The OWASP Top 10 as a Map

A shared vocabulary for web risk

The OWASP Top 10 is a consensus list of the most critical web application security risk categories, refreshed every few years from industry data. The 2025 edition lists: Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions. Compared with the 2021 edition, which you will still see quoted, Server-Side Request Forgery was folded into Broken Access Control and Vulnerable and Outdated Components widened into Software Supply Chain Failures. Categories get merged and renamed between editions, so check owasp.org for the latest one. Treat it as an awareness document and a map, not a complete standard; for detailed requirements use ASVS. For DevSecOps the useful exercise is mapping each category to where it is caught: injection by SAST and code review, supply chain failures by dependency scanning and SBOMs, misconfiguration by IaC and container scanning, integrity failures by signed artefacts, and logging failures by observability reviews.

From untrusted input to safe output

Untrusted input is validated at the edge, handled by code that keeps data and commands separate, and encoded for its context before it is shown to another user.

Mapping risks to pipeline controls

A quick lookup table you might keep in a team wiki, using 2025 category names.

controls = {
    "Broken Access Control": "authz tests + code review",
    "Injection": "SAST + parameterised queries",
    "Security Misconfiguration": "IaC and container config scanning",
    "Software Supply Chain Failures": "SCA + SBOM + automated dependency updates",
    "Software or Data Integrity Failures": "signed artefacts + pinned actions",
}
for risk, control in controls.items():
    print(f"- {risk}: {control}")

Output:

- Broken Access Control: authz tests + code review
- Injection: SAST + parameterised queries
- Security Misconfiguration: IaC and container config scanning
- Software Supply Chain Failures: SCA + SBOM + automated dependency updates
- Software or Data Integrity Failures: signed artefacts + pinned actions

Access control tops the list for a reason

Scanners are weak at finding broken access control, because they do not know which user should see which record. That category needs design review and explicit negative tests.

त्वरित जाँच: Which pipeline control most directly catches known-vulnerable third-party packages (the 2021 "Vulnerable and Outdated Components" risk, now part of "Software Supply Chain Failures")?

• Software composition analysis (dependency scanning)
• A web application firewall rule for XSS
• Password complexity rules
• Load testing