The OWASP Top 10 is the closest thing the security industry has to a universal syllabus. If you understand these ten risk categories and know how to prevent them, you're ahead of the vast majority of developers shipping code today.
A01: Broken Access Control
Users doing things they shouldn't be able to do. Accessing another user's data, escalating privileges, bypassing auth checks. Fix: enforce access control server-side on every request. Never trust the client.
A02: Cryptographic Failures
Sensitive data transmitted or stored without proper encryption. Passwords stored as plain text. HTTP instead of HTTPS. Fix: encrypt data in transit (TLS) and at rest. Hash passwords with bcrypt or Argon2.
A03: Injection
Attackers injecting code into your queries or commands — SQL, NoSQL, LDAP, OS commands. Fix: parameterise everything. Never concatenate user input into executable strings.
A04: Insecure Design
Security flaws baked into the architecture before a line of code is written. Fix: threat model during design. Ask "what happens if an attacker controls this input?" before building.
A05: Security Misconfiguration
Default credentials, open S3 buckets, verbose error messages, unnecessary features enabled. Fix: harden your configuration. Remove what you don't need. Disable debug mode in production.
A06: Vulnerable Components
Using libraries with known CVEs. Fix: keep dependencies updated. Run automated vulnerability scanning in CI.
A07: Authentication Failures
Weak passwords, no MFA, broken session management. Fix: use battle-tested auth libraries. Implement MFA. Invalidate sessions on logout.
A08: Software and Data Integrity Failures
Untrusted plugins, insecure deserialization, compromised CI/CD pipelines. Fix: verify integrity of dependencies. Sign your releases.
A09: Logging and Monitoring Failures
Not knowing you've been breached. Fix: log auth events and anomalies. Set up alerts. Have an incident response plan.
A10: Server-Side Request Forgery (SSRF)
Tricking your server into making requests to internal systems. Fix: validate and whitelist URLs your server fetches. Block requests to internal IP ranges.