OWASP Top 10
debt(d7/e5/b3/t7)
Closest to 'only careful code review or runtime testing' (d7). The detection_hints note automated=no and while tools like owasp-zap, burpsuite, and semgrep can surface some issues, coverage is incomplete — business logic flaws and application-specific gaps listed in the misconception are silent until testing or production incidents expose them.
Closest to 'touches multiple files / significant refactor in one component' (e5). The quick_fix describes an annual mapping exercise across the entire application, and common_mistakes highlight that addressing items requires understanding underlying risks beyond framework-level fixes, implying meaningful cross-component work rather than a single-line patch.
Closest to 'localised tax' (b3). OWASP Top 10 is a reference standard and audit framework applied to web/api contexts. It imposes a recurring review cost and shapes security prioritisation, but it is not load-bearing across every code change — it functions more as a periodic checklist than a pervasive structural dependency.
Closest to 'serious trap' (t7). The misconception explicitly states that covering OWASP Top 10 is mistaken for complete security coverage — this directly contradicts the intuitive reading of 'top 10 security checklist', and common_mistakes confirm developers routinely use absence from the list to deprioritise real vulnerabilities, a consequential and recurring wrong belief.
Also Known As
TL;DR
Explanation
The OWASP Top 10 is the most widely referenced web application security awareness document. It groups vulnerability classes into ten categories ranked by prevalence and impact. The 2021 edition introduced Insecure Design (A4) and Software and Data Integrity Failures (A8). Each category maps to multiple CWEs. PHP Clarity Lab maps findings to their OWASP category so you can understand the broader risk context, not just the specific vulnerability.
Common Misconception
Why It Matters
Common Mistakes
- Treating the OWASP Top 10 as a complete security checklist rather than a prioritised starting point.
- Addressing items purely at the framework level (e.g. ORM for SQLi) without understanding the underlying risk.
- Not revisiting OWASP guidance when the list is updated — the 2021 list differs significantly from 2017.
- Using 'not on the OWASP Top 10' as justification for deprioritising a real vulnerability.
Code Examples
// Checking only OWASP Top 10 — missing business logic flaws:
function securityAudit($app) {
checkForSQLi($app);
checkForXSS($app);
// Business logic, IDOR, auth flaws not checked
return 'Secure'; // False confidence
}# OWASP Top 10 (2021) — PHP quick-reference mitigations
# A01 Broken Access Control
$order = Order::findOrFail($id);
if ($order->user_id !== auth()->id()) abort(403);
# A02 Cryptographic Failures
$hash = password_hash($pw, PASSWORD_ARGON2ID); // not md5/sha1
# A03 Injection
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?');
$stmt->execute([$email]);
# A04 Insecure Design — threat model early; use security patterns
# A05 Security Misconfiguration
# display_errors=Off, expose_php=Off, directory listing off
# A06 Vulnerable Components
# composer audit on every CI run
# A07 Auth Failures
# bcrypt + MFA + session_regenerate_id() on login
# A08 Software Integrity
# Verify composer.lock; sign deployments
# A09 Logging Failures
# Log auth events: user, IP, timestamp, outcome
# A10 SSRF
# Validate and allowlist outbound URLs