OWASP Top 10 status
OWASP Top 10 status
Frameworks · OWASP · v2026.06 · Foundry’s posture against the OWASP Top 10 (2021) categories. Platform review completed 2026-02-21; findings are binding for new web app code. Last refreshed June 2026.
OWASP isn’t a certification; it’s an industry consensus on the most common, highest-impact web vulnerabilities. Foundry’s Secure SDLC policy binds new web app code to the Top 10. The platform-wide review of
conductor, marketing-website, pureethosmed-website, helen-project1, and ux completed 2026-02-21; the matrix below summarizes posture per category and links to the policies that operationalize it.Status Mitigated Mitigated (design-level) Tracked finding(s)
OWASP Top 10 (2021)
| ID | Category | Foundry posture | Policy | Status |
|---|---|---|---|---|
| A01 | Broken Access Control | RBAC enforced before any request reaches the FHIR store; clinic-scoped agents (Tier-3) cannot see other clinics’ data; sandboxed workers (Tier-4) cannot hold PHI. Authorization is checked at the API boundary, not the UI. Object-level authorization is reviewed during threat modeling. | Access control, SDLC | Mitigated (design-level) |
| A02 | Cryptographic Failures | TLS 1.2+ in transit; AES-256 at rest with optional CMEK; argon2id is the required hash where Foundry stores a password-bearing credential (Foundry is passwordless in practice); secrets in a managed broker, never in source. No PHI written to local disk, logs, or generated documents. | Data protection | Mitigated |
| A03 | Injection | FHIR-typed query layer with parameterized requests; React’s auto-escaping for the web surface; SSR templates use safe rendering; LLM prompt-injection mitigations are tracked separately under the LLM Top 10 (below). | SDLC | Mitigated |
| A04 | Insecure Design | Threat modeling required for new features; PHI boundary is enforced architecturally (only the clinical data plane holds PHI); tiered agent model encodes least privilege; the Beacon Layer is a designed redaction boundary, not an afterthought. | SDLC, Security arch | Mitigated (design-level) |
| A05 | Security Misconfiguration | Infrastructure as code (Terraform / Pulumi for AWS; Nix for host configuration); CIS-aligned baselines; default-deny network policies; production isolated by AWS account and IAM scope. Configuration drift is a tracked finding category. | CCM, Security arch | Mitigated |
| A06 | Vulnerable and Outdated Components | Dependency scanning on every PR; SHA-pinned GitHub Actions (no floating tags); production container images pinned to explicit version tags (content-digest pinning is a near-term roadmap item); npm dep upgrades honor the seven-day cooldown (--min-age 7); patching SLAs are defined by severity in the vulnerability policy. | Vuln mgmt | Mitigated |
| A07 | Identification and Authentication Failures | Doctor onboarding uses email magic links with short-lived, HttpOnly sessions; the production workforce IdP (a signature-verifying OIDC provider) is being selected under ADR-011. Phishing-resistant WebAuthn passkeys are the preferred MFA factor and are enforced today on the AWS root account. SMS one-time codes are prohibited for workforce (patient flows use email OTP where SMS would otherwise apply). Session timeouts are short on the operating platform. See NIST 800-63B mapping. | Access | Mitigated |
| A08 | Software and Data Integrity Failures | Signed git history; PR review required before merge; CI runs on locked-down runners; supply-chain pinning (SHA-pinned actions, version-tag-pinned containers); generated documentation in foundry-master-agent is byte-deterministic so unintended changes show up in diff review. | SDLC, CCM | Mitigated |
| A09 | Security Logging and Monitoring Failures | Centralized audit logging for FHIR access and authentication events; audit codes are machine-readable, never free-text PHI; six-year retention; detection rules cover authentication, privileged access, and FHIR access anomalies. | System audits, Threat | Tracked finding(s) |
| A10 | Server-Side Request Forgery (SSRF) | Outbound network egress is constrained on PHI-bearing service perimeters; URL/host allow-lists for user-supplied URLs where applicable; metadata endpoints (e.g., the AWS instance metadata service, IMDS) are not reachable from web-tier processes. | Security arch, SDLC | Mitigated |
How findings are tracked
OWASP-category findings from the February 2026 platform review and from ongoing engineering are tracked in the central risk register with severity, owner, and target date. Critical and high findings have SLAs defined in the vulnerability management policy. The Security Officer reviews open findings monthly; no finding is closed without a documented validation step. Findings that touch PHI-handling code or the PHI boundary are escalated to the Privacy Officer.
OWASP LLM Top 10 for AI surfaces
Beyond the classic Top 10, Foundry’s agentic surfaces, Atlas, Forge Agents, the operating platform’s AI features, are subject to LLM-specific risks. We track the OWASP Top 10 for LLM Applications as a companion list. Highlights below.
| Category | Foundry posture | Policy |
|---|---|---|
| LLM01 Prompt Injection | Trusted vs. untrusted content boundaries; tool-use scoping; Tier-4 Moltworkers run untrusted tool invocations in a sandboxed network with no PHI reach. | AI governance |
| LLM02 Sensitive Information Disclosure | Beacon Layer redacts PHI before physician-facing sanitized surfaces; agent worktrees and logs use machine-readable identifiers, not PHI content; system prompts treat PHI as restricted. | AI governance, Data protection |
| LLM05 Improper Output Handling | LLM output bound for execution or rendering is treated as untrusted; output schemas validate before any downstream tool call. | SDLC |
| LLM06 Excessive Agency | Agent tier (T0–T4) caps the scope of any single agent; PHI-eligible actions require explicit tier-3 scope; material decisions stay human-in-the-loop. | AI governance |
| LLM08 Vector and Embedding Weaknesses | Foundry’s “Vector Engine” is a deterministic routing/placement planner, not a vector search store; embeddings of PHI are not retained outside the FHIR boundary. | AI governance |
| LLM10 Unbounded Consumption | Rate limits, token budgets, and concurrency caps per agent tier; cost/usage monitoring on subprocessors. | Threat, AI governance |
OWASP CheatSheetSeries is indexed alongside Foundry project docs for in-house search via qmd query -c owasp "...". Engineers use it as a fast reference during threat modeling and code review.