OWASP Audit — Source Code Security Review Perform a systematic security audit of application source code against the OWASP Top 10:2025. Every candidate is traced, then independently challenged, before it becomes a finding. Coverage is recorded per surface and trust boundary, so "clean" means someone actually read the code. Cross-references: - for a surface-driven pass over every API endpoint (shares the recon, verification, and orchestration references) - "Combined white-box + black-box mode" when you have both the source and a running instance you're authorized to test - to prove race condit…