-sources-relationnelles0 reactions
- Nov 9, 2021Security Cheat Sheet — ethinallen/ethinallen0 reactions
- Oct 26, 2021Secure the API — caizixian/goxidize0 reactions
- Feb 28, 2020Email & password reset — FoalTS/foal0 reactions · 2 comments
- Nov 6, 2019Add server-side validation for organization class — crchong1/senior_design_20190 reactions
- Apr 20, 2019Sanitize file upload form & input — bbenefield89/LegendsViewerBrowser-Client0 reactions
- Mar 8, 2019Add security section — messa/what-next0 reactions
On Stack Overflow · 21
- Mar 27, 2017Vuex store empty if i refresh my webpage16 votes
- Jan 21, 2020Options for token storage and refresh in SPAs7 votes · 1 answer
- Dec 22, 2019Why is auth0 recommending not to store tokens in localStorage?7 votes · 1 answer
- Apr 29, 2013Does HTML encoding prevent XSS security exploits?6 votes
- Mar 18, 2022How do I pass the JWT from the server to the client in a an http-header3 votes
16 more on Stack Overflow
- Jun 25, 2019Cookie is not set when secure option is enabled in rails session_store configuration?3 votes
- Mar 27, 2019Do I have to set XMLResolver to null for preventing XXE attacks?3 votes · 1 answer
- Nov 4, 2020Veracode XML External Entity Reference (XXE)2 votes
- Nov 14, 2019long-lived access token vs short-lived access token & refresh token pair2 votes
- Apr 25, 2019OWASP | ZAP | SQL Injection | Scan Report2 votes
- Aug 16, 2017How to secure a restful webapi core2 votes
- Feb 9, 2024Where does keycloak-js adapter store the refresh token and access token?1 vote
- Feb 9, 2024Keycloak redirects to login on page refresh1 vote
- May 18, 2023Create anchor link from location.pathname and sanitise data1 vote
- Jul 3, 2019Vulnerable when user clicks on a malicious link1 vote
- May 16, 2019How to add not valid pattern to Hibernate Validator?1 vote
- Apr 9, 2019OAuth with custom JWT authentication1 vote
- Aug 21, 2020Veracode Scan: jQuery html method showing Improper Neutralization of Script-Related HTML Tags in a Web Page issue0 votes
- Aug 17, 2019In EF of oracle, data type conversion occurs when SQL is generated by linq, which makes SQL more complex and less efficient0 votes
- May 23, 2019Checkmarx fix for CGI_Stored_XSS Vulnerability0 votes
- Mar 26, 2019How and where domain name is detected and resolved after SSL Pinning0 votes
On YouTube · 16
- Jun 1, 2026Créez votre IA Pentest 100% locale et sans censure (LM Studio + AnythingLLM) — Michel Kartnersays it tested it60k views · 84 comments
- Feb 24, 2023CCSP Exam Cram - DOMAIN 2 (2023) — Inside Cloud and Security43k views · 87 comments
- Mar 15, 2023CCSP Exam Cram - DOMAIN 3 (2023) — Inside Cloud and Security33k views · 42 comments
- Mar 25, 2023CCSP Exam Cram - DOMAIN 4 (2023) — Inside Cloud and Security28k views · 37 comments
- Apr 23, 2019XXE Injection - Explained — Override16k views · 7 comments
11 more on YouTube
- Mar 23, 2020Authentication in Node.js - #9 Session Timeout — Code Realm15k views · 38 comments
- May 16, 2019bWAPP - Cross-Site-Scripting - Reflected (JSON) - #2 — Anshuman Pattnaik11k views · 15 comments
- May 18, 2019bWAPP - Cross-Site-Scripting - Reflected (AJAX/JSON) - #3 — Anshuman Pattnaik7k views · 5 comments
- Mar 22, 2019Secure Coding: Hacking-Praxis - XSS-Angriffstechnik - So hackt man mit Cross-Site-Scripting — Bernhard Hirschmann3.4k views · 21 comments
- Nov 6, 2020OWASP Spotlight - Project 4 - Cheat Sheet Series — Vandana Verma1.3k views · 1 comment
- Aug 27, 2023How Mass Assignment Gives You Admin Privileges? | APIs | Code Examples | — Medusa1.3k views · 13 comments
- May 15, 2019XML External Entities (XXE) — Elyes Doudech151 views
- Sep 9, 2026같은 비밀번호 재사용이 위험한 진짜 이유 — 매일 한가지108 views · 1 comment
- May 15, 2019OWASP - A1 Injection — Wizka75 views
- Oct 7, 2026Introducing the OWASP Cheat Sheet Series — Dann Paker AI71 views
- Mar 19, 2019Época 01 S01E26 - Ubucons e mais Ubucons — Podcast Ubuntu Portugal11 views
On Hacker News · 2
- Oct 4, 2020CheatSheetSeries/Dotnet_security_cheat_sheet.md2 points
- Apr 23, 2019OWASP Cheatsheet Series V.22 points
On the web · 1
- Oct 29, 2026Welcome to the OWASP Cheat Sheet Series - Kitploit — kitploit.com
Other versions194 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 194
- mattpocock/skills★ 303ksame name
- TheAlgorithms/Python★ 226ksame name
- microsoft/vscode★ 194ksame name
- github/spec-kit★ 145ksame name
- ggml-org/llama.cpp★ 132ksame name
- shareAI-lab/analysis_claude_code★ 78ksame name
- shareAI-lab/learn-claude-code★ 78ksame name
- vectorize-io/hindsight★ 54ksame name
- dbeaver/dbeaver★ 52ksame name
- roboflow/supervision★ 51ksame name
184 more not listed
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
Used alongsideProjects with it also use add-new-model, azsdk-common-sdk-breaking-change and 10 more.
Other files people use alongside this one.
Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
PydanticSkilladd-new-model
Add support for a newly-released language or image generation model in pydantic-ai (e.g. openai:gpt-5.6, anthropic:claude-sonnet-5, openai:gpt-image-2). Use when a provider ships a new model id and you need to wire literals, profile flags, adapters, and tests to recognize it. Handles SDK-lag, gateway list conventions, capability probing, and direct image-model geometry.
Also in 9 projects that use this
Microsoft AzureSkillazsdk-common-sdk-breaking-change
Detect and mitigate SDK Breaking changes for an SDK package which is generated from TypeSpec. WHEN: "Detect SDK breaking changes for a service", "Detect SDK breaking changes for an SDK package", "Detect and mitigate SDK breaking changes for a service", "Detect and mitigate SDK breaking changes for an SDK package". INVOKES: skill: azsdk-common-generate-sdk-locally; MCP tools: azure-sdk-mcp:azsdk_customized_code_update, azure-sdk-mcp:azsdk_package_detect_breaking_change.
Also in 4 projects that use this
dzhngSkillaudit-choices
Audit the choices an implementing agent made, not its diff — a pure decision audit that traces the session's history into a choices ledger, changes no code, and never blocks an unsupervised run. Working code still embeds architecture the user never chose; surface it because future work inherits it. Use when the user wants to review the decisions the AI made on their behalf, before merging or committing AI-implemented work, when integrating a delegated subagent's pass, or when a fix "works" but might be a point fix.
Also in 4 projects that use this
ww-w-aiSkillbkend-auth
bkend.ai authentication guide. Signup, login, JWT tokens, sessions, role-based access control, and password management with bkend.ai BaaS. Triggers: bkend auth, bkend login, bkend signup, JWT, session, RBAC, password, bkend 인증, 로그인, 회원가입, bkend認証, ログイン, 新規登録, bkend认证, 登录, 注册, autenticacion bkend, authentification bkend, bkend-Auth Do NOT use for: data operations (use $bkend-data), file storage (use $bkend-storage).
Also in 4 projects that use this
ww-w-aiSkillbkend-cookbook
bkend.ai cookbook with step-by-step tutorials and example projects. Build a todo app, blog, e-commerce store, and more with bkend.ai BaaS. Triggers: bkend cookbook, bkend tutorial, bkend example, todo app, blog app, bkend 쿡북, bkend 튜토리얼, 예제 프로젝트, bkendクックブック, チュートリアル, bkend教程, 示例项目, tutorial bkend, tutoriel bkend, bkend-Tutorial, ricettario Do NOT use for: initial setup (use $bkend-quickstart), specific features (use $bkend-data/auth/storage).
Also in 4 projects that use this
dzhngSkillclose-spec
When a spec under specs/<feature>/ is done shipping (a write-spec build, or any planned task that produced a spec), archive it to specs/done/ and rewrite it from a build-plan into a durable rationale — the why, the principles, the invariants — pointing back to the real code for the how. Use when implementation has landed and the plan no longer matches what shipped, or the user says a feature/spec is finished. Pairs with [write-spec](../write-spec/SKILL.md) (the plan this closes) and [review](../review/SKILL.md) (run before closing).
Also in 4 projects that use this
- +5 more from ww-w-ai
- +1 more from dzhng
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
Reviews can't be read right now.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

