This is an international non-profit group that helps keep the internet safe for everyone. They create a list of the most common ways websites are attacked to help builders defend against them.

The OWASP Foundation

This rule ensures that users can only see and do things they are specifically allowed to do. If it breaks, a regular user might accidentally see another person's private messages or bank details.

Access Control Basics

Websites must be set up carefully to stay safe. Using 'default' settings is like leaving the factory-standard keys in a new door, which makes it easy for intruders to get inside.

Safe System Settings

Developers use pre-made code blocks from others to build apps faster. These parts must be checked regularly because if a popular code block has a bug, every app using it becomes unsafe.

Trusted Software Parts

This involves using secret codes (encryption) to protect private information like passwords and credit card numbers. If the data isn't scrambled correctly, anyone watching the network can read it.

Scrambling Sensitive Data

This stops hackers from sending hidden commands that trick a website into doing something it shouldn't. It is like making sure a visitor only writes their name on a form instead of writing a command to open the safe.

Preventing Sneaky Inputs

Thinking about safety while building a website is better than trying to fix it after it is finished. Security should be a part of the original blueprint, not a patch added later.

Security by Design

Strong systems make sure the person logging in is actually who they say they are. This prevents hackers from using simple tricks to guess passwords or skip the login screen entirely.

Verifying Login Identities

This ensures that software and information haven't been secretly changed or tampered with. It is like having a digital seal on a package that shows if someone opened or altered it before it reached you.

Protecting Data Quality

Just like a security camera, apps should record important events so owners can spot suspicious behavior. Without these records, an intruder could roam around for months without being noticed.

Logging App Activity

When an app crashes or runs into a problem, it should stay safe. It must avoid showing technical 'behind-the-scenes' secrets that could help a hacker find a way to break in.

OWASP Top 10 Vulnerabilities Concepts