OWASP Top 10

What it means

The OWASP Top 10 lists ten categories of web application security risk, published by the Open Web Application Security Project, a non-profit, and revised every few years. The current edition is the 2025 list.

Each entry names a category rather than a single bug. Broken access control, which still sits at number one, covers a large family of failures that all reduce to the application not checking whether the person asking is allowed.

OWASP builds the list from data organisations contribute after testing real applications, together with a practitioner survey for risks the data cannot show yet.

Why it matters

Its main value is shared vocabulary. When a security report, an engineering team and a customer's questionnaire use the same ten names, the argument about categories stops and the conversation moves on to findings.

Read it as a floor. It describes common categories across many organisations, not the risks in your product. The flaws that hurt a specific business are often logic failures no generic list mentions: a discount applied twice, an approval step skipped, a refund larger than the payment.

How it shows up

You meet it in three places. In questionnaires, where a customer asks whether you test against it. In tooling, where findings carry the category they fall under. And in training, where it is the standard introduction for developers.

Use it as a coverage checklist rather than a definition of done. For each category, can you say how you test for it and when you last did? A category that keeps producing findings in your application is telling you something about your habits, not only about this release.