OWASP Top 10:2025

Address OWASP Top 10 A01 Broken Access Control per OWASP Top 10:2025. Broken Access Control occurs when authorisation enforcement is missing + bypassable + inconsistent across web applications including bypass via URL tampering + forced browsing + tampering with metadata + role manipulation + insecure direct object reference (IDOR) + missing function-level access checks + CORS misconfiguration. Mitigations include (a) implement access control as server-side enforcement consistently across all routes + (b) implement deny-by-default policy with explicit allow + (c) implement object-level + function-level + property-level access checks + (d) implement RBAC + ABAC where appropriate + (e) protect against IDOR via unpredictable identifiers + ownership checks + (f) implement rate limiting + lockout against access control brute force + (g) test access control thoroughly across user roles + tenan

• OWASP Top 10 A01:2025 evidence

• test coverage incomplete + Top 10 alignment partial

Address OWASP Top 10 A07 Identification and Authentication Failures per OWASP Top 10:2025. Identification and Authentication Failures arise from weak password + session management + credential storage + recovery + reuse attacks + credential stuffing + session fixation + replay attacks. Mitigations include (a) implement strong password requirements aligned to NIST SP 800-63B including compromised password checking + (b) require multi-factor authentication for sensitive operations + privileged accounts + (c) implement secure password storage using adaptive hashing (Argon2 + bcrypt + PBKDF2 + scrypt) + (d) implement credential lifecycle management + (e) implement secure session management including cryptographically random tokens + secure cookies + appropriate timeout + (f) implement rate limiting + account lockout against brute force.

• OWASP Top 10 A07:2025 evidence

• test coverage incomplete + Top 10 alignment partial

Address OWASP Top 10 A06 Vulnerable and Outdated Components per OWASP Top 10:2025. Vulnerable and Outdated Components arises from using libraries + frameworks + runtimes + operating systems + containers + and other components with known vulnerabilities + end-of-life status + unsupported versions + or unauthorised modifications. Mitigations include (a) maintain inventory of components + dependencies + including transitive + (b) maintain Software Bill of Materials (SBOM) + (c) scan for known vulnerabilities + license issues + (d) verify component provenance + signing + (e) maintain patching + update programme with priority + tracking + (f) implement third-party script + tag management for client-side dependencies + (g) implement secure dependency lifecycle including secure update + retirement.

• OWASP Top 10 A06:2025 evidence

• test coverage incomplete + Top 10 alignment partial

Address OWASP Top 10 A05 Security Misconfiguration per OWASP Top 10:2025. Security Misconfiguration occurs across application + middleware + runtime + infrastructure including default credentials + unnecessary features enabled + verbose error messages + missing security headers + cloud + container + Kubernetes misconfigurations + and CORS issues. Mitigations include (a) maintain hardened baseline configurations across stack + (b) implement configuration management with drift detection + remediation + (c) disable unnecessary features + endpoints + debug + verbose errors + (d) apply security headers (HSTS + CSP + X-Content-Type-Options + Referrer-Policy + Permissions-Policy + similar) + (e) implement Content Security Policy + browser hardening + (f) maintain secure cloud + container + orchestration configurations.

• OWASP Top 10 A05:2025 evidence

• test coverage incomplete + Top 10 alignment partial

Address OWASP Top 10 A02 Cryptographic Failures per OWASP Top 10:2025. Cryptographic Failures occur when sensitive data is not appropriately protected by cryptography enabling data exposure including weak + deprecated algorithms + improper parameter choices + key management failures + clear-text transmission + clear-text storage + side-channel attacks + and improper certificate validation. Mitigations include (a) classify data + apply appropriate cryptographic protection per classification + (b) use industry-vetted algorithms + key sizes + libraries + (c) implement key management lifecycle including generation + storage + rotation + revocation + (d) protect data at rest + in transit + in use appropriate to risk + (e) implement secrets management using dedicated secret store + rotation + no hard-coded secrets + (f) maintain crypto-agility for algorithm migration.

• OWASP Top 10 A02:2025 evidence

• test coverage incomplete + Top 10 alignment partial

Address OWASP Top 10 A03 Injection per OWASP Top 10:2025. Injection occurs when untrusted data is sent to an interpreter as part of a command or query enabling SQL injection + NoSQL injection + LDAP injection + OS command injection + ORM injection + XML/XPath injection + Server-Side Template Injection (SSTI) + Cross-Site Scripting (XSS) + and other injection variants. Mitigations include (a) validate + sanitise + escape input at trust boundaries + (b) use parameterised queries + prepared statements + ORM safe-query APIs against SQL/NoSQL injection + (c) use context-appropriate output encoding against XSS (HTML + URL + JS + CSS encoding) + (d) implement Content Security Policy + Trusted Types + (e) validate file uploads (type + size + content + scanning) + (f) protect against XXE + deserialisation + template injection via safe parser configuration.

• OWASP Top 10 A03:2025 evidence

• test coverage incomplete + Top 10 alignment partial

Address OWASP Top 10 A08 Software and Data Integrity Failures per OWASP Top 10:2025. Software and Data Integrity Failures arise from assumptions about software updates + critical data + CI/CD pipelines without verifying integrity including unsigned updates + insecure deserialisation + third-party script + tag injection + plugin compromise + supply chain attacks. Mitigations include (a) implement code signing + signature verification for software updates + plugins + (b) implement secure CI/CD pipeline including signed artefacts + isolated build environments + integrity verification + (c) implement Subresource Integrity (SRI) for third-party scripts + (d) implement secure deserialisation including allow-list of accepted types + (e) implement third-party script + tag management with monitoring + (f) protect against supply chain attacks via dependency confusion + typosquatting + repository c

• OWASP Top 10 A08:2025 evidence

• test coverage incomplete + Top 10 alignment partial

Address OWASP Top 10 A09 Security Logging and Monitoring Failures per OWASP Top 10:2025. Security Logging and Monitoring Failures arise from insufficient logging + monitoring + alerting + and incident response capability including missing audit logs + missing anomaly detection + missing incident response readiness + log injection + and information exposure via error messages. Mitigations include (a) log security-relevant events including authentication + authorisation + administrative actions + with sufficient context + (b) protect log integrity + confidentiality + availability + (c) integrate with SIEM + monitoring + alerting + (d) implement anomaly detection + incident response workflows + (e) handle errors without leaking sensitive information + (f) maintain retention aligned to regulatory + investigative + governance requirements + (g) protect against log injection.

• OWASP Top 10 A09:2025 evidence

• test coverage incomplete + Top 10 alignment partial

Address OWASP Top 10 A10 Server-Side Request Forgery (SSRF) per OWASP Top 10:2025. SSRF occurs when an application fetches a remote resource without validating the user-supplied URL allowing internal network access + cloud metadata service access + or other unauthorised target access including blind SSRF + DNS rebinding + URL parsing inconsistencies. Mitigations include (a) implement URL allowlist for fetching external resources + (b) block internal IP ranges + cloud metadata service IPs (169.254.169.254 + similar) + (c) use DNS resolution checking + (d) enforce schemes + protocols + ports + (e) implement network-level egress controls + (f) protect cloud metadata via IMDSv2 + workload identity + (g) implement defence in depth.

• OWASP Top 10 A010:2025 evidence

• test coverage incomplete + Top 10 alignment partial

Address OWASP Top 10 A04 Insecure Design + A11 API Abuse and Business Logic Attacks per OWASP Top 10:2025. Insecure Design reflects missing or inadequate security design including missing threat modelling + missing security requirements + insecure reference architecture + missing business logic security controls + and missing security testing of design. API Abuse and Business Logic Attacks occur when business workflows are abused at scale via automation + scalping + scraping + fake transaction generation + bot abuse. Mitigations include (a) conduct threat modelling at design phase + revise on significant change + (b) maintain documented security requirements + reference architecture + (c) integrate security activities into SDLC + (d) implement business logic security controls including step ordering + state validation + replay prevention + (e) implement bot management + rate limiting + v

• OWASP Top 10 A04:2025 evidence

• test coverage incomplete + Top 10 alignment partial