What Is the OWASP Top 10?

Quick answer
The OWASP Top 10 is a consensus list of the most critical risks to web applications, updated every few years.
The current list is led by broken access control, cryptographic failures, and injection.
It is an awareness and prioritization tool, not a complete checklist of every vulnerability.

What is the OWASP Top 10?

The OWASP Top 10 is a regularly updated, community-consensus list of the ten most critical security risks to web applications, published by the Open Worldwide Application Security Project (OWASP). It draws on real-world breach and vulnerability data and is the closest thing the industry has to a shared vocabulary for web security. The most recent edition (2021) is the current reference.

The ten categories

A01 Broken Access Control — users can reach data or actions they shouldn’t.
A02 Cryptographic Failures — sensitive data exposed through weak or missing crypto.
A03 Injection — untrusted input interpreted as commands (SQL, OS, etc.).
A04 Insecure Design — flaws baked into the architecture, not just the code.
A05 Security Misconfiguration — defaults, exposed panels, missing headers.
A06 Vulnerable and Outdated Components — known-vulnerable dependencies.
A07 Identification and Authentication Failures — broken login/session handling.
A08 Software and Data Integrity Failures — unverified updates, deserialization.
A09 Security Logging and Monitoring Failures — attacks go undetected.
A10 Server-Side Request Forgery (SSRF) — the server fetches attacker-chosen URLs.

How to use it

Treat the Top 10 as a starting map, not a checklist you finish. Use it to prioritize: scan for the items on the list, fix the highest-impact findings first, and build awareness so developers and reviewers share the same vocabulary. Most security programs use it as their baseline before layering on specific standards.

Where this bites vibecoders
AI assistants regenerate these exact categories with remarkable consistency — the OWASP list reads like a catalog of what generated code gets wrong. The practical value for a vibecoder is as a review lens: after generating a feature, walk the list and ask whether broken access control, injection, or misconfiguration crept in. Nearly every other page on this site links back here as the shared reference.

Where AI coding assistants get this wrong

Generating CRUD endpoints with no per-object access checks (A01).
Building SQL from string concatenation instead of parameterized queries (A03).
Shipping default configurations and debug endpoints (A05).
Adding dependencies without checking for known vulnerabilities (A06).

Checklist

Use the Top 10 as a review lens on every feature, especially AI-generated ones.
Fix broken access control first — it’s the top category.
Parameterize all queries and validate all input.
Keep dependencies updated and scanned for CVEs.
Log security-relevant events and review them.

FAQ

Is the OWASP Top 10 a standard?

It’s a widely adopted reference rather than a formal compliance standard. Auditors and security teams reference it heavily, and many compliance frameworks borrow from it, but certification usually requires a specific standard like PCI DSS or ISO 27001.

How often is it updated?

Roughly every three to four years, based on new data. The 2017 and 2021 editions are the recent releases. Always cite the edition you’re using, since categories shift between versions.

Does the Top 10 cover APIs and LLMs?

OWASP publishes companion lists for specific domains: the API Security Top 10 and the Top 10 for LLM applications, plus the Non-Human Identity Top 10. See What Is Prompt Injection? and What Is the OWASP Non-Human Identity Top 10?.