Access review
Login, sessions, password recovery, roles and routes: the security arm checks that access is denied by default and validated on every request.
Deliverable: access findings with their OWASP categoryOcto for application security · security arm
Every finding with its category. Every risk with an owner.
The OWASP Top 10 is in its 2025 edition, and broken access control is still at the top. The ASVS is at version 5.0.0, and the final version of the NIST SSDF is 1.1. Octo's security arm works at this step: it reviews login, password storage, sessions, password recovery, roles, routes without checks, exposed files and credentials in the code, and flags each finding with its OWASP category. Risk acceptance belongs to the tech lead, and the report is signed by a professional at the company.
ArmSecurityworks at this step
OWASPTop 10 2025A01: access control
Sources7listed at the end of the page
01
What Octo does in security.
Four possible deliverables. Octo does not issue reports or run penetration tests on your company's behalf.
Passwords stored the right way
Checks how passwords are stored against the OWASP recommendation: Argon2id with the minimum parameters, or bcrypt only in legacy systems.
Deliverable: finding with the reference recommendationSecrets out of the code
Looks for keys, passwords and tokens in the code and in versioned configuration, and proposes detection before commit.
Deliverable: list of exposed secrets to rotateFindings with category and requirement
Each finding comes with its OWASP Top 10 2025 category and the matching ASVS requirement, so the team prioritizes with the same yardstick.
Deliverable: findings report for the professional who signs
02
Eight arms, one verified attack surface.
The same Octo cycle, applied to this step. Each arm has a narrow role; your company's tech lead is in charge and approves.
-
Discovery
Maps the surface
Routes, forms, uploads and files served over the web.
-
Data
Finds the sensitive data
Where passwords, sessions and personal data are, and who can read them.
-
Security
Reviews access
Login, passwords, sessions, roles, routes without checks and credentials in the code.
-
Architecture
Plans the fix
Each finding becomes a task with a plan, or a risk accepted in writing.
-
Development
Fixes on the branch
The fix follows the approved plan, like any other task.
-
Review
Tests the simple attack
Least-privileged role and someone else's object, through the real path.
-
Release
Publishes with your OK
Security fixes also go to production only with the approval of whoever is in charge.
-
Documentation
Records the finding
What was found, what was fixed and which risk was accepted.
Octo flags issues and fixes them with a plan; accepting each unfixed risk, prioritizing, and deciding whether to report an incident are up to your company, and any security report or opinion is signed by a professional at the company.
03
The security yardsticks.
The references the security arm uses. The OWASP, NIST and ANPD publications remain the reference.
| Reference | What it says | Use in Octo |
|---|---|---|
| OWASP Top 10 2025 | A01 access control; A03 supply chain; A10 exceptional conditions | Category of each finding |
| OWASP ASVS 5.0.0 | Basis for testing web application technical security controls | Matching requirement |
| NIST SSDF 1.1 | Secure development practices (SP 800-218, February 2022) | Lifecycle practices |
| CD/ANPD Resolution 15/2024 | Incident reporting to the ANPD and data subjects within three business days | Data controller's decision |
04
From request to routine.
Three steps. Each one only makes sense once the previous one has shown results on your team.
A proposal, not a promise
Access review
The security arm reviews access in the system you already have, without changing anything.
- Login, passwords and sessions
- Roles and routes
- Secrets in the code
Fixes with a plan
Each finding becomes a task with a plan or a risk accepted in writing.
- Small, reviewed fixes
- Accepted risks on record
Security in every delivery
Every task that touches access goes through the security arm.
- Access review at delivery
- Secret detection before commit
05
Confirmed by source.
Each point below has a source published by the organization responsible for the standard, the specification or the tool, or in Brazilian federal law. The sources are in the next section.
8
points with a published source, each with its reference alongside.
- ConfirmedTop 10 2025
- The current version of the OWASP Top 10 is 2025, and the top risk is still broken access control (A01:2025).Source: OWASP, Top 10 2025
- ConfirmedNew categories
- The 2025 edition adds software supply chain failures (A03:2025) and mishandling of exceptional conditions (A10:2025).Source: OWASP, Top 10 2025
- ConfirmedASVS 5.0.0
- The ASVS is at version 5.0.0, released May 30, 2025, and is a basis for testing the technical security controls of web applications.Source: OWASP, ASVS
- ConfirmedDeny by default
- The application should deny access by default, and permissions should be properly validated on every request.Source: OWASP, Authorization Cheat Sheet
- ConfirmedPassword storage
- Use Argon2id with at least 19 MiB of memory, 2 iterations and a parallelism of 1; bcrypt only in legacy systems, with a work factor of 10 or more.Source: OWASP, Password Storage Cheat Sheet
- ConfirmedSecrets
- Prevent secrets from entering the code before the commit or PR, and rotate secrets frequently so a stolen credential is only valid for a short time.Source: OWASP, Secrets Management Cheat Sheet
- ConfirmedSSDF 1.1
- The final version of the NIST SSDF is 1.1, published in February 2022 as SP 800-218.Source: NIST, SP 800-218
- ConfirmedPersonal data incident
- The data controller must notify the ANPD and the data subjects within three business days.Source: ANPD, security incident
06
What Octo does and what stays with you.
Octo prepares everything, but does not sign. The document of record stays with whoever is accountable for it.
Octo prepares
Maps, plans, codes on the task branch, reviews with evidence and prepares the release: plans, code, reviews, security reports and the system dossier.
Deliverable: material ready for reviewYour team reviews
Whoever is in charge is the company's tech lead or senior developer: they approve the plan, review the PR and merge it. Nothing goes to production without their approval.
Step: approval by whoever is in chargeWho signs and is accountable
Octo does not sign and is not accountable for the system. The tech lead accepts the risk and is accountable for the system in production; a security report or opinion is signed by a professional at the company.
Accountable: the company's tech lead
07
Sources.
OWASP, NIST and Brazil's National Data Protection Authority (ANPD). Accessed October 31, 2026.
- OWASP: Top 10, 2025 editionThe ten web application risks
- OWASP: ASVS 5.0.0Version, date and use
- OWASP: Authorization Cheat SheetDeny by default and validate on every request
- OWASP: Password Storage Cheat SheetArgon2id and bcrypt
- OWASP: Secrets Management Cheat SheetDetection before commit and rotation
- NIST: SP 800-218, SSDF 1.1Final version, February 2022
- ANPD: security incidentReporting deadline
Every risk with an owner.
The assessment starts with an access review of the system you already have, without changing anything. You get the findings with their category and decide with them in hand.