OWASP Top 10
The Open Web Application Security Project (OWASP) Top 10 is a community-driven list of the most critical web application security risks. Refreshed every few years from real-world incident data.
The 2021 edition
- A01 — Broken Access Control. Users can act outside their permitted scope. Vertical (privilege escalation) and horizontal (accessing another user's data).
- A02 — Cryptographic Failures. Sensitive data exposed because it wasn't encrypted, was encrypted poorly, or because key management failed.
- A03 — Injection. Untrusted input is treated as code: SQL, NoSQL, OS commands, LDAP, ORM, XPath, expression languages.
- A04 — Insecure Design. Architectural flaws — missing threat modeling, ambiguous trust boundaries — that no amount of secure coding can fix later.
- A05 — Security Misconfiguration. Defaults left in place, verbose error pages, unused features enabled, missing security headers.
- A06 — Vulnerable and Outdated Components. Known CVEs in dependencies the application ships.
- A07 — Identification and Authentication Failures. Credential stuffing accepted, weak passwords allowed, predictable session IDs, broken MFA.
- A08 — Software and Data Integrity Failures. Untrusted updates, deserialization of untrusted data, CI/CD pipelines that can be hijacked.
- A09 — Security Logging and Monitoring Failures. Attacks not detected because no one is looking and nothing is logged.
- A10 — Server-Side Request Forgery. The server fetches a URL provided by the user and returns the result — exposing internal services.
How to use the list
The Top 10 is not a checklist. It is a starting point for security conversations and a way to align teams on a shared vocabulary. Pair it with a real threat model for your specific application, and follow the linked OWASP Cheat Sheet for each category.
i
The OWASP project also maintains the API Security Top 10 and Mobile Top 10, which overlap with — but aren't the same as — the web list.