OWASP: Top 10 Web Application Security Risks

API security remains underprioritized as usage surges; the 2023 OWASP API Security Top 10 still leads with BOLA and broken authentication, and manual testing is needed where scanners fall short.

NetSPI vibe-coded a web app with AI coding tools and tested it for vulnerabilities; the results were mixed, showing why AI-generated code still needs proactive security review.

A technical walkthrough of XPath injection: how unvalidated input in XML queries enables authentication bypass and data theft, with a vulnerable lab and Burp Suite techniques for identifying the flaw.

Breaks down OWASP Top 10 2017 candidate A7, Insufficient Attack Protection, urging apps to detect, block, log, and respond to automated attacks rather than only validating input.

OpenSAMM, OWASP's free maturity framework, splits app security into four business functions—Governance, Construction, Verification, Deployment—letting organizations score each app in under an hour.

Since its formal recognition by the security community in 2007 on the OWASP Top Ten list, Cross Site Request Forgery (CSRF) has stepped out of the shadows and joined the ranks of vulnerability all-stars like Cross Site Scripting (XSS) and SQL injection.