Last reviewed: 2026-08-16
This file defines what “comprehensive” means for this repository. The guides cover the listed baselines for HTTP and JSON APIs. A statement is normative only when it is tied to a cited specification using that specification’s requirement language. Otherwise it is labelled Project recommendation.
Included:
Not covered in depth:
| Area | Source | Status used here | Review note |
|---|---|---|---|
| OAuth 2.0 | RFC 6749 | RFC | Base authorization framework. Read with RFC 9700. |
| OAuth security | RFC 9700 | Best Current Practice | Current security baseline for OAuth 2.0 deployments. |
| OAuth 2.1 | draft-ietf-oauth-v2-1-15 | Active Internet-Draft, 2026-03-02 | Work in progress, not an RFC. Do not present draft text as a stable RFC requirement. |
| OAuth bearer tokens | RFC 6750 | RFC | Bearer-token transport and threat considerations. |
| PKCE | RFC 7636 | RFC | Authorization-code interception protection. |
| OpenID Connect | OpenID Connect Core 1.0 incorporating errata set 2 | OpenID Final Specification with errata | Standardized end-user authentication and ID Token validation. |
| SAML 2.0 | OASIS SAML 2.0 Technical Overview and conformance requirements | OASIS overview and standard | Browser SSO, assertions, profiles, and conformance. |
| JWT | RFC 7519 | RFC | Generic JWT claims are application and profile dependent. |
| JWT security | RFC 8725 | Best Current Practice | Algorithm verification, explicit typing, and cross-JWT confusion. |
| JWT access tokens | RFC 9068 | RFC profile | Defines required claims for conforming OAuth JWT access tokens. |
| Revocation | RFC 7009 | RFC | Token revocation endpoint. |
| Introspection | RFC 7662 | RFC | Active-state lookup for tokens. |
| Token exchange | RFC 8693 | RFC | Delegation and impersonation token exchange. |
| Client authentication | RFC 7523, RFC 8705 | RFCs | private_key_jwt, mutual-TLS client authentication, and certificate-bound tokens. |
| Resource indicators | RFC 8707 | RFC | Binds an authorization request to a target resource. |
| DPoP | RFC 9449 | RFC | Application-layer proof of possession. |
| HTTP message signatures | RFC 9421 | RFC | Standard canonicalization and signature fields. The guide’s HMAC snippet is illustrative and not an RFC 9421 wire example. |
| PAR | RFC 9126 | RFC | Pushed Authorization Requests. |
| Authorization server metadata | RFC 8414 | RFC | Authorization-server discovery metadata. |
| Protected resource metadata | RFC 9728 | RFC | Resource-server metadata and authorization-server locations. |
| FAPI 2.0 | FAPI 2.0 Security Profile | OpenID Final Specification, 2025-02-22 | High-security OAuth 2.0 profile. |
| MCP authorization | MCP 2025-11-25 authorization | Versioned MCP specification | Authorization is optional; the HTTP authorization flow has explicit discovery, PKCE, resource, audience, and token-handling requirements. |
| CORS | WHATWG Fetch Standard, CORS protocol | Living Standard | Browser cross-origin request and credential behavior. |
| API deprecation | RFC 9745 and RFC 8594 | RFCs | Deprecation metadata and planned sunset signaling. |
| Baseline | Version | Coverage rule |
|---|---|---|
| OWASP API Security Top 10 | 2023 | Every API1 through API10 risk has an explicit control section or cross-reference. |
| OWASP Top 10 for LLM Applications | 2025 | API-boundary controls are mapped explicitly. Model training and governance topics are marked out of scope where applicable. |
| OWASP Top 10 for Agentic Applications | 2026 | Tool, identity, privilege, supply-chain, memory, and inter-agent controls are mapped explicitly. |
| Risk | Guide location | Coverage |
|---|---|---|
| API1 Broken Object Level Authorization | Authorization tab | Explicit |
| API2 Broken Authentication | Auth Mechanisms and JWT Security tabs | Explicit |
| API3 Broken Object Property Level Authorization | Authorization tab | Explicit |
| API4 Unrestricted Resource Consumption | Rate Limiting tab | Explicit |
| API5 Broken Function Level Authorization | Authorization tab | Explicit |
| API6 Unrestricted Access to Sensitive Business Flows | Authorization tab | Explicit |
| API7 Server Side Request Forgery | API Boundaries tab | Explicit |
| API8 Security Misconfiguration | Gateway Controls and CORS tabs | Explicit |
| API9 Improper Inventory Management | Versioning tab | Explicit |
| API10 Unsafe Consumption of APIs | API Boundaries tab | Explicit |
This mapping covers controls that can be enforced or tested at an API, retrieval, model, or tool boundary. It does not claim to replace model-development governance.
| Risk | Guide location | Coverage |
|---|---|---|
| LLM01 Prompt Injection | AI-Specific Threats, Prompt Injection card | Explicit |
| LLM02 Sensitive Information Disclosure | AI-Specific Threats, Sensitive Data in Model Context card | Explicit |
| LLM03 Supply Chain | AI-Specific Threats, AI Supply Chain, Retrieval, and Memory card | Explicit |
| LLM04 Data and Model Poisoning | AI-Specific Threats, AI Supply Chain, Retrieval, and Memory card | API-boundary subset |
| LLM05 Improper Output Handling | AI-Specific Threats, Prompt Injection and Agent Authority cards; API Boundaries, Request and Response Contracts card | Explicit |
| LLM06 Excessive Agency | AI-Specific Threats, Agent Authority and Tool Use card | Explicit |
| LLM07 System Prompt Leakage | AI-Specific Threats, Prompt Injection card | Explicit |
| LLM08 Vector and Embedding Weaknesses | AI-Specific Threats, AI Supply Chain, Retrieval, and Memory card | Explicit |
| LLM09 Misinformation | AI-Specific Threats, Agent Authority and Tool Use card | High-impact action subset |
| LLM10 Unbounded Consumption | Rate Limiting tab and Model Endpoint Abuse card | Explicit |
| Risk | Guide location | Coverage |
|---|---|---|
| ASI01 Agent Goal Hijack | AI-Specific Threats, Prompt Injection and Agent Authority cards | Explicit |
| ASI02 Tool Misuse and Exploitation | AI-Specific Threats, Agent Authority and Tool Use card | Explicit |
| ASI03 Identity and Privilege Abuse | JWT Security, Delegation and Identity Chains card; AI-Specific Threats, Agent Authority card | Explicit |
| ASI04 Agentic Supply Chain Vulnerabilities | AI-Specific Threats, AI Supply Chain, Retrieval, and Memory card | Explicit |
| ASI05 Unexpected Code Execution | API Boundaries, Request and Response Contracts card; AI-Specific Threats, Agent Authority card | Explicit |
| ASI06 Memory and Context Poisoning | AI-Specific Threats, AI Supply Chain, Retrieval, and Memory card | Explicit |
| ASI07 Insecure Inter-Agent Communication | JWT Security, Delegation and Identity Chains card; Auth Protocols, MCP HTTP Authorization card | Explicit |
| ASI08 Cascading Failures | Authorization, Sensitive Business Flows card; AI-Specific Threats, Agent Authority card | Explicit |
| ASI09 Human-Agent Trust Exploitation | AI-Specific Threats, Agent Authority and Tool Use card | High-impact action subset |
| ASI10 Rogue Agents | AI-Specific Threats, Agent Authority and Tool Use card | Explicit |