Walk both OWASP lists against your own lab

short · 40 min · Objective 2.1

Task

Use the OWASP Top 10 for LLM Applications and the Machine Learning Security Top 10 as a working checklist against the lab you built in lesson 2. Record every entry as applicable or not, with a reason; turn each applicable entry into a test, a control and an owner; run the disclosure test for real; and list what the two lists did not ask about at all.

Steps

  1. Create lab/owasp-walk.csv with header list,id,name,applies,evidence,test,control,owner. Quote any field that contains a comma.
  2. Add one row per entry of the 2025 LLM list, LLM01 to LLM10, and one per entry of the ML list, ML01 to ML10: twenty rows. Set applies to yes or no. A no must carry its reason in evidence -- the lab has no fine-tuning, so ML07 Transfer Learning Attack may well be no, but your embedding model is a pre-trained component, so think before marking ML06 the same way.
  3. For every yes row, fill test with something you could run against the lab, control with what would reduce the risk, and owner with a role (in this lab you hold all of them, so name the role, such as platform or front end, not yourself).
  4. Run the LLM02 Sensitive Information Disclosure test through the gateway: as an ordinary user, ask three questions about pay or salary bands. Then count the responses in the log that contain the canary in either form, CANARY-7Q4X-SECAI or the [CANARY] that lesson 15's log writer leaves, and record the count in the LLM02 row's evidence as canary_hits=<n>.
  5. Check LLM07 System Prompt Leakage the way the lesson frames it: read your app's system prompt and template and record in evidence whether anything in it would matter if it leaked.
  6. Write lab/owasp-outside.md: at least three findings in your lab that neither list would have prompted, one per line starting - . Start with what the runner and gateway listen on, where any credential or configuration file sits and who can read it, and whether the VM's packages are up to date.

Verify

Run from ~/secai-lab, straight after the LLM02 probes.

python - <<'EOF'
import csv, json
rows = list(csv.DictReader(open("lab/owasp-walk.csv", newline="")))
want = {f"LLM{n:02d}" for n in range(1, 11)} | {f"ML{n:02d}" for n in range(1, 11)}
got = {r["id"] for r in rows}
print(len(rows), "rows; missing:", sorted(want - got) or "none")
print("applies not yes/no:", [r["id"] for r in rows if r["applies"] not in ("yes", "no")] or "none")
print("'no' with no reason:", [r["id"] for r in rows if r["applies"] == "no" and not r["evidence"].strip()] or "none")
print("'yes' missing test, control or owner:",
      [r["id"] for r in rows if r["applies"] == "yes" and not (r["test"].strip() and r["control"].strip() and r["owner"].strip())] or "none")
def leaked(text):
    return "CANARY-7Q4X-SECAI" in text or "[CANARY]" in text
hits = sum(leaked(json.loads(l).get("response") or "") for l in open("logs/gateway.jsonl") if l.strip())
llm02 = next((r["evidence"] for r in rows if r["id"] == "LLM02"), "")
print("log canary hits:", hits, "| recorded:", llm02)
print("PASS" if f"canary_hits={hits}" in llm02 else "FAIL: LLM02 evidence does not match the log")
EOF
grep -c '^- ' lab/owasp-outside.md

Twenty rows with nothing missing, every no explained, every yes carrying a test, a control and an owner, PASS on the canary count, and three or more outside-the-list findings. The count covers the whole log, so it is usually non-zero: lesson 2's build and lesson 5's lab both leaked the canary before lesson 5's retrieval filter went in. With that filter in place your three new probes add nothing to it, which is LLM02's control already working; lesson 11's lab hardens it.

Notes

The outside-the-list file is the point of the last section of the lesson. In a real review those plain findings -- an endpoint listening where it should not, a readable key, a missing patch -- are how AI systems are actually breached, and a scenario question will often offer a list entry as the distractor. Revisit your no rows when later labs add tools to the lab: lesson 12 gives it an agent, and LLM06 Excessive Agency stops being no that day.

This is an independent study companion for CompTIA SecAI+ CY0-001 and is not produced by or endorsed by CompTIA.