The OWASP Top 10 for people who decide

The OWASP Top 10 is a widely used awareness list of the most serious web application security risks. Testers use it as a starting point. You can use it to ask better questions.

Questions worth asking your team

• Access control: can a user reach another user's data by changing a number in the address?
• Injection: is everything a user types treated as data, never as a command?
• Authentication: how are passwords stored, and is a second factor available?
• Misconfiguration: are default accounts, debug pages and open storage removed?
• Components: do you know which libraries you use and whether they are up to date?
• Logging: would you notice an attack, and could you investigate it afterwards?

A caution

The list is a map of categories, not a checklist that proves you are safe. A good test goes beyond it, into how your particular application works.