OWASP Top 10 Pattern Recognition

Search for routes missing authorization middleware, direct object references without ownership checks, and admin endpoints lacking role verification. Grep for patterns like findById or req.params.id used without comparing resource ownership to the authenticated user.

Grep for string interpolation or concatenation in queries, such as f-strings in cursor.execute, template literals in db.query, or .raw() calls. Parameterized queries with placeholders are the safe pattern to confirm as the alternative.

Search for assignments like SECRET_KEY, JWT_SECRET, or ENCRYPTION_KEY followed by quoted string literals across source, env, and YAML files. Also check for weak hashing algorithms such as MD5 and SHA1 used for password storage.

Broken access control (A01) ranks first due to high payouts and prevalence, followed by injection (A03), authentication failures (A07), SSRF (A10), and cryptographic failures (A02) where hardcoded secrets offer quick wins.

No. Static pattern matching finds suspicious code but cannot confirm exploitability, and it misses runtime-only issues like misconfigured servers or logic flaws requiring user interaction. Combine it with dynamic testing and manual review for full coverage.