OWASP Top 10 Analysis Work a web application category-by-category so nothing is skipped. Checklist by Category (2021) A01 Broken Access Control - Test IDOR: swap identifiers (user IDs, UUIDs, filenames) between two test accounts - Verify server-side enforcement on every endpoint, not just UI hiding - Try HTTP method overrides, path traversal in IDs, mass assignment on profile updates - Check forced browsing to admin routes after logout/role downgrade A02 Cryptographic Failures - Confirm TLS 1.2+ only, HSTS present - Find plaintext protocols, hardcoded keys, weak hashes (MD5/SHA1) for password…