Add security directory README for easy navigation

Co-authored-by: axellab <38169843+axellab@users.noreply.github.com>

Author: Copilot

security/README.md

@@ -0,0 +1,77 @@
+# Security Analysis Reports
+
+This directory contains security assessment reports for OWASP Juice Shop.
+
+## Available Reports
+
+### 📄 [PENTEST_CODE_REVIEW_2025-11-20.md](./reports/PENTEST_CODE_REVIEW_2025-11-20.md)
+
+**Comprehensive Black Hat Security Analysis**
+
+- **Date:** November 20, 2025
+- **Type:** Static Code Analysis / Pentesting Review
+- **Scope:** Complete application codebase (v17.3.0)
+- **Risk Level:** CRITICAL
+
+#### Quick Stats
+- **Total Vulnerabilities:** 15
+- **Critical:** 8 (SQLi, RCE, XXE, SSRF, Hardcoded Keys, Weak Crypto)
+- **High:** 3 (Path Traversal, IDOR, Business Logic)
+- **Medium:** 4 (CSRF, Info Disclosure, Rate Limiting, Open Redirect)
+
+#### Key Findings
+
+🔴 **Immediate Action Required:**
+1. SQL Injection in Login & Search
+2. Remote Code Execution in B2B endpoint
+3. Hardcoded JWT private keys
+4. MD5 password hashing
+5. XXE in file uploads
+
+🟠 **High Priority:**
+6. SSRF in profile image upload
+7. Path Traversal in ZIP processing
+8. Insecure direct object references
+
+#### Attack Chain Examples
+
+The report documents several critical attack chains:
+- **SQLi → Admin Access → RCE → Full Server Compromise**
+- **Hardcoded Keys → JWT Forgery → Unauthorized Access**
+- **SSRF → Cloud Metadata → Infrastructure Takeover**
+
+## Report Structure
+
+Each report follows this structure:
+
+1. **Executive Summary** - High-level overview and risk assessment
+2. **Methodology** - Analysis approach and scope
+3. **Detailed Findings** - Individual vulnerabilities with:
+   - Severity rating
+   - Code location
+   - Attack scenarios
+   - Impact analysis
+   - Remediation recommendations
+4. **Attack Chains** - Combined vulnerabilities for maximum impact
+5. **Recommendations** - Prioritized remediation roadmap
+6. **Annexes** - Tools, references, metrics
+
+## Usage
+
+These reports are intended for:
+- Security teams
+- Development teams
+- Security champions
+- Auditors and compliance
+
+## Notes
+
+⚠️ **Important:** OWASP Juice Shop is an intentionally vulnerable application designed for security training. The vulnerabilities documented here are deliberate educational examples.
+
+## Contact
+
+For questions about these reports or security concerns, contact the security team.
+
+---
+
+*Last Updated: 2025-11-20*