The Consensus Map of What Breaks

The OWASP Top 10 is the community-voted list of the most critical web application risks, refreshed every few years (2021 being the current major edition). It is not a vulnerability scanner checklist — it is a map of risk areas, each broad enough to contain many specific flaws, and it is the standard vocabulary your team, auditors and test reports will use. Reading a few paragraphs on each entry turns "we audited security" into a grounded conversation.

A01: Broken Access Control

The list's most-reported entry: applications that fail to authorize as well as authenticate. A logged-in admin can read another user's account (/account/42 where 42 is user-controlled), a lower-tier user reaches an admin endpoint, or a GET deletes a resource. Fix with central authorization (per-object checks, RBAC/ABAC from the auth lesson), deny-by-default, and never trusting a client-supplied role. The dedicated IDOR lesson digs deeper.

A02 / A07: Authentication and Identity Failures

Weak login, missing MFA, credential stuffing exposed through no rate limiting, session IDs leaked in URLs or never invalidated, and "remember me" tokens stored insecurely. Fix with MFA where it matters, strict session management (HttpOnly, Secure, SameSite cookies; rotate on privilege change), rate limiting on login, and hashed password storage.

A03: Sensitive Data Exposure

Personal data, financial data, or session tokens unprotected at rest or in transit, or kept beyond necessity. Fix with encryption in transit (TLS 1.2+) and at rest, minimized collection, and strict key management — the encryption lesson's whole terrain.

A04: Insecure Design

The 2021 edition's shift toward design-level risk: business flows that are fundamentally flawed (rate limits bypassable by design, trust boundaries too wide, no threat modeling during design). Fix with threat modeling (the dedicated lesson), secure design reviews, and structural controls rather than spot-fixing incidents.

A05: Security Misconfiguration

Default credentials still active, verbose error pages leaking stack traces and versions, unnecessary features enabled, CORS wildcards, unpatched defaults. Fix by hardening: disable what you do not use, remove defaults, apply patches, and scan configs.

A06: Vulnerable and Outdated Components

The "left-pad" class of problem: running a framework, library or OS version with a known CVE. Fix by knowing your inventory (SBOM — the supply-chain lesson), monitoring advisories, and a patch cadence that treats dependency health as debt.

A08: Software and Data Integrity Failures

Trusting unpinned/unsigned dependencies, deserializing untrusted data, or building from unverified pipelines. Fix with signed artifacts, pinned hashes, secure CI/CD, and never deserializing attacker input.

A09: Security Logging and Monitoring Failures

The breach you cannot detect. Fix by logging events (logins, failures, privilege changes) defensible in a court case, with alerting wired (the incident-response lesson).

A10: Server-Side Request Forgery (SSRF)

A server that fetches attacker-chosen URLs becomes a proxy into its own internals — the dedicated SSRF lesson covers detection and defense in full.

The Top 10 is not a compliance kiosk; treat it as a shared checklist, map every entry to your stack, and let the ones you cannot answer immediately become your roadmap.