The OWASP Top 10 (2025)

The OWASP Top 10 is an awareness list of the most critical web application risks. The 2025 edition: A01 Broken Access Control (including SSRF), A02 Security Misconfiguration, A03 Software Supply Chain Failures, A04 Cryptographic Failures, A05 Injection, A06 Insecure Design, A07 Authentication Failures, A08 Software or Data Integrity Failures, A09 Security Logging and Alerting Failures, and A10 Mishandling of Exceptional Conditions. Use it to prioritize training, reviews and testing, and pair it with the OWASP ASVS for concrete requirements.

Developer checklist mapped to the Top 10
A01  every endpoint checks object-level authorization; deny by default
A02  hardened defaults, no debug in prod, security headers, least-privilege cloud IAM
A03  lockfiles, dependency/SBOM scanning, pinned CI actions, signed artifacts
A04  TLS everywhere, strong password hashing, no home-made crypto, secrets in a vault
A05  parameterized queries, output encoding, safe templating
A06  threat modeling for new features; abuse cases in requirements
A07  MFA, rate limiting, secure sessions and recovery
A08  verify updates/integrity; no unsafe deserialization
A09  security events logged and alerted
A10  fail closed; handle errors without leaking details or skipping checks

Common pitfalls

• Treating the Top 10 as a complete standard (use ASVS for verification).
• Focusing only on injection and ignoring access control.
• One-off security reviews instead of continuous practices.

Key points

• Awareness list, updated periodically (2025 edition)
• Broken access control is #1
• Use ASVS for detailed requirements

Further reading: OWASP Top 10