SaaS Security Audit - OWASP Top 10 & Multi-Tenant Isolation Review

Improved prompt:

title: Comprehensive SaaS Dashboard Security Audit - Knowledge-Anchored Backend Assessment
domain: backend
anchors:
- OWASP Top 10 (2021)
- OAuth 2.0 / OpenID Connect (OIDC)
- REST API Security Principles (Fielding)
- Security Misconfiguration (OWASP A05)

validation: PASS

role: Senior Application Security Engineer
- Specializes in web application penetration testing and secure code review
- Deep expertise in OWASP methodologies, Django/DRF security hardening, and SaaS multi-tenancy isolation patterns
- Proven experience auditing production SaaS applications

context:
application_type: Multi-tenant SaaS analytics dashboard
technology_stack:
frontend: Next.js App Router with React
backend: Django + Django Rest Framework (DRF)
database: PostgreSQL on Neon managed database service
deployment: Vercel (frontend) + Railway (backend)
authentication_mechanism: OAuth 2.0 / session-based with OIDC support
primary_functionality:
- Displays user metrics, revenue (MRR/ARR/ARPU), and usage statistics
- Each tenant must be strictly isolated and must only see their own data
- Real-time data aggregation from multiple sources

instructions:
1. OWASP Top 10 Systematic Audit
- Task:Thoroughly evaluate the application against the OWASP Top 10 (2021) categories
- Detail: Conduct a systematic review, addressing each category (A01 through A10) explicitly
- For each category, document findings and assign severity using the following scale:
- Critical: Breakdown of core application functionality or system-level compromise
- High: Significant data exposure or authorization bypass
- Medium: Non-compliance with industry best practices
- Low: Minor issues or informational findings
- Info: Non-severity items for awareness

2. Tenant Isolation Verification
- Task: Ensure tenant isolation at every layer per OWASP A01 (Broken Access Control)
- Detail:
a. Check that Django querysets are filtered by tenant at the model manager level, not at the view level
b. Confirm no cross-tenant data leakage is possible via API parameter manipulation (IDOR)
- Test with at least three concrete scenarios:
1. Attempt to access another tenant's data via direct API endpoint
2. Test for parameter tampering that could leak or modify tenant-specific data
3. Verify session hijacking cannot access sensitive data from another tenant
- Provide a pass/fail status for each component of the tenant isolation strategy

3. Authentication Flow Review
- Task: Evaluate the authentication flow against OAuth 2.0 and OIDC best practices
- Detail:
a. Verify PKCE (Proof Key for Code Exchange) is enforced for public clients
b. Confirm access tokens have an appropriate expiry of 15 minutes or less
c. Ensure refresh tokens have an expiry of 7 days or less and are rotated upon use
d. Validate that logout invalidates server-side sessions
- Include any deviations from the standard OAuth 2.0 flow and their implications

4. Django Deployment Hardening
- Task: Check Django deployment hardening per OWASP A05 (Security Misconfiguration)
- Detail:
a. Run the command `python manage.py check --deploy` and provide a pass/fail status for each check
b. Verify the following security settings are enabled:
- `DEBUG=False`
- `SECURE_SSL_REDIRECT=True`
- `SECURE_HSTS_SECONDS >= 31536000`
- `SESSION_COOKIE_SECURE=True`
- `CSRF_COOKIE_SECURE=True`
- `ALLOWED_HOSTS` is restrictive and does not include wildcard
c. Document any misconfigurations found and their potential impact

5. Input Validation and Injection Surfaces
- Task: Evaluate input validation and injection surfaces per OWASP A03 (Sensitive Data Exposure)
- Detail:
a. Check all DRF serializer fields have explicit validation and type enforcement
b. Ensure raw SQL queries use parameterized statements or ORM abstractions
c. Verify any user-supplied filter parameters are whitelisted and validated
d. Document any unvalidated inputs, unsanitized outputs, or unprotected sensitive data

6. Rate Limiting and Abuse Prevention
- Task: Review API rate limiting and abuse prevention mechanisms
- Detail:
a. Verify DRF throttling is configured per-user and per-endpoint
b. Check that authentication endpoints have stricter limits (e.g., 5 requests per minute)
c. Ensure expensive dashboard queries have query cost guards or pagination limits
- Provide examples of any rate limiting rules in place

7. Secrets Management
- Task: Assess secrets management practices
- Detail:
a. Verify no hardcoded credentials exist in the codebase
b. Confirm `.env` files are gitignored and do not contain secrets
c. Check that production secrets are injected via Railway/Vercel environment variables
d. Validate that API keys use scoped permissions and are rotated regularly
- Document any hardcoded secrets found and their potential exposure

constraints:
Required:
- Check every OWASP Top 10 (2021) category without omission
- Provide concrete test scenarios for tenant isolation verification
- Include severity rating and remediation recommendation for each finding
- Address Django deployment hardening checklist completely
Prohibited:
- Assuming security by obscurity is sufficient
- Skipping authentication/authorization checks on internal endpoints
Mandatory:
- Check for missing security headers (Content-Security-Policy, X-Frame-Options, Strict-Transport-Security)
- Verify tenant-specific data is encrypted at rest and in transit

output_format:
1. Executive Summary
- Write 2-3 concise sentences summarizing the overall security posture
- Include a high-level risk assessment and the most critical findings

2. Findings Table
- Use a markdown table with columns: "#", "OWASP Category", "Finding", "Severity", "Status"
- Ensure all findings are listed and assigned a severity level
- Include a status (Open/In Progress/Resolved) for each item

3. Detailed Findings
- For each issue, provide a detailed description, including:
- Description of the vulnerability or weakness
- Affected component (file/endpoint)
- Proof of concept or test scenario demonstrating the issue
- Remediation with concrete code examples and recommendations
- Organize findings by severity, with Critical/High findings prioritized

4. Deployment Checklist
- Provide a pass/fail status for each Django security setting
- Document any misconfigurations and their potential consequences

5. Recommended Next Steps
- Prioritize findings by severity and provide actionable steps
- Include a timeline for resolution and any dependencies
- Ensure the report can be acted upon by a solo developer without external tools

success_criteria:
- All 10 OWASP categories evaluated with explicit findings and severity ratings
- Tenant isolation verified with at least 3 concrete test scenarios per component
- Django deployment checklist has zero critical or high misconfigurations
- Every Critical/High finding has a detailed remediation with code-level examples
- Report is actionable and includes a clear roadmap for resolution
- The report enables a single developer to address the identified vulnerabilities