OWASP Top 10
Listed inInjection AttacksSecurityon
The industry baseline for web application risk — broken access control, injection, misconfiguration, and the rest, with mitigations.
External
OWASP · owasp.org#security
#checklist
The attacks that actually happen against ordinary applications, and the defaults that stop most of them before they start.
15 articles
Listed inInjection AttacksSecurityon
The industry baseline for web application risk — broken access control, injection, misconfiguration, and the rest, with mitigations.
Listed inSecure DefaultsSecurityon
Short, concrete guidance per topic: password storage, session management, CSP, deserialisation. The reference to check before you ship.
Listed inOAuth 2.0 and OIDCSecurityon
The community reference: which grant to use in 2026, why implicit is dead, and the current security best practice drafts.
Listed inThreat ModellingSecurityon
Working out what an attacker wants and where your trust boundaries are, before choosing controls.
Listed inInjection AttacksSecurityon
SQL, command, and template injection — one root cause and one class of fix: never concatenate.
Listed inTLS and Transport SecuritySecurityon
Certificates, chains of trust, HSTS, and what an expired cert does to every client at once.
Listed inOAuth 2.0 and OIDCSecurityon
The flows worth using, PKCE, token lifetimes, and what the ID token is actually for.
Listed inCryptography BasicsSecurityon
Hashing versus encryption versus signing, choosing a primitive, and never writing your own.
Listed inSecure DefaultsSecurityon
Making the safe path the easy path, so security does not depend on every developer remembering.
Listed inAuthorisationSecurityon
RBAC, ABAC, and enforcing access at the data layer rather than the route handler.
Listed inSecrets ManagementSecurityon
Environment variables, vaults, short-lived credentials, and a rotation plan you can actually execute.
Listed inPrivacy and Data HandlingSecurityon
Data minimisation, retention, PII in logs, and deletion that actually deletes.
Listed inAuthenticationSecurityon
Passwords, hashing with a slow KDF, MFA, magic links, and the session lifecycle around them.
Listed inXSS and CSRFSecurityon
Output encoding, content security policy, SameSite cookies, and where each defence still leaves a gap.
Listed inDependency and Supply Chain RiskSecurityon
Lockfiles, provenance, audit tooling, and the transitive dependency nobody has read.