The OWASP Top 10, explained for people who ship code
A developer-friendly walk through the OWASP Top 10 web application risks: what each one is, how it's exploited, and one concrete way to prevent it.
The OWASP Top 10 is the industry's shorthand for the most critical web application security risks. If you build web apps, it's worth knowing. Not to memorize, but to recognize the patterns in your own code. Here's each category in plain terms, with how it's exploited and one thing you can do about it.
A01: Broken Access Control
The number-one risk, and the one we exploit most often. It's when a user can act outside their intended permissions, reading another user's data by changing an ID (IDOR), or reaching an admin function they shouldn't. Prevent it: enforce authorization server-side on every request, based on the authenticated user, and never trust a client-supplied ID or a hidden field.
A02: Cryptographic Failures
Sensitive data exposed because it wasn't protected properly: missing encryption, weak algorithms, secrets in the wrong place. Prevent it: encrypt data in transit and at rest, use modern algorithms, and keep secrets out of code and config.
A03: Injection
Untrusted input interpreted as a command. SQL injection, command injection, and cross-site scripting (XSS) all live here. Prevent it: use parameterized queries, and encode output based on where it's rendered.
A04: Insecure Design
Flaws baked into the architecture, not the code: a missing control that no amount of clean implementation can fix. Prevent it: threat-model early; ask "how would an attacker abuse this flow?" before you build it.
A05: Security Misconfiguration
Default credentials, verbose error messages, unnecessary features enabled, missing security headers. Prevent it: harden by default, review configuration as part of deployment, and set a secure header baseline.
A06: Vulnerable and Outdated Components
Your app is only as secure as its dependencies. A known CVE in a library is an open door. Prevent it: track your dependencies, scan them continuously, and patch promptly.
A07: Identification and Authentication Failures
Weak passwords, broken session management, missing brute-force protection. Prevent it: enforce strong authentication, rate-limit login, and manage sessions securely.
A08: Software and Data Integrity Failures
Trusting code or data that could have been tampered with: insecure deserialization, unsigned updates, compromised CI/CD. Prevent it: verify integrity of what you deploy and consume.
A09: Security Logging and Monitoring Failures
You can't respond to what you can't see. Without logging, a breach goes unnoticed. Prevent it: log security-relevant events, monitor them, and alert on anomalies.
A10: Server-Side Request Forgery (SSRF)
An app can be tricked into making requests to internal systems on an attacker's behalf, which is increasingly dangerous in cloud environments. Prevent it: validate and restrict outbound requests, and segment internal services.
Key takeaways
- Broken access control is the most common, and most impactful, category we exploit.
- Most of the Top 10 comes down to not trusting input and enforcing controls server-side.
- Dependencies and configuration are as much a part of your attack surface as your own code.
Curious what these look like as real findings? See our sample pentest report. Several of the Top 10 show up in it, scored and explained.