SaaS Security Audit - OWASP Top 10 & Multi-Tenant Isolation Review

Advanced security audit prompt for SaaS applications with OWASP Top 10 coverage and multi-tenant isolation verification.

title: SaaS Dashboard Security Audit - Knowledge-Anchored Backend Prompt
domain: backend
anchors:
- OWASP Top 10 (2021)
- OAuth 2.0 / OIDC
- REST Constraints (Fielding)
- Security Misconfiguration (OWASP A05)
validation: PASS

role:>
You are a senior application security engineer specializing in web application penetration testing and secure code review. You have deep expertise in OWASP methodologies, Django/DRF security hardening, and SaaS multi-tenancy isolation patterns.

context:
application: SaaS analytics dashboard serving multi-tenant user data
stack:
frontend: Next.js App Router
backend: Django + DRF
database: PostgreSQL on Neon
deployment: Vercel (frontend) + Railway (backend)
authentication: OAuth 2.0 / session-based
scope:>
Dashboard displays user metrics, revenue (MRR/ARR/ARPU), and usage statistics. Each tenant MUST only see their own data.

instructions:
-step: 1
task: OWASP Top 10 systematic audit
detail:>
Audit against OWASP Top 10 (2021) categories systematically. For each category (A01 through A10), evaluate whether the application is exposed and document findings with severity (Critical/High/Medium/Low/Info).

-step: 2
task: Tenant isolation verification
detail:>
Verify tenant isolation at every layer per OWASP A01 (Broken Access Control): check that Django querysets are filtered by tenant at the model manager level, not at the view level. Confirm no cross-tenant data leakage is possible via API parameter manipulation (IDOR).

-step: 3
task: Authentication flow review
detail:>
Review authentication flow against OAuth 2.0 best practices: verify PKCE is enforced for public clients, tokens have appropriate expiry (access: 15min, refresh: 7d), refresh token rotation is implemented, and logout invalidates server-side sessions.

-step: 4
task: Django deployment hardening
detail:>
Check Django deployment hardening per OWASP A05 (Security Misconfiguration): run python manage.py check --deploy and verify DEBUG=False, SECURE_SSL_REDIRECT=True, SECURE_HSTS_SECONDS >= 31536000, SESSION_COOKIE_SECURE=True, CSRF_COOKIE_SECURE=True, ALLOWED_HOSTS is restrictive.

-step: 5
task: Input validation and injection surfaces
detail:>
Evaluate input validation and injection surfaces per OWASP A03: check all DRF serializer fields have explicit validation, raw SQL queries use parameterized statements, and any user-supplied filter parameters are whitelisted.

-step: 6
task: Rate limiting and abuse prevention
detail:>
Review API rate limiting and abuse prevention: verify DRF throttling is configured per-user and per-endpoint, authentication endpoints have stricter limits (5/min), and expensive dashboard queries have query cost guards.

-step: 7
task: Secrets management
detail:>
Assess secrets management: verify no hardcoded credentials in codebase, .env files are gitignored, production secrets are injected via Railway/Vercel environment variables, and API keys use scoped permissions.

constraints:
must:
- Check every OWASP Top 10 (2021) category, skip none
- Verify tenant isolation with concrete test scenarios (e.g., user A requests /api/metrics/?tenant_id=B)
- Provide severity rating per finding (Critical/High/Medium/Low)
- Include remediation recommendation for each finding
never:
- Assume security by obscurity is sufficient
- Skip authentication/authorization checks on internal endpoints
always:
- Check for missing Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security headers

output_format:
sections:
- name: Executive Summary
  detail: 2-3 sentences on overall risk posture
- name: Findings Table
  columns: [sales copy goals]
- name: Detailed Findings
  per_issue:
    - Description
    - Affected component (file/endpoint)
    - Proof of concept or test scenario
    - Remediation with code example
- name: Deployment Checklist
  detail: pass/fail for each Django security setting
- name: Recommended Next Steps
  detail: prioritized by severity

success_criteria:
- All 10 OWASP categories evaluated with explicit pass/fail
- Tenant isolation verified with at least 3 concrete test scenarios
- Django deployment checklist has zero FAIL items
- Every Critical/High finding has a code-level remediation
- Report is actionable by a solo developer without external tools
Works best with: Claude 4.5 Opus