OWASP Top 10 is a reference document that catalogs the most critical security risks in web applications.
The project addresses the need for a shared understanding of the most dangerous application security vulnerabilities. It works by gathering data from security professionals, researchers, and practitioners across the industry to identify and rank the top ten categories of security weaknesses that pose the greatest risk to web applications. The document serves as a consensus-driven baseline for understanding which vulnerabilities deserve the most attention and resources during development and security testing.
Organizations building or securing web applications should use this document as a foundational reference for their security programs. It suits teams at any stage—from those establishing initial security practices to mature organizations refining their vulnerability management priorities. The document provides a common language for discussing application security risks across development teams, security professionals, and business stakeholders, making it particularly valuable for prioritizing which vulnerabilities to address first when resources are limited.
The project maintains multiple versions of the document reflecting different release cycles, with earlier editions preserved for historical reference. The repository accepts feedback and issues from the community, indicating an open channel for practitioners to contribute observations and corrections to the guidance.
