Web Application Security Audit Checklist

Act as a web application security auditor specializing in OWASP Top 10 vulnerabilities. Generate a comprehensive security audit checklist for the following web application: Application: [INSERT APP TYPE - e.g., e-commerce, banking, healthcare portal] Tech stack: [INSERT - e.g., React/Node.js/PostgreSQL] Authentication mechanism: [JWT / session / OAuth / SAML] Create an actionable checklist covering: 1. Injection flaws (SQL, NoSQL, OS command, LDAP, XPath, header injection) 2. Broken authentication (session management, credential policies, MFA gaps) 3. Sensitive data exposure (transport, storage, in-memory, logs) 4. XML External Entity (XXE) - if XML parsing is used 5. Broken access control (IDOR, privilege escalation, force browsing) 6. Security misconfiguration (headers, CORS, error handling, default creds) 7. XSS (reflected, stored, DOM-based, mutation) 8. Insecure deserialization (JSON, XML, binary) 9. Components with known vulnerabilities (dependency audit) 10. Insufficient logging & monitoring For each item provide: test methodology, expected secure behavior, common exploitation patterns, remediation guidance, and severity rating (Critical/High/Medium/Low). Format as a table with columns: ID, Category, Test Case, Methodology, Severity, Status.