Overview
Use the OWASP Top 10 as the risk taxonomy behind this category, not as a one-time launch checklist. The 2025 edition is the eighth installment and the current one as of October 2026 (OWASP Top 10:2025). Against 2021 it adds Software Supply Chain Failures (A03, widened from “Vulnerable and Outdated Components”) and Mishandling of Exceptional Conditions (A10), folds Server-Side Request Forgery into A01, and moves Security Misconfiguration from #5 to #2. Each entry links to the page here with implementation guidance. LLM-specific risks have their own list: owasp-llm-top-10.
A01 Broken Access Control: enforce it in the data layer
Users reach data or actions outside their permission: another tenant’s rows, an admin route with no role check, an object ID that works for any logged-in user. SSRF now sits here too. Enforce authorization in the database so a missed application check cannot leak rows: supabase-rls and auth-sessions. SSRF prevention: python-security.
A02 Security Misconfiguration: deny by default
Default credentials, verbose errors, open ports, permissive CORS, and missing security headers. Enable only what a feature needs. Headers: cloudflare-security-headers; pre-launch sweep: pre-launch-checklist.
A03 Software Supply Chain Failures: audit what you did not write
The scope is dependencies, build systems, CI/CD, and third-party platforms. Pin versions, scan dependencies in CI, and verify provenance before adding a package (python-security).
A04 Cryptographic Failures: data exposed in transit or at rest
Plaintext transport, weak or homegrown algorithms, hardcoded keys, unencrypted secrets. Force HTTPS, never write your own primitive, and keep keys out of source control (secrets-and-env).
A05 Injection: parameterize everything
Untrusted input reaching an interpreter (SQL, shell, template engine, ORM raw queries) as code. Use parameterized queries and never concatenate SQL (python-security). The LLM analog is tracked separately (prompt-injection-defense, owasp-llm-top-10).
A06 Insecure Design: the flaw is the architecture
What remains after implementation bugs are fixed: a password reset with no rate limit, a checkout that trusts a client-supplied price, a multi-tenant schema with no tenant column. Threat-model before coding and enforce money- and access-related rules server-side (payments-stripe).
A07 Authentication Failures: sessions and credentials together
Weak session tokens, missing MFA, credential stuffing with no rate limit, session fixation. Cookie flags, rotation, and refresh-token reuse detection: auth-sessions.
A08 Software or Data Integrity Failures: verify before you trust
Unsigned updates, CI pipelines pulling unpinned dependencies, and deserializing untrusted data. Verify signatures on auto-updates and treat webhook payloads as untrusted until the HMAC checks out (webhooks).
A09 Security Logging and Alerting Failures: an attacker’s first request looks like their thousandth
Log authentication events, access-control failures, and validation failures, and alert on anomalous volume. Build this in before launch (pre-launch-checklist).
A10 Mishandling of Exceptional Conditions: fail closed
Improper error handling, logic errors on failure, and systems that fail open. A payment webhook that succeeds on a malformed payload, or an auth check that defaults to allowed on an exception, belong here. Any unhandled exception in an authorization or payment path must deny the action.