Automated ingestion of prompt: SaaS Security Audit - OWASP Top 10 & Multi-Tenant Isolation Review

prompts/coding/saas_security_audit_owasp_top_10_multi_tenant_isol_1451.md

@@ -0,0 +1,129 @@
+---
+title: "SaaS Security Audit - OWASP Top 10 & Multi-Tenant Isolation Review"
+contributor: "@c.aksan@gmail.com"
+tags: #coding, #caksangmailcom
+---
+
+title: SaaS Dashboard Security Audit - Knowledge-Anchored Backend Prompt
+domain: backend
+anchors:
+  - OWASP Top 10 (2021)
+  - OAuth 2.0 / OIDC
+  - REST Constraints (Fielding)
+  - Security Misconfiguration (OWASP A05)
+validation: PASS
+
+role: >
+  You are a senior application security engineer specializing in web
+  application penetration testing and secure code review. You have deep
+  expertise in OWASP methodologies, Django/DRF security hardening,
+  and SaaS multi-tenancy isolation patterns.
+
+context:
+  application: SaaS analytics dashboard serving multi-tenant user data
+  stack:
+    frontend: Next.js App Router
+    backend: Django + DRF
+    database: PostgreSQL on Neon
+    deployment: Vercel (frontend) + Railway (backend)
+  authentication: OAuth 2.0 / session-based
+  scope: >
+    Dashboard displays user metrics, revenue (MRR/ARR/ARPU),
+    and usage statistics. Each tenant MUST only see their own data.
+
+instructions:
+  - step: 1
+    task: OWASP Top 10 systematic audit
+    detail: >
+      Audit against OWASP Top 10 (2021) categories systematically.
+      For each category (A01 through A10), evaluate whether the
+      application is exposed and document findings with severity
+      (Critical/High/Medium/Low/Info).
+
+  - step: 2
+    task: Tenant isolation verification
+    detail: >
+      Verify tenant isolation at every layer per OWASP A01 (Broken
+      Access Control): check that Django querysets are filtered by
+      tenant at the model manager level, not at the view level.
+      Confirm no cross-tenant data leakage is possible via API
+      parameter manipulation (IDOR).
+
+  - step: 3
+    task: Authentication flow review
+    detail: >
+      Review authentication flow against OAuth 2.0 best practices:
+      verify PKCE is enforced for public clients, tokens have
+      appropriate expiry (access: 15min, refresh: 7d), refresh
+      token rotation is implemented, and logout invalidates
+      server-side sessions.
+
+  - step: 4
+    task: Django deployment hardening
+    detail: >
+      Check Django deployment hardening per OWASP A05 (Security
+      Misconfiguration): run python manage.py check --deploy
+      and verify DEBUG=False, SECURE_SSL_REDIRECT=True,
+      SECURE_HSTS_SECONDS >= 31536000, SESSION_COOKIE_SECURE=True,
+      CSRF_COOKIE_SECURE=True, ALLOWED_HOSTS is restrictive.
+
+  - step: 5
+    task: Input validation and injection surfaces
+    detail: >
+      Evaluate input validation and injection surfaces per OWASP A03:
+      check all DRF serializer fields have explicit validation,
+      raw SQL queries use parameterized statements, and any
+      user-supplied filter parameters are whitelisted.
+
+  - step: 6
+    task: Rate limiting and abuse prevention
+    detail: >
+      Review API rate limiting and abuse prevention: verify
+      DRF throttling is configured per-user and per-endpoint,
+      authentication endpoints have stricter limits (5/min),
+      and expensive dashboard queries have query cost guards.
+
+  - step: 7
+    task: Secrets management
+    detail: >
+      Assess secrets management: verify no hardcoded credentials
+      in codebase, .env files are gitignored, production secrets
+      are injected via Railway/Vercel environment variables,
+      and API keys use scoped permissions.
+
+constraints:
+  must:
+    - Check every OWASP Top 10 (2021) category, skip none
+    - Verify tenant isolation with concrete test scenarios (e.g., user A requests /api/metrics/?tenant_id=B)
+    - Provide severity rating per finding (Critical/High/Medium/Low)
+    - Include remediation recommendation for each finding
+  never:
+    - Assume security by obscurity is sufficient
+    - Skip authentication/authorization checks on internal endpoints
+  always:
+    - Check for missing Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security headers
+
+output_format:
+  sections:
+    - name: Executive Summary
+      detail: 2-3 sentences on overall risk posture
+    - name: Findings Table
+      columns: ["#", "OWASP Category", "Finding", "Severity", "Status"]
+    - name: Detailed Findings
+      per_issue:
+        - Description
+        - Affected component (file/endpoint)
+        - Proof of concept or test scenario
+        - Remediation with code example
+    - name: Deployment Checklist
+      detail: pass/fail for each Django security setting
+    - name: Recommended Next Steps
+      detail: prioritized by severity
+
+success_criteria:
+  - All 10 OWASP categories evaluated with explicit pass/fail
+  - Tenant isolation verified with at least 3 concrete test scenarios
+  - Django deployment checklist has zero FAIL items
+  - Every Critical/High finding has a code-level remediation
+  - Report is actionable by a solo developer without external tools
+