---
note type:
  - theory
date: 2026-06-03
done: true
---
This stands for Open Web Application Security Project. 

It is a non profit foundation which publishes the OWASP top 10, which is a standard document that identifies the most critical security risks to web applications.

Current edition: **OWASP Top 10:2025**

The 2025 list ranks risks as follows:

- **A01:2025 Broken Access Control**: Remains the #1 risk, covering unauthorized access and privilege escalation; includes [[Server-Side Request Forgery (SSRF)]]. 
- **A02:2025 Security Misconfiguration**: Moved up to #2, highlighting insecure defaults, exposed services, and inconsistent controls. 
- **A03:2025 Software Supply Chain Failures**: A new, expanded category (from "Vulnerable and Outdated Components") covering dependencies, CI/CD systems, and distribution infrastructure. 
- **A04:2025 Cryptographic Failures**: Covers insecure encryption, weak key management, and data exposure. 
- **A05:2025 Injection**: Includes SQL, OS, and template injection flaws. 
- **A06:2025 Insecure Design**: Focuses on architectural weaknesses and lack of threat modeling. 
- **A07:2025 Authentication Failures**: Covers weak login flows, session handling, and password policies. 
- **A08:2025 Software or Data Integrity Failures**: Addresses tampering with code, data, or CI/CD pipelines. 
- **A09:2025 Security Logging & Alerting Failures**: Highlights gaps in monitoring that allow attacks to go undetected. 
- **A10:2025 Mishandling of Exceptional Conditions**: A new category focusing on unsafe error handling and system resilience during failures.