The OWASP Top 10: A Developer's Guide to Web Security

The OWASP Top 10 is the industry's list of the most dangerous web vulnerabilities. Knowing it is the difference between shipping and shipping safely. Here's each one, with the fix.

1. Broken access control

The most common vulnerability: a user can reach another user's data by changing an ID.

// BAD — trusts the client-supplied id
app.get("/invoice/:id", (req, res) => {
  db.invoices.find(req.params.id).then(send);   // any id works
});

// GOOD — scope to the authenticated user
app.get("/invoice/:id", auth, (req, res) => {
  db.invoices.find({ id: req.params.id, owner: req.user.id }).then(send);
});

2–4. Injection, broken auth, broken object refs

# BAD — string-built SQL (SQL injection)
q = f"SELECT * FROM users WHERE name = '{name}'"

# GOOD — parameterised query
cursor.execute("SELECT * FROM users WHERE name = %s", (name,))

Use parameterised queries everywhere, hash passwords with a slow function (bcrypt/argon2), and never trust an object reference from the client.

5–7. Misconfig, XSS, insecure deserialisation

// BAD — renders user input as HTML (XSS)
<div>{userInput}</div>

// React escapes by default, but beware dangerouslySetInnerHTML
<div dangerouslySetInnerHTML={{ __html: userInput }} />  // audit this

The checklist

1. Authenticate and authorise on the server, never the client.
2. Parameterise all queries; validate and escape all input.
3. Use HTTPS everywhere; set security headers.
4. Hash passwords; enforce MFA for privileged accounts.
5. Keep dependencies patched — run a scanner.
6. Log and monitor; know what normal looks like.
7. Deny by default; least privilege for every role.

Security isn't a feature you add at the end. Every one of these is a design decision made in the first week of a project.

We test the systems we build the way an attacker would, then close the gaps. This list is where that starts — know it cold.