The OWASP Top 10
When a security report says "A01" or "injection", everyone on the Tiffin team should picture the same kind of bug. The OWASP Top 10 gives teams that shared language. OWASP, the Open Worldwide Application Security Project, is a non-profit community, and every few years it publishes a list of the web risk categories it sees most often in real applications.
The rule
The Top 10 is a common vocabulary and a first checklist, not a finish line.
The list is built from data about real applications plus a survey of practitioners, and it is revised every few years, so names and rankings shift between editions. Categories that keep appearing near the top include:
- Broken access control: users reach data or actions that are not theirs.
- Injection: untrusted input is treated as a command, as in SQL injection or cross-site scripting.
- Security misconfiguration: default passwords, open storage, verbose error pages.
- Vulnerable and outdated components: libraries and images with known holes; the supply chain.
- Cryptographic failures: sensitive data sent or stored without proper protection.
- Authentication failures: weak login, session and password handling.
Two things the list is not. It is not a complete standard; a system can avoid all ten and still be insecure. And it is not a tool; it tells you what to look for, not how. For a thorough checklist, OWASP publishes a separate, much longer verification standard (ASVS).
The shortcut
Turn each category into a pipeline control with a two-step chain: finding → category → automated check.
Another customer's order
Changing
/orders/1043to/orders/1044shows someone else's lunch. Category: broken access control. Check: a test that requests another user's order and expects a refusal.
The mistake is treating the list as a compliance box: "we covered the ten". The list is where awareness starts. Your own threat model, which you will build later in this course, decides what matters most for Tiffin.
Drills
Answer fast — trust the rule.
A Tiffin user edits the ID in /orders/1043 and sees someone else's order. Which category is this?
A storage bucket holding Tiffin's invoices was left publicly readable by default. Which category fits best?
Which statement about the OWASP Top 10 is true?
Which pipeline control most directly addresses vulnerable and outdated components?
Remember
- The Top 10 is a shared vocabulary and a first checklist, not a finish line.
- Chain each finding to a category, then to an automated check.
- A threat model, not the list, decides what matters most for your system.