---
id: 2790
title: "How to Catch the Top OWASP 2021 Security Category - Broken Access Control - in Code Review"
source_domain: hackerone.com
source_url: "https://www.hackerone.com/blog/how-catch-top-owasp-2021-security-category-broken-access-control-code-review"
published_at: "2022-01-03T00:00:00Z"
tags: ["access-control", "code-review", "web-security", "api-security", "idor", "owasp", "broken-access-control", "least-privilege", "parameter-tampering"]
phying_url: "https://phying.com/item/2790"
lang: en
---

# How to Catch the Top OWASP 2021 Security Category - Broken Access Control - in Code Review

## Summary

Part 1 of a series on catching broken access control in code review, explaining OWASP's top 2021 risk category and common forms from least-privilege violations to insecure direct object references.

## Intelligence Metadata

- **Sources:** hackerone.com
- **Published:** 2022-01-03T00:00:00Z
- **Original:** https://www.hackerone.com/blog/how-catch-top-owasp-2021-security-category-broken-access-control-code-review
- **Phying News:** https://phying.com/item/2790