Every security control shipped across the catalogue, mapped to the current OWASP Top 10.
Generated directly from each kit's security/checks.json,
so this page cannot drift from what the kits actually enforce.
Each cell counts controls in that kit mapped to that category. A dash means no control in this kit maps there — which is often correct: a static analysis pack has no session layer to harden.
Authorization gaps including IDOR/BOLA, tenant leakage, privilege escalation, and server-side request forgery (absorbed from A10:2021).
21 / 35 kits
14 kit(s) without a mapped control: agentic-langgraph-crewai, django-tailwind-postgresql, flask-htmx-sqlite, go-chi-templ-htmx, go-fiber-api, go-gin-postgresql, rag-langgraph-agentic, reverse-engineering-security …
Insecure defaults, permissive CORS, debug surfaces in production, over-privileged containers, and missing hardening headers.
31 / 35 kits
4 kit(s) without a mapped control: laravel-filament-postgresql, laravel-livewire-postgresql, laravel-mongodb, nextjs-approuter-supabase
Compromise of dependencies, build systems, package registries, and distribution infrastructure. Expanded from A06:2021 components.
27 / 35 kits
8 kit(s) without a mapped control: laravel-api-sanctum, laravel-mysql, rust-actix-postgresql, rust-axum-postgresql, rust-leptos-fullstack, rust-loco-sqlite, security-owasp-api, ts-hono-bun-sqlite
Weak or missing encryption in transit and at rest, poor key handling, and inadequate password hashing.
34 / 35 kits
1 kit(s) without a mapped control: security-owasp-api
SQL, NoSQL, command, template, and LDAP injection, plus cross-site scripting arising from untrusted input reaching an interpreter.
33 / 35 kits
2 kit(s) without a mapped control: go-fiber-api, security-passkeys-auth
Missing or ineffective control design: absent threat modelling, unbounded resource consumption, and missing rate limits.
31 / 35 kits
4 kit(s) without a mapped control: django-api-ninja, rag-fastapi-qdrant, reverse-engineering-security, security-devsecops-ci
Credential stuffing exposure, weak session lifecycle, missing MFA. Renamed from Identification and Authentication Failures.
17 / 35 kits
18 kit(s) without a mapped control: agentic-langgraph-crewai, flask-htmx-sqlite, go-chi-templ-htmx, go-fiber-api, go-gin-postgresql, laravel-mysql, python-litestar-postgresql, rag-fastapi-qdrant …
Unverified updates, insecure deserialization, and CI/CD pipelines that accept unsigned or unpinned artifacts.
17 / 35 kits
18 kit(s) without a mapped control: flask-htmx-sqlite, go-chi-templ-htmx, go-fiber-api, go-gin-postgresql, laravel-ai-features, laravel-filament-mysql, laravel-filament-postgresql, laravel-livewire-postgresql …
Insufficient audit trails, unmonitored security events, and logs that leak secrets or personal data. Renamed to emphasise alerting.
6 / 35 kits
29 kit(s) without a mapped control: agentic-langgraph-crewai, django-api-ninja, django-tailwind-postgresql, elixir-phoenix-liveview, go-gin-postgresql, laravel-ai-features, laravel-api-sanctum, laravel-filament-mysql …
Improper error handling, fail-open logic, verbose stack traces, and unhandled edge cases that degrade into insecure states.
21 / 35 kits
14 kit(s) without a mapped control: agentic-langgraph-crewai, django-tailwind-postgresql, elixir-phoenix-liveview, laravel-api-sanctum, laravel-filament-postgresql, laravel-livewire-postgresql, laravel-mongodb, mcp-tools-kit …
The same data as JSON, for agents and dashboards. Each kit manifest validates against kit-security-checks.schema.json.
curl -s https://techtalks.itsumarfarooq.com/security/coverage.json | jq '.categories[] | select(.id=="A01:2025")'
# Verify locally
python tools/validate_checks.py
python tools/build_security_matrix.py --check