What is OWASP Top 10?
The community-ranked list of the most critical web application risks, refreshed every few years from real breach data. Teams use it to prioritize injection, broken auth, and misconfiguration fixes first.
Example
A launch review walks a BYOB storefront down the list: checkout input for injection, session cookies for broken access control, edge redirects for misconfiguration, then dependency and secrets hygiene before publish.
What people get wrong
Treating the ranking as a compliance checkbox instead of a prioritization aid. Your threat model decides the order; the list only tells you where whole industries keep bleeding.
Frequently asked questions
How often does the list change?
Roughly every few years from survey and breach data. Track releases, but fix your own highest-risk findings first rather than waiting for a new edition.
Related terms
Cross-Site Scripting (XSS)
An injection flaw where attacker-supplied scripts execute in a victim’s browser, stealing sessions or defacing pages. Output-encoding, framework auto-escaping, and strong CSP turn most payloads inert.
SQL Injection
An attack that smuggles database commands through unsanitized input into application queries. Parameterized statements and least-privilege database roles keep hostile input as data, never executable code.
Secrets in Code
Credentials accidentally committed to repositories, chat logs, or client bundles where history preserves them forever. BYOB project secrets live in server environment, so agents request missing keys instead of pasting values.
Security Headers
HTTP response headers (CSP, HSTS, frame options) hardening a deployed site. Edge hosts should set sensible defaults; generated apps inherit them without per-project configuration.
Cross-Site Request Forgery (CSRF)
An attack that tricks a logged-in browser into submitting unwanted state-changing requests to a trusted site. SameSite cookies, anti-CSRF tokens, and origin checks break the forgery chain.
CSP Directives
The individual rules inside a Content Security Policy, such as script-src, object-src, and frame-ancestors. Each directive narrows one resource class, so auditing means reviewing directives one by one.