OWASP Top Ten

The OWASP Top 10:2025 is the current awareness list of critical web application risks (2021 is superseded). It is not a full standard and not a 2024 list — there was no official “Top 10 2024.” Use it as a checklist of failure classes, then map each to how your app actually authenticates, queries, and ships.

The 2025 ten

1. A01 Broken Access Control — missing or wrong authorization. IDOR, privilege climb, CORS gone wide. SSRF is folded into A01 in 2025 (it was A10 in 2021). Fail closed; check this object, not just “is logged in.”
2. A02 Security Misconfiguration — moved up. Default creds, directory listing, verbose errors, cloud buckets public, missing security headers, debug left on.
3. A03 Software Supply Chain Failures — new emphasis. Compromised dependencies, unsigned artifacts, “we pip installed yesterday.” Pin, verify, and watch build identity — not only “npm audit once.”
4. A04 Cryptographic Failures — weak or missing crypto, custom crypto, secrets in repos, HTTP for sensitive data, bad key handling.
5. A05 Injection — SQL, OS, LDAP, template. Parameterize. XSS sits here as injection into HTML/JS as well.
6. A06 Insecure Design — no threat model: “we never thought an attacker would call this endpoint.” Patterns and reviews, not a library you install.
7. A07 Authentication Failures — stuffing, session fixation, missing MFA where it matters, home-grown JWT.
8. A08 Software or Data Integrity Failures — unsigned updates, insecure CI, deserialization of untrusted data, CI that publishes with a stolen token.
9. A09 Security Logging and Alerting Failures — you cannot detect the breach; logs have no user id, or they have passwords. Alerting is in the name now: a log nobody pages on is a diary.
10. A10 Mishandling of Exceptional Conditions — new. Crashes, catch-all handlers that return 200, resource leaks, error paths that skip authz. The unhappy path is still a path.

How to use this as a refresher

For each item: “where could this happen in our app, and what test or control would catch it?” A01 and A05 still pay the most in typical CRUD apps. A03 is the one teams skip because it lives in the pipeline, not the controller.

Pitfalls

• Memorizing the 2021 order and calling it current.
• WAF as the only control (it is not access control).
• Logging tokens “for support.”

Official list: OWASP Top 10:2025. Related: defensive programming, API authentication.