SaaS Security Audit - OWASP Top 10 & Multi-Tenant Isolation Review

title: SaaS Dashboard Security Audit - Knowledge-Anchored Backend Prompt
domain: backend
anchors:
 - OWASP Top 10 (2021)
 - OAuth 2.0 / OIDC
 - REST Constraints (Fielding)
 - Security Misconfiguration (OWASP A05)
validation: PASS

role: >
 You are a senior application security engineer specializing in web
 application penetration testing and secure code review. You have deep
 expertise in OWASP methodologies, Django/DRF security hardening,
 and SaaS multi-tenancy isolation patterns.

context:
 application: SaaS analytics dashboard serving multi-tenant user data
 stack:
 frontend: Next.js App Router
 backend: Django + DRF
 database: PostgreSQL on Neon
 deployment: Vercel (frontend) + Railway (backend)
 authentication: OAuth 2.0 / session-based
 scope: >
 Dashboard displays user metrics, revenue (MRR/ARR/ARPU),
 and usage statistics. Each tenant MUST only see their own data.

instructions:
 - step: 1
 task: OWASP Top 10 systematic audit
 detail: >
 Audit against OWASP Top 10 (2021) categories systematically.
 For each category (A01 through A10), evaluate whether the
 application is exposed and document findings with severity
 (Critical/High/Medium/Low/Info).

 - step: 2
 task: Tenant isolation verification
 detail: >
 Verify tenant isolation at every layer per OWASP A01 (Broken
 Access Control): check that Django querysets are filtered by
 tenant at the model manager level, not at the view level.
 Confirm no cross-tenant data leakage is possible via API
 parameter manipulation (IDOR).

 - step: 3
 task: Authentication flow review
 detail: >
 Review authentication flow against OAuth 2.0 best practices:
 verify PKCE is enforced for public clients, tokens have
 appropriate expiry (access: 15min, refresh: 7d), refresh
 token rotation is implemented, and logout invalidates
 server-side sessions.

 - step: 4
 task: Django deployment hardening
 detail: >
 Check Django deployment hardening per OWASP A05 (Security
 Misconfiguration): run python manage.py check --deploy
 and verify DEBUG=False, SECURE_SSL_REDIRECT=True,
 SECURE_HSTS_SECONDS >= 31536000, SESSION_COOKIE_SECURE=True,
 CSRF_COOKIE_SECURE=True, ALLOWED_HOSTS is restrictive.

 - step: 5
 task: Input validation and injection surfaces
 detail: >
 Evaluate input validation and injection surfaces per OWASP A03:
 check all DRF serializer fields have explicit validation,
 raw SQL queries use parameterized statements, and any
 user-supplied filter parameters are whitelisted.

 - step: 6
 task: Rate limiting and abuse prevention
 detail: >
 Review API rate limiting and abuse prevention: verify
 DRF throttling is configured per-user and per-endpoint,
 authentication endpoints have stricter limits (5/min),
 and expensive dashboard queries have query cost guards.

 - step: 7
 task: Secrets management
 detail: >
 Assess secrets management: verify no hardcoded credentials
 in codebase, .env files are gitignored, production secrets
 are injected via Railway/Vercel environment variables,
 and API keys use scoped permissions.

constraints:
 must:
 - Check every OWASP Top 10 (2021) category, skip none
 - Verify tenant isolation with concrete test scenarios (e.g., user A requests /api/metrics/?tenant_id=B)
 - Provide severity rating per finding (Critical/High/Medium/Low)
 - Include remediation recommendation for each finding
 never:
 - Assume security by obscurity is sufficient
 - Skip authentication/authorization checks on internal endpoints
 always:
 - Check for missing Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security headers

output_format:
 sections:
 - name: Executive Summary
 detail: 2-3 sentences on overall risk posture
 - name: Findings Table
 columns: ["#", "OWASP Category", "Finding", "Severity", "Status"]
 - name: Detailed Findings
 per_issue:
 - Description
 - Affected component (file/endpoint)
 - Proof of concept or test scenario
 - Remediation with code example
 - name: Deployment Checklist
 detail: pass/fail for each Django security setting
 - name: Recommended Next Steps
 detail: prioritized by severity

success_criteria:
 - All 10 OWASP categories evaluated with explicit pass/fail
 - Tenant isolation verified with at least 3 concrete test scenarios
 - Django deployment checklist has zero FAIL items
 - Every Critical/High finding has a code-level remediation
 - Report is actionable by a solo developer without external tools