The OWASP Top 10 Explained for Developers

The OWASP Top 10 is a widely used awareness list of the most critical web application security risks, based on data from real applications. It's updated every few years; the 2025 edition reflects how modern apps are built, with supply chains and cloud configuration now near the top.

The list (2025 edition)

1. Broken Access Control - users can act outside their permissions: viewing others' data, changing IDs in URLs. Includes server-side request forgery (SSRF).
2. Security Misconfiguration - default settings, verbose errors, open cloud storage, missing headers.
3. Software Supply Chain Failures - vulnerable or malicious dependencies, compromised build pipelines.
4. Cryptographic Failures - sensitive data unencrypted, weak algorithms, poorly stored passwords.
5. Injection - SQL, NoSQL, OS command injection and cross-site scripting (XSS).
6. Insecure Design - missing security controls by design, such as no rate limit on password reset.
7. Authentication Failures - credential stuffing, weak session handling, missing MFA.
8. Software or Data Integrity Failures - trusting unsigned updates, unsafe deserialisation.
9. Security Logging and Alerting Failures - attacks happen unnoticed.
10. Mishandling of Exceptional Conditions - errors that fail open, leak details or leave the system in an unsafe state.

The habits that prevent most of it

• Deny by default: check authorisation on every request, for every resource, on the server.
• Never build queries or HTML by string concatenation: use parameterised queries and auto-escaping templates.
• Validate input at the boundary with a schema.
• Keep dependencies updated and scanned; commit lockfiles.
• Use proven libraries for auth, crypto and sessions instead of writing your own.
• Secure defaults: HTTPS everywhere, security headers, private-by-default storage.
• Log security events and alert on suspicious patterns.
• Fail closed: when something goes wrong, deny access rather than allow it.

The rest of this series covers the most common risks in detail, with vulnerable and fixed code side by side.