OWASP Top 10, Explained for Developers Who Aren't Security Specialists

Most developers have heard of the OWASP Top 10 but couldn't name more than two or three items on it. Here's what actually matters, in plain language.

1. Broken Access Control

Users acting outside their intended permissions — like editing another user's data by changing an ID in a URL.

Fix: Always verify the requesting user owns or has permission for the resource, server-side, on every request.

2. Cryptographic Failures

Sensitive data (passwords, tokens, PII) stored or transmitted without proper encryption.

Fix: Use HTTPS everywhere, hash passwords with bcrypt/argon2 (never plain hashes like MD5), and encrypt sensitive data at rest.

3. Injection

Untrusted input executed as code — SQL injection is the classic example.

// Vulnerable
db.query(`SELECT * FROM users WHERE email = '${input}'`);
 
// Safe — parameterized query
db.query("SELECT * FROM users WHERE email = ?", [input]);

Fix: Always use parameterized queries or an ORM. Never string-concatenate user input into a query.

4. Insecure Design

Security flaws baked into the architecture itself, not fixable by patching code — e.g., a password reset flow with no rate limiting.

Fix: Threat-model sensitive flows during design, not after an incident.

5. Security Misconfiguration

Default credentials, verbose error messages leaking stack traces, unnecessary services exposed.

Fix: Disable debug mode in production, remove default accounts, and minimize the attack surface.

6. Vulnerable and Outdated Components

Using dependencies with known CVEs.

Fix: Run npm audit / pip-audit in CI, and keep dependencies patched on a schedule, not just reactively.

7. Identification and Authentication Failures

Weak session management, predictable tokens, no multi-factor authentication.

Fix: Use established auth libraries rather than rolling your own, enforce MFA for sensitive accounts, and rotate session tokens on privilege changes.

8. Software and Data Integrity Failures

Trusting unsigned updates or CI/CD pipelines without integrity checks — the root cause of many supply-chain attacks.

Fix: Verify package signatures, pin dependency versions, and restrict who can publish to your package registry.

9. Security Logging and Monitoring Failures

Breaches that go undetected for months because nothing was logged or alerted on.

Fix: Log authentication events and access-control failures, and alert on anomalies — don't just log everything and never look at it.

10. Server-Side Request Forgery (SSRF)

Tricking a server into making requests to internal resources on the attacker's behalf.

Fix: Validate and allowlist outbound request destinations; never let user input directly control a server-side fetch target.

The pattern across all ten

Nearly every item traces back to one root cause: trusting input or configuration that an attacker can influence. Validate at every boundary, and you'll have already mitigated most of this list.