The OWASP Top 10 for web and the OWASP API Security Top 10 are the global references for the most common and dangerous software weaknesses. Here are the most important ones with a practical focus.
1. Broken access control
The most widespread weakness: a user changes an ID in the URL and reads another user's data (IDOR/BOLA).
// unsafe
GET /api/orders/1052
// safe: always check ownership on the server
$order = auth()->user()->orders()->findOrFail($id);2. Cryptographic failures
- All traffic over HTTPS only, with HSTS
- Store passwords with slow, salted algorithms such as bcrypt or Argon2
- Do not keep sensitive data you do not need
3. Injection
SQL injection, command injection and XSS are still common. Use parameterised queries, an ORM, escaped output and a Content Security Policy.
4. Insecure design
Some weaknesses cannot be fixed with better code because they are rooted in design — for example no limit on password-reset attempts. Do threat modelling before development.
5. Security misconfiguration
- Debug mode must be off in production.
- Configuration and environment files (such as
.env) must not be reachable from the web. - Set security headers (CSP, X-Frame-Options, X-Content-Type-Options).
- Remove default accounts and passwords.
6. Vulnerable and outdated components
Keep libraries and frameworks up to date and scan dependencies automatically for known vulnerabilities.
7. Authentication failures
- Multi-factor authentication for sensitive accounts
- Login rate limiting and temporary lockout
- Secure session handling: HttpOnly, Secure and SameSite cookies
API-specific risks
- Unrestricted resource consumption: without rate limiting an API is open to abuse and runaway cost.
- Mass assignment: accept only allowed fields from input.
- Excessive data exposure: responses should contain only the fields needed, not the whole record.
- Improper inventory management: find and retire old versions and test endpoints.
8. Insufficient logging and monitoring
Without proper logs a breach may go unnoticed for months. Log and monitor logins, permission changes and unusual errors.
Application security belongs inside the development lifecycle, not at its end.
