OWASP Top 10 (2025)

1. A01 Broken Access Control

   Access control enforcement, IDOR, privilege escalation, SSRF folded into access control and deny-by-default.

2. A02 Security Misconfiguration

   Insecure defaults, hardening gaps, verbose errors, cloud and framework misconfiguration.

3. A03 Software Supply Chain Failures

   Dependency and build-system compromise, vulnerable components, SBOMs and trusted distribution.

4. A04 Cryptographic Failures

   Weak algorithms, key management, TLS, hashing and protection of sensitive data at rest and in transit.

5. A05 Injection

   SQL, command, XSS and other injection flaws, parameterization and output encoding.

6. A06 Insecure Design

   Threat modeling, secure design patterns, business logic abuse cases and secure development lifecycle.

7. A07 Authentication Failures

   Credential stuffing, weak passwords, session management and multi-factor authentication.

8. A08 Software or Data Integrity Failures

   Unsigned code and data, insecure deserialization and CI/CD integrity verification.

9. A09 Security Logging and Alerting Failures

   Security event logging, alerting, monitoring, log integrity and incident detection.

10. A10 Mishandling of Exceptional Conditions

    Improper error handling, failing open, unchecked exceptions, resource exhaustion and abnormal state handling.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.