OWASP Top Ten
The ten most critical web application security risks, with the concrete failures behind each one and how to prevent them. The baseline every developer is assumed to know and many do not.
Guide
Other
OWASP
A few hours
Intermediate
Free
What it is
A regularly updated, evidence based list of the most serious categories of web application security risk, each with an explanation, examples of how it happens and specific prevention guidance.
Why every developer needs it, not just security people
Most vulnerabilities are introduced by ordinary developers doing ordinary work: a query built by string concatenation, an access check that runs on the client, a dependency nobody updated, a token logged in plain text. These are not exotic attacks, they are routine mistakes, and knowing the ten categories is enough to avoid most of them.
The one that catches the most people
Broken access control. Almost everyone gets authentication right and then checks authorisation in the wrong place, or not at all on one endpoint out of forty.
Best for: every developer who writes code that faces the internet.
Ready to start?
Opens on OWASP in a new tab.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Every session is free; a few slots open each week.
Follow along
New writing, resources and project ideas land here first.