OWASP Top 10

OWASP's short list of major web application risk families, used to start security reviews and give teams a shared checklist.

the web security top ten listwhat security bugs should I check firstOWASP listweb app security checklistthe list everyone says to check before launchingmy client asked if we follow the OWASP thingOWASP top tenOWSAP top 10common website vulnerabilities list

See it

Live demo coming soon

What it is

The OWASP Top 10 is an awareness document that groups the most important web application security risk families into a short shared vocabulary. It gives teams a practical place to start conversations about access control, injection, insecure design, configuration, and the other broad failure patterns that repeatedly show up in real applications. In the 2021 edition, broken access control took the top slot as A01 and injection fell to A03, which is a fair signal of how much the ordering moves between revisions.

Reach for it when teaching a team, planning a first security review, or checking whether a delivery process covers the obvious classes of web risk. Use each category as a prompt for concrete questions about this application, then turn the answers into tests and engineering work. The category names are buckets, not individual bugs.

Ten headings are not a complete security standard or a compliance certificate. The list is deliberately broad, changes between editions, and cannot model your business logic, abuse cases, tenant boundaries, or unusual architecture. OWASP ASVS is the better anchor when you need detailed, testable application security requirements.

Ask AI for it

Audit this web application against the OWASP Top 10 and turn every category into evidence. For each category, list the routes, data flows, dependencies, and configuration that are in scope; the exact source files and controls inspected; one positive test showing the intended control works; and one negative test proving a forbidden action fails. Use OWASP ASVS 5.0 requirement IDs to make each recommendation testable. Do not mark a category complete because a scanner returned zero findings. Implement fixes for confirmed gaps, add the regression tests to CI, and finish with a table of pass, fail, not applicable, or unverified, with evidence and an owner for every non-pass result.

You might have meant

threat modelbroken access controlsql injectionxsssecure by default

Go deeper