OWASP Top 10
OWASP's short list of major web application risk families, used to start security reviews and give teams a shared checklist.
See it
What it is
The OWASP Top 10 is an awareness document that groups the most important web application security risk families into a short shared vocabulary. It gives teams a practical place to start conversations about access control, injection, insecure design, configuration, and the other broad failure patterns that repeatedly show up in real applications. In the 2021 edition, broken access control took the top slot as A01 and injection fell to A03, which is a fair signal of how much the ordering moves between revisions.
Reach for it when teaching a team, planning a first security review, or checking whether a delivery process covers the obvious classes of web risk. Use each category as a prompt for concrete questions about this application, then turn the answers into tests and engineering work. The category names are buckets, not individual bugs.
Ten headings are not a complete security standard or a compliance certificate. The list is deliberately broad, changes between editions, and cannot model your business logic, abuse cases, tenant boundaries, or unusual architecture. OWASP ASVS is the better anchor when you need detailed, testable application security requirements.
Ask AI for it
Audit this web application against the OWASP Top 10 and turn every category into evidence. For each category, list the routes, data flows, dependencies, and configuration that are in scope; the exact source files and controls inspected; one positive test showing the intended control works; and one negative test proving a forbidden action fails. Use OWASP ASVS 5.0 requirement IDs to make each recommendation testable. Do not mark a category complete because a scanner returned zero findings. Implement fixes for confirmed gaps, add the regression tests to CI, and finish with a table of pass, fail, not applicable, or unverified, with evidence and an owner for every non-pass result.