OWASP Top 10

In short: The OWASP Top 10 is a regularly updated list of the ten most common and dangerous security risks in web applications. It is the standard entry point to secure development.

In more detail: OWASP (Open Worldwide Application Security Project) evaluates real vulnerability data. The list serves as a checklist for development, testing and audits. Behind it are recurring patterns of mistakes.

In Depth

• Broken access control: Users see or change other people’s data (for example changing an ID in the URL, IDOR).
• Cryptographic failures: Missing or weak encryption, plain-text passwords.
• Injection: SQL, command, template injection, XSS. Countermeasure: parameterised queries, output encoding.
• Insecure design: Missing security thinking already in the design.
• Security misconfiguration: Default passwords, open cloud buckets, debug mode.
• Vulnerable components: Outdated libraries, supply chain.
• Authentication failures: Weak passwords, missing MFA, session errors.
• Integrity/logging failures: Insecure updates, missing logs and alerts.
• SSRF: Server fetches internal addresses given by the attacker.
• In practice: Never trust input, least privilege, keep dependencies current, tests and code review.

See also: Threat modelling with STRIDE, Software supply chain and SBOM