Grade My Investments Technology Observatory
GMI · TECHNOLOGY OBSERVATORY // ALL SYSTEMS NOMINAL
ENGINEERED BY LEOPARD DATA

OWASP Compliance

How Grade My Investments addresses the OWASP Top 10 web application security risks across our entire platform.

OWASP Top 10 Overview

The OWASP Top 10 is the industry-standard awareness document for web application security. It represents a broad consensus about the most critical security risks to web applications. Grade My Investments' architecture is designed with these risks in mind from the ground up, applying mitigations at every layer of the platform — from the Blazor WASM frontends through the Azure Functions API to the MySQL database.

Below is our approach to each of the OWASP Top 10 (2021) categories and the specific measures Grade My Investments implements.

OWASP TOP 10 MITIGATIONS
rendering diagram…
flowchart LR
    subgraph RISKS[OWASP Top 10 Risk]
        A01[A01 Broken Access Control]
        A02[A02 Cryptographic Failures]
        A03[A03 Injection]
        A05[A05 Misconfiguration]
        A06[A06 Outdated Components]
        A07[A07 Auth Failures]
        A09[A09 Logging Gaps]
        A10[A10 SSRF]
    end
    subgraph MIT[GMI Mitigation]
        RBAC[OAuth 2.0 - RBAC<br/>Function Keys]
        ENC[TLS 1.3 - AES-256<br/>Azure Key Vault]
        EF[EF Core Params<br/>Blazor Output Encoding]
        IaC[Bicep IaC<br/>Security Headers]
        DEP[Dependabot<br/>dotnet list --vulnerable]
        MFA[Delegated Auth<br/>Google - Azure AD MFA]
        LOG[App Insights<br/>Log Analytics]
        VNET[VNet Integration<br/>API Allowlist]
    end
    A01 --> RBAC
    A02 --> ENC
    A03 --> EF
    A05 --> IaC
    A06 --> DEP
    A07 --> MFA
    A09 --> LOG
    A10 --> VNET
    classDef app fill:#1f2630,stroke:#C0894E,color:#F3EFE8;
    classDef svc fill:#241c14,stroke:#E2B583,color:#F3EFE8;
    classDef data fill:#22201a,stroke:#C0894E,color:#EBD3AE;
    classDef ext fill:#1b1f27,stroke:#5A616B,color:#C4C0B8;
    classDef sec fill:#1d2733,stroke:#5cc8e0,color:#eafaff;
    class A01,A02,A03,A05,A06,A07,A09,A10 sec
    class RBAC,ENC,EF,IaC,DEP,MFA,LOG,VNET app
How each OWASP Top 10 category maps to a concrete GMI mitigation.

A01: Broken Access Control

Critical

Access control enforces policy so that users cannot act outside of their intended permissions.

Grade My Investments Mitigations
  • OAuth 2.0 / OpenID Connect — Google OAuth for Client Web, Azure AD for Admin Web; no custom credential storage
  • Role-Based Access Control (RBAC) — Separate admin and client roles enforced at both the UI and API layers
  • Function Key Authentication — Azure Functions require valid function keys on every API request
  • Account-Scoped Data Access — Users can only access data belonging to their own account; enforced in the data access layer
  • Idle Session Timeout — Automatic logout after 60 minutes of inactivity with a 5-minute warning

A02: Cryptographic Failures

Critical

Failures related to cryptography which often lead to exposure of sensitive data.

Grade My Investments Mitigations
  • TLS 1.3 Everywhere — All communications are encrypted in transit via HTTPS
  • Azure-Managed AES-256 Encryption at Rest — Database and blob storage use Azure-managed server-side encryption (SSE)
  • Azure Key Vault — All secrets, connection strings, and API keys are stored in Azure Key Vault; never in source code
  • Azure MySQL Server-Side Encryption — Azure MySQL Flexible Server provides automatic AES-256 encryption at rest with Microsoft-managed keys
  • PKCE for Mobile Apps — The MAUI mobile app uses PKCE (Proof Key for Code Exchange) for all platforms; no client secrets are stored in application code
  • No Sensitive Data in URLs — Tokens and credentials are never passed via query strings

A03: Injection

Critical

Injection flaws such as SQL, NoSQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter.

Grade My Investments Mitigations
  • Entity Framework Core — Parameterized queries by default; no raw SQL concatenation
  • Stored Procedures — Database operations use parameterized stored procedures where raw SQL is needed
  • Blazor WASM Rendering — Blazor automatically encodes output to prevent XSS; no direct DOM manipulation
  • Input Validation — Server-side validation on all API endpoints before processing
  • Content Security Policy — CSP headers configured to prevent inline script execution

A04: Insecure Design

High

Risks related to design and architectural flaws, calling for more use of threat modeling and secure design patterns.

Grade My Investments Mitigations
  • Defense in Depth — Multi-layered security across network, application, and data tiers
  • Principle of Least Privilege — Each component only has access to the resources it needs
  • Separation of Concerns — Distinct Client Web and Admin Web applications with isolated authentication
  • Testable Architecture — Unit tests and integration tests validate security boundaries
  • Private Endpoints — Backend services are not exposed to the public internet

A05: Security Misconfiguration

High

Missing or incorrect security hardening, unnecessary features enabled, or default credentials left in place.

Grade My Investments Mitigations
  • Infrastructure as Code (Bicep) — All Azure resources are provisioned via Bicep templates, ensuring consistent and auditable configuration
  • CI/CD Pipeline Security — Automated deployments via GitHub Actions with no manual server configuration
  • Environment-Specific Configuration — Separate settings for development, staging, and production via Azure App Configuration
  • No Default Credentials — All access keys are generated uniquely per environment and stored in Key Vault
  • Security Headers — HSTS, X-Frame-Options, X-Content-Type-Options, and CSP headers are enforced

A06: Vulnerable and Outdated Components

High

Using components with known vulnerabilities that may undermine application defenses.

Grade My Investments Mitigations
  • NuGet Package Auditing — Automated vulnerability scanning of .NET dependencies during build
  • Dependabot Alerts — GitHub Dependabot monitors for known vulnerabilities in all dependencies
  • .NET 10 LTS — Built on a Long-Term Support framework version with regular security patches from Microsoft
  • Managed Azure Services — Azure PaaS services are patched and maintained by Microsoft
  • Minimal Dependencies — Only necessary third-party libraries are included to reduce attack surface

A07: Identification and Authentication Failures

High

Weaknesses in authentication mechanisms that may allow attackers to compromise passwords, keys, or session tokens.

Grade My Investments Mitigations
  • Delegated Authentication — Authentication is delegated entirely to Google (Client Web, MAUI) and Azure AD (Admin Web); Grade My Investments never handles raw passwords
  • Multi-Factor Authentication — MFA is enforced through the identity providers (Google and Azure AD)
  • PKCE on All Mobile Platforms — The MAUI app uses PKCE (Proof Key for Code Exchange) for iOS, Android, and Mac Catalyst; no OAuth client secrets are embedded in application binaries
  • Automatic Token Refresh — OAuth tokens are refreshed automatically without user intervention
  • Session Timeout — 60-minute idle timeout with automatic logout to prevent session hijacking on unattended devices
  • Secure Token Storage — Web apps store tokens in browser memory (not localStorage); mobile apps use platform SecureStorage

A08: Software and Data Integrity Failures

Medium

Failures to protect against integrity violations in software updates, critical data, and CI/CD pipelines.

Grade My Investments Mitigations
  • CI/CD Pipeline Integrity — GitHub Actions workflows run in isolated environments with pinned action versions
  • Source Control Protection — Branch protection rules require pull request reviews before merging to main
  • NuGet Package Verification — Packages are sourced from the official NuGet.org feed with signature verification
  • Subresource Integrity — CDN-hosted assets use version-pinned URLs to prevent tampering
  • Database Integrity — Foreign key constraints and stored procedures enforce data integrity at the database level

A09: Security Logging and Monitoring Failures

Medium

Insufficient logging, monitoring, and alerting that prevents detection of active breaches.

Grade My Investments Mitigations
  • Application Insights — Full telemetry, request tracing, and exception logging across all Azure Functions
  • Structured Logging — ILogger integration with configurable log levels per component
  • Azure Monitor Alerts — Automated alerting on anomalous request patterns, failures, and resource issues
  • Audit Trails — Key operations (report generation, account changes, payment events) are logged with timestamps and user context
  • Centralized Log Analytics — All logs are aggregated in Azure Log Analytics for correlation and investigation

A10: Server-Side Request Forgery (SSRF)

Medium

Flaws that allow an attacker to coerce the server-side application into making requests to an unintended location.

Grade My Investments Mitigations
  • No User-Controlled URLs — The API does not accept arbitrary URLs from user input for server-side fetching
  • Allowlisted External APIs — Outbound calls are restricted to known third-party services (Financial Modeling Prep, Stripe)
  • VNet Integration — Azure Functions run within a virtual network, limiting outbound network exposure
  • Network Security Groups — NSGs restrict traffic flow between Azure resources
OWASP Top 10 (2021)

Our compliance status across all categories:

  • A01: Broken Access Control
  • A02: Cryptographic Failures
  • A03: Injection
  • A04: Insecure Design
  • A05: Security Misconfiguration
  • A06: Vulnerable Components
  • A07: Authentication Failures
  • A08: Data Integrity Failures
  • A09: Logging & Monitoring
  • A10: SSRF
Security Architecture

Key architectural decisions that support OWASP compliance:

  • Blazor WASM — Automatic output encoding prevents XSS
  • Azure Functions — Serverless compute with managed patching
  • Entity Framework — Parameterized queries prevent SQL injection
  • Azure Key Vault — Centralized secret management
  • OAuth 2.0 — Delegated authentication, no password storage
Security Tooling

Tools and processes used to maintain compliance:

  • OWASP ZAP — Automated vulnerability scanning
  • Dependabot — Dependency vulnerability alerts
  • Static Analysis — Code analysis during CI builds
  • Application Insights — Runtime monitoring and alerting
  • Azure Sentinel — SIEM and threat detection
Related Pages