Module Map by OWASP Number
Every OWL module maps directly to an OWASP Top 10 (2021) category, so the API you import matches the vocabulary your threat model already uses.
| # | OWASP Category | Core Module | Key Exports |
|---|---|---|---|
| A01 | Broken Access Control | a01-access-control | RBACManager, ACLManager, PermissionChecker |
| A02 | Cryptographic Failures | a02-crypto-integrity | CryptoManager, PBKDF2Adapter, Argon2Adapter, SecretPolicy |
| A03 | Injection | a03-injection-defense | InputSanitizer, InputValidator |
| A04 | Insecure Design | a04-insecure-design-guard | ThreatModelGuard, DesignChecklist |
| A05 | Security Misconfiguration | a05-security-misconfiguration | SecurityConfigManager, HardeningReporter |
| A06 | Vulnerable & Outdated Components | a06-vulnerable-components | DependencyRiskScanner, ComponentPolicy |
| A07 | Identification & Authentication Failures | a07-auth-session | AuthManager, TokenManager |
| A08 | Software & Data Integrity Failures | a08-data-integrity | CSRFTokenManager, HTTPClient |
| A09 | Security Logging & Monitoring Failures | a09-logging-monitoring | SecurityLogger, EventEmitter |
| A10 | Server-Side Request Forgery | a10-ssrf-defense | SSRFGuard, SafeFetcher |
Composition across categories
HTTPClient (A08) natively accepts an outboundRequestPolicy from SSRFGuard (A10), composing transport hardening and SSRF defense in a single client. See the A08 reference for the full example.
Simplified setup for A01/A07/A09
createOwlClient() builds the A01 (RBACManager/ACLManager), A07 (TokenManager/AuthManager), and A09 (EventEmitter/SecurityLogger) managers from one config object, and React's OwlProvider composes their four providers into one component. See React Adapter Setup or the A07 reference.
Every class and typed constant also has a matching React hook or provider in @owasp-webshield/react, documented alongside the core API on each category's reference page.