Browse
If you’re new here, start with the OWASP Top 10. The rest is a deeper set of categories and checks.
OWASP Top 10:2025 (A01–A10)
- A01 Broken Access Control
- A02 Security Misconfiguration
- A03 Software Supply Chain Failures
- A04 Cryptographic Failures
- A05 Injection
- A06 Insecure Design
- A07 Authentication Failures
- A08 Software or Data Integrity Failures
- A09 Security Logging and Alerting Failures
- A10 Mishandling of Exceptional Conditions (new in 2025 — article coming soon; overlaps with logging and exception-handling heuristics in the meantime)
Core categories (auth, secrets, config, API safety)
- B01 Business Logic Trust of Client
- C01 Insecure Defaults
- C02 Weak Cryptography
- CRED-URL Hardcoded Credentials in URLs
- E01 Verbose Error Handling
- F01 Foot-gun APIs
- I01 Injection Risk Patterns
- L01 Logging Exposure
- M01 Missing Authentication
- N01 Insecure Redirects
- P01 Path Traversal Risk
- P02 Plaintext Password Storage
- RACE01 Race Condition (TOCTOU)
- R01 Weak Randomness
- RATE01/02 Missing or Disabled Rate Limiting
- INPUT01/02 Unbounded Inputs and Missing Request Size Limits
- S02 Insecure Session Cookies
- X01 XSS Risk
- S01 Secret Exposure
- SSO1 SSO Not Enforced
- MFA01 MFA Not Enforced
- TOK01 Long-Lived Token Use
- T01 TLS Verification Disabled
- CERT01 Embedded CA Bundle
- CREDS01 Hard-coded Credentials in Config Files
- CLICK01 Clickjacking Protection Missing
- SRI01 Missing Subresource Integrity
- SBOM01 Missing Lockfile or SBOM
- DEP01 Unpinned Dependencies
- CLOUD01 Insecure Cloud Storage ACLs
- CONTAINER01 Privileged Container or Root User
- DOCKER01/02 Dockerfile and Compose Risky Patterns
- K8S01–K8S04 Kubernetes Security Misconfiguration
- API01 Mass Assignment / Over-Posting
- JWT01 Insecure JWT Handling
- CICD01 CI/CD Security Gates Missing
- INC01 Incident Readiness Missing
- SS01 SSRF Risk Patterns
- S03 Secrets Written to Files
- S04 Custom Password Flows
Heuristic analysis (H01–H14)
Quality & process checks (QP)
- QP01 Version Control Practices
- QP02 Continuous Integration Practices
- QP03 Automated Tests Practices
- QP04 Code Reviews Practices
- QP05 Pair Programming Practices
- QP06 Style Guides Practices
- QP07 Clean Code Principles Practices
- QP08 Standards & Style Guides Practices
- QP09 God Files / Spaghetti Code
- QP10 Excessive Duplication
- QP11 High Complexity
- QP12 Long Functions
- QP13 Large Classes
- QP14 Repository Ownership (CODEOWNERS)
- QP15 CI Workflows Presence
- QP16 Test Configuration Presence
- QP17 EditorConfig Presence
- QP18 ESLint Configuration Presence
- QP19 Pre-commit Hooks Presence
- QP20 Python Project Config Presence
- QP21 Java Style Guide Presence
- QP22 Go Module Presence
Secure Coding Practices (SCP)
- SCP01 Input Validation
- SCP02 Output Encoding
- SCP03 Authentication & Password Management
- SCP04 Session Management
- SCP05 Access Control
- SCP06 Cryptographic Practices
- SCP07 Error Handling & Logging
- SCP08 Data Protection
- SCP09 Communication Security
- SCP10 Configuration
- SCP11 Database Security
- SCP12 File & Memory Management
- SCP13 General Coding Practices