# About the OWASP Top 10
The Open Web Application Security Project (OWASP) Top 10 is the globally recognized standard document representing the most critical security risks to web applications.
# A01: Broken Access Control
Occurs when users can act outside of their intended permissions, such as accessing another user's account by modifying an ID parameter (IDOR) or viewing admin portals without proper authentication.
# A02: Cryptographic Failures
Previously known as Sensitive Data Exposure. Focuses on weak encryption algorithms (e.g. MD5, SHA1), unencrypted transmission of credentials, and improper key management.
# A03: Injection Flaws
Includes SQL Injection, Command Injection, LDAP Injection, and Cross-Site Scripting (XSS).
# A04: Insecure Design
Flaws originating during architecture and design phases that cannot be fixed by perfect implementation alone.
# Implementing Defenses
Modern secure development requires threat modeling during sprint planning, automated SAST/DAST scanning, and comprehensive peer code reviews.