OWASP

OWASP is a nonprofit best known for the OWASP Top 10, a regularly updated list of the most common and serious security flaws in web applications, which has become the shared checklist for web security. Many of the classic entries share one root cause: the application lets user input be interpreted as code. In SQL injection, text typed into a form becomes part of a database query; in cross-site scripting, a comment becomes JavaScript running in other people’s browsers. The fixes follow the same idea: keep data and code separate, using parameterised queries and output escaping. The list also covers broken access control, which now tops it, weak authentication, misconfiguration and vulnerable dependencies.