The OWASP Top 10 is a regularly updated list, published by the Open Worldwide Application Security Project, of the ten most significant categories of web application security risk. It is a broad awareness standard used across the industry to prioritize what to defend against, covering areas like broken access control, injection, and cryptographic failures.
What it covers
The list groups risks into categories rather than single bugs. Recent editions lead with Broken Access Control, followed by Cryptographic Failures and Injection, and include Security Misconfiguration and Vulnerable Components. Each category is a family of related weaknesses, so a single finding usually maps to one of them.
How to use it
Treat it as a checklist of what to verify, not a scanner. It tells you the classes of problem worth checking for; you still need to look at your own code or run a scan to find where those classes actually appear in your app.
What this means for AI-generated code
The issues AI coding tools introduce most, hardcoded secrets, missing authorization, and injection, sit squarely in the top OWASP categories. That is why AI-built apps tend to fail in predictable, well-understood ways rather than exotic ones.
Common questions
What is the current OWASP Top 10?
The 2021 edition leads with: 1. Broken Access Control, 2. Cryptographic Failures, 3. Injection, 4. Insecure Design, 5. Security Misconfiguration, 6. Vulnerable and Outdated Components, 7. Identification and Authentication Failures, 8. Software and Data Integrity Failures, 9. Security Logging and Monitoring Failures, 10. Server-Side Request Forgery.
How do AI-built apps map to the OWASP Top 10?
AI tools hit the top of the list reliably. Broken Access Control (A01) — missing ownership checks on API routes. Cryptographic Failures (A02) — hardcoded secrets, weak token generation. Injection (A03) — SQL from string concatenation, command injection from shell interpolation. Security Misconfiguration (A05) — no security headers, disabled TLS verification, wildcard CORS.
Is the OWASP Top 10 a compliance requirement?
Not inherently, but it is referenced in several compliance frameworks. SOC 2 Type II audits often check that developers are aware of and defend against common vulnerability classes. PCI DSS requires covering the OWASP Top 10 as part of secure development. ISO 27001 recommends it. Most enterprise security questionnaires mention it.