The OWASP Top 10, Explained Without the Jargon
The OWASP Top 10 is the closest thing the web security world has to a shared vocabulary. If you build or break web applications, you need to know this list.
What OWASP actually is
OWASP (the Open Worldwide Application Security Project) is a nonprofit foundation that produces free, community-driven resources on application security. The Top 10 is their flagship awareness document — a periodically updated ranking of the most critical web application security risks, based on real-world data and expert consensus (OWASP Top 10:2021).
It's not a checklist you tick off once. It's a map of where things most commonly go wrong — useful whether you're writing code, reviewing it, or trying to break it.
The 2021 list, plain-English version
A01 — Broken Access Control
The most common issue in the list. This happens when an application doesn't properly enforce what a user is allowed to do — like letting a regular user view or edit another user's data just by changing an ID in a URL.
A02 — Cryptographic Failures
Sensitive data (passwords, financial info, personal data) gets exposed because it wasn't encrypted properly, was encrypted with weak or outdated algorithms, or was transmitted in plain text.
A03 — Injection
Untrusted input gets interpreted as code instead of data — classic examples are SQL injection and cross-site scripting (XSS). It's one of the oldest vulnerability classes and still shows up constantly.
A04 — Insecure Design
A flaw baked into the architecture itself, not just a coding bug. No amount of clean implementation fixes a design that never accounted for abuse cases in the first place.
A05 — Security Misconfiguration
Default credentials left in place, unnecessary features enabled, verbose error messages leaking internals, or missing security headers — small oversights that add up to real exposure.
A06 — Vulnerable and Outdated Components
Using libraries, frameworks, or dependencies with known vulnerabilities. If you don't track what's inside your own software supply chain, attackers will.
A07 — Identification and Authentication Failures
Weak password policies, missing multi-factor authentication, predictable session tokens, or flawed login logic that lets attackers impersonate legitimate users.
A08 — Software and Data Integrity Failures
Trusting data or code (plugins, updates, CI/CD pipelines, serialized objects) without verifying its integrity — opening the door to supply-chain style attacks.
A09 — Security Logging and Monitoring Failures
If a breach happens and nobody notices for months because logging was thin or nobody was watching, this is the category. Detection is half the battle.
A10 — Server-Side Request Forgery (SSRF)
An attacker tricks a server into making requests it shouldn't — often to internal systems that aren't meant to be reachable from the outside world.
Why this list matters either way
If you're building software, the Top 10 tells you where to focus your defensive effort. If you're testing software — bug bounty hunting, pentesting, or just curious — it tells you where to start looking. Either way, this isn't trivia. These ten categories account for the overwhelming majority of real-world web application breaches.
One honest note: OWASP updates this list periodically as the threat landscape shifts, so it's worth checking owasp.org/Top10 directly for the current edition rather than treating any single year's list as permanent gospel.