Topic guide
OWASP Top 10 coverage
Source and package versions
One AIWAF repository.
Python: py/aiwaf/ · Node.js: js/ · Rust/WASM: rust/ · Java: java/.
Source and canonical README.
Versions shown describe the source checkout; package releases are independent.
Current Python/Node source targets are aiwaf 1.1.8 (Python) and
aiwaf 1.1.5 (npm), with Rust/Python 0.2.7 and
WASM 0.2.5 and Java 1.3.5. Sandbox guides retain their separately pinned builds.
The OWASP Top 10:2025 describes broad application risks. The sandbox combines request observations, confirmed SQL outcomes, reference-application rules, TLS checks and dependency findings. Those are different kinds of evidence.
A passing scenario establishes only its tested outcome. It does not close an entire OWASP category. Evaluate each category against your application, deployment, and current dependency findings.
Category-by-category scope
| 2025 category | Implemented checks | Remaining scope |
|---|---|---|
| A01 Broken Access Control | Reference cross-user reads/writes, anonymous access, role spoofing, protected-field assignment and CSRF. | Production identity, ownership, tenant and egress/SSRF policies. AIWAF does not supply application authorization. |
| A02 Security Misconfiguration | Sensitive-file/debug exposure and security response headers on direct/protected fixtures. | Host/cloud configuration, CORS, cookies and complete deployment audits. |
| A03 Software Supply Chain Failures | Manifest/lock fingerprints, Python wheel hashes, pinned images, npm production audits, Grype JS/Python/Java/OS image scans. | High advisories remain; PHP, build provenance, signing, exploitability triage and resolved SBOM verification remain separate. |
| A04 Cryptographic Failures | Trusted TLS 1.2/1.3; rejection of old protocols, untrusted roots and wrong hostname; PBKDF2 passwords with independent salts. | At-rest encryption, production secrets/key management and application-wide cryptography. |
| A05 Injection | Two SQL login payloads per integration with token-issuance assertions and benign controls. Other SQL/XSS/XXE/command/LFI-shaped payloads are observations. | No blanket injection pass; browser execution, callbacks and additional backend side-effect assertions are needed for other exploit classes. |
| A06 Insecure Design | Negative quantity with no side effects, idempotent replay, conflicting payload under the same key and concurrent inventory budget. | Application-owned purchase/refund/workflow rules and resource budgets. |
| A07 Authentication Failures | Reference session rotation, expiry, logout/revocation; reset actor binding, expiry and single use; MFA requirement, actor binding and replay rejection. | Real identity/MFA/reset providers, delivery and production account/session policies. |
| A08 Software or Data Integrity Failures | Original signed reference data accepted; modified subject and forged signature rejected. | Package signatures, trusted updates, deserialization and other integrity boundaries. |
| A09 Security Logging and Alerting Failures | Exactly one correlated redacted failed-login event/alert; modified/truncated history rejected. | External SIEM delivery, persistent append-only storage and incident response. |
| A10 Mishandling of Exceptional Conditions | Generic injected exception plus recovery; isolated live Express Redis and shared upstream failures; Python cache regressions. | Every-runtime outages, production failover, rollback and resource cleanup under broader failures. |
What the reference fixture proves
The fixture is separate from Juice Shop. It uses two users, independently salted PBKDF2-SHA256 hashes with 600,000 iterations, random sessions, test-only reset/MFA controls, isolated inventory and HMAC-protected data. The Compose service starts securely; regression tests also use deliberately broken fixture modes to verify that assertions detect failures.
Each check validates response fields and side effects, not merely an HTTP denial. Per-run state is cleaned afterward; fixture signing keys/state are ephemeral. The default control credential is sandbox-assessment-only; AIWAF_ASSESSMENT_TOKEN overrides it for both Compose and runner. Tokens/passwords are excluded from reports. Reference rules demonstrate an assessment technique, not AIWAF implementations of identity/business policies.
Interpret supply-chain findings
Run assessment/scan_images.py to scan the fifteen non-PHP images with pinned Grype. Retain image IDs, advisory database metadata, package locations and scan timestamps with your results.
A03 image checks fail when high/critical matches exist. Review wont-fix, not-fixed and available fix versions without suppressing findings. Shared packages may produce repeated matches across images; a match count is not a count of distinct exploitable vulnerabilities. A clean npm audit can coexist with OS or other ecosystem findings.
Advisory matches require location and exploitability triage. Rebuilt images require matching scan evidence; an older scan does not certify a new image.
How to describe a result
Identify which scenarios passed, which findings remain, and which controls were not assessed. Avoid “OWASP certified,” “10/10 compliant,” or “all other OWASP categories closed.” Completion of the payload matrix establishes collection of observations without request errors, not universal exploit prevention.
See the validation workflow to generate evidence, and application testing to add assertions for your own security boundaries.