$ ls ~/owasp-top-10/2025
OWASP Top 10 (2025)
The ten most critical web application security risks, explained for developers - starting from how an attacker finds each one from outside.
Every page has the same five parts: why it happens (with JavaScript and C# code), how attackers spot it with OSINT, how it's abused, how to fix it, and which tools detect it.
Broken Access Control
The app checks who you are, but forgets to check what you are allowed to touch.
A02Security Misconfiguration
The code is fine. The server, framework or cloud settings around it are not.
A03Software Supply Chain Failures
The code you did not write - packages, images, actions - is most of what you ship.
A04Cryptographic Failures
Sensitive data is stored or sent without proper protection - or "protected" with something guessable.
A05Injection
User input gets treated as code - by the database, the browser, the shell or a template.
A06Insecure Design
The code does exactly what it was designed to do - and the design is the problem.
A07Authentication Failures
Weaknesses in how users log in, stay logged in, or recover their account.
A08Software or Data Integrity Failures
The app trusts code or data without checking that it has not been tampered with.
A09Security Logging & Alerting Failures
The attack happened. Nobody noticed - or the logs could not be trusted.
A10Mishandling of Exceptional Conditions
When something unexpected happens, the app leaks information, crashes, or fails open.
Category names and ranking are from the OWASP Top 10:2025 (CC BY-SA 4.0). Explanations and code on this site are my own. Payload examples are from PayloadsAllTheThings (MIT). See credits.