01 · Definition
What is the OWASP Top 10?
The OWASP Top 10 is the Open Worldwide Application Security Project's ranked list of the most critical security risks to web applications, built from vulnerability data contributed by testing organisations plus a community survey. The current edition, OWASP Top 10:2025, unveiled in November 2025, replaced the 2021 list: A01 Broken Access Control, A02 Security Misconfiguration, A03 Software Supply Chain Failures, A04 Cryptographic Failures, A05 Injection, A06 Insecure Design, A07 Authentication Failures, A08 Software or Data Integrity Failures, A09 Security Logging and Alerting Failures, and A10 Mishandling of Exceptional Conditions.
Because messaging platforms are mostly APIs, OWASP's companion API Security Top 10 (2023 edition) matters just as much. Its first entry, API1 Broken Object Level Authorization (BOLA), describes an endpoint such as GET /conversations/{id} that checks the caller is logged in but not that the conversation belongs to their workspace: change the ID and you read another business's chats. Other entries map just as directly, from unrestricted resource consumption (no Rate Limiting on OTP sends) to broken function-level authorisation (an agent reaching an admin-only export) and unsafe consumption of APIs (trusting webhook payloads without checking their signature).
The Top 10 is a risk catalogue, not a test method or a certification. Penetration testing and code review are how you check for these risks; ISO/IEC 27001 and SOC 2 are management frameworks that expect you to handle them; OWASP's Application Security Verification Standard (ASVS) turns them into testable requirements. Teams use the list to prioritise training, code-review checklists and scanner rules, and to share a common language with auditors and enterprise customers' security questionnaires.
Key takeaways
- The OWASP Top 10 is a ranked, data-driven list of the most critical web application security risks, revised every few years.
- In the 2025 edition broken access control stays at A01, security misconfiguration rises to A02 and software supply chain failures enter at A03.
- OWASP's API Security Top 10 (2023) starts with broken object-level authorisation, the classic bug on conversation and message IDs.
- The list is an awareness baseline, not a certifiable standard; verify controls with OWASP ASVS and penetration testing.
02 · Specifications
The OWASP Top 10: key facts and limits
| Current edition | OWASP Top 10:2025 (unveiled November 2025) |
|---|---|
| A01:2025 | Broken Access Control |
| New in 2025 | A03 Software Supply Chain Failures, A10 Mishandling of Exceptional Conditions |
| SSRF in 2025 | Mapped under A01 Broken Access Control |
| API list | OWASP API Security Top 10:2023 |
| API1:2023 | Broken Object Level Authorization (BOLA) |
| Verification standard | OWASP ASVS |
03 · Code samples
The OWASP Top 10 in code
// VULNERABLE: authenticated, but any tenant can read any conversation (BOLA)app.get("/api/conversations/:id", requireLogin, async (req, res) => {const convo = await db.conversation.findUnique({ where: { id: req.params.id } });if (!convo) return res.sendStatus(404);res.json(convo);});// FIXED: the query itself is scoped to the caller's tenantapp.get("/api/conversations/:id", requireLogin, async (req, res) => {const convo = await db.conversation.findFirst({where: { id: req.params.id, tenantId: req.user.tenantId },});if (!convo) return res.sendStatus(404); // same answer for "missing" and "not yours"res.json(convo);});
Ownership belongs in the query, not in a check someone can forget after the fetch.
04Playground
A working model of OWASP Top 10. Use its controls to replay it step by step.
Climb the list from unreviewed to verified
- Tier 1Tier 1: Unreviewed API (below the current tier)BaselineBaseline
- Tier 2Tier 2: Broken Access Control (below the current tier)A01:2025A01:2025
- Tier 3Tier 3: Security Misconfiguration (below the current tier)A02:2025A02:2025
- Tier 4Tier 4: Supply Chain Failures (below the current tier)A03:2025A03:2025
- Tier 5Tier 5: Cryptographic Failures (below the current tier)A04:2025A04:2025
- Tier 6Tier 6: Authentication Failures (below the current tier)A07:2025A07:2025
- Tier 7Tier 7: Logging and Alerting (below the current tier)A09:2025A09:2025
- Tier 8Tier 8: Verified (current)ASVS L2ASVS L2
Tier 8 · Verified
ASVS L2
Why: An ASVS Level 2 review and an external pentest confirm the controls.
Controls checked against OWASP ASVS Level 2 and confirmed by an external penetration test.
Move 8 of 8: climbs to tier 8, Verified (ASVS L2). An ASVS Level 2 review and an external pentest confirm the controls.
05 · Operation
How does the OWASP Top 10 work?
Map the list to your architecture
For each category, note where it could appear: tenant checks on conversation and contact IDs (A01), debug routes and open storage (A02), npm or PyPI dependencies (A03), how each API Key, JSON Web Token (JWT) and webhook secret is stored and checked (A04, A07).
Fix access control first
Enforce object-level checks on every read and write: scope the query by the caller's tenant or WABA, deny by default, check function-level rights through Role-Based Access Control (RBAC), and add tests that request another tenant's IDs.
Harden configuration and dependencies
Turn off debug endpoints, restrict CORS and storage buckets, pin and scan dependencies, generate a software bill of materials and verify build artefacts.
Verify with ASVS and testing
Turn categories into checklist items from OWASP ASVS, run automated scans in CI and commission a penetration test before major releases or enterprise deals.
Log, alert and revisit
Record security-relevant events in an Audit Log, alert on anomalies such as bursts of 403s or bulk exports, and redo the mapping whenever OWASP publishes a new edition.
06 · Cautions
Common mistakes with the OWASP Top 10
Treating it as a compliance checklist
Ticking ten boxes does not make an app secure, and the list is deliberately short. Use it to prioritise, then verify with ASVS requirements and testing.
Checking authentication but not ownership
Login middleware proves who the caller is, not what they may touch. Scope every query by tenant, WABA or user, including exports, media downloads and internal admin tools.
Ignoring the API Security Top 10
Messaging platforms are API-first, so the web list alone misses issues like BOLA, resource consumption and unsafe consumption of third-party APIs. Review both lists together.
Leaking details in errors
Stack traces, SQL errors or raw upstream API errors passed to clients help attackers, and unhandled exceptions can leave systems in unsafe states (A10:2025). Return generic errors and keep detail in your logs.
07 · Worked example: Fixing BOLA in a Bengaluru team inbox
Example: Fixing BOLA in a Bengaluru team inbox
During a pre-sale security review for a bank, testers of a Bengaluru messaging platform log in as workspace A and request GET /api/conversations/88231, an ID belonging to workspace B. The API returns the whole chat, customer phone number included, because it checked the session but not ownership (A01:2025, API1:2023). The fix scopes every query by the caller's tenant ID, returns 404 rather than 403 for other tenants' objects so IDs cannot be probed, and adds an automated test per endpoint that swaps in a foreign ID. The retest passes, and the check joins the team's code-review checklist.
08 · Rationale
Why does the OWASP Top 10 matter?
A WhatsApp integration concentrates sensitive data behind a handful of endpoints: conversation history, phone numbers, templates, and tokens that can message thousands of people. One missing ownership check or one leaked token is enough for a breach that also puts the business's number and its DPDP Act obligations on the line. The Top 10 points effort at the flaws real applications most often have: OWASP reports that every application tested for the 2025 list showed some form of broken access control.
09 · Recommended practice
Best practices for the OWASP Top 10
- Add a foreign-ID test for every endpoint that accepts an object ID.
- Use unguessable IDs such as UUIDs as defence in depth, never as the only access check.
- Generate a software bill of materials on every build and scan it for known vulnerabilities.
- Give each Top 10 category an owner and a named control in your security questionnaire answers.
- Treat Prompt Injection in AI-handled chats as both an injection and an access-control risk: limit which tools and records the bot can reach.
10 · Questions and answers
OWASP Top 10 FAQs
- What is number one on the OWASP Top 10?
- Broken access control is A01 in both the 2021 and 2025 editions. It covers users acting outside their permissions: reading another tenant's data, reaching admin functions or tampering with IDs in requests.
- What changed in the OWASP Top 10 2025?
- Security misconfiguration rose to A02, software supply chain failures entered at A03 and mishandling of exceptional conditions is new at A10. Server-side request forgery is now mapped under broken access control.
- Is the OWASP Top 10 a compliance standard?
- No. It is an awareness document, not a certifiable standard. Customers and auditors often reference it, but you demonstrate controls through OWASP ASVS, penetration tests, ISO/IEC 27001 or SOC 2.
- What is BOLA in an API?
- Broken object-level authorisation is API1 in OWASP's API Security Top 10: the API trusts an object ID from the request without checking that the caller owns it. Changing a conversation or message ID then exposes another customer's data.