OWASP Top 10

The OWASP Top 10 is a short list of the ten most common ways a website or a web application gets broken into. It is written by a group of security volunteers called OWASP and updated every few years. Nobody sells it. Anyone can read it in an afternoon.

The list is useful because the same mistakes keep happening. A staff account that opens every customer record instead of only its own. A login page that lets a thief try a thousand passwords in a minute. A search box that passes whatever you type straight to the database, so a visitor types a command instead of a word and reads the whole table. A password kept as plain text. An upload form that accepts a program dressed up as a photo. A piece of borrowed code nobody has updated in three years, with a hole anyone can look up online.

Notice what those have in common. Not one of them is clever. They are ordinary errors made by tired people near a deadline, and machines find them. Scanners sweep millions of addresses a day looking for exactly these faults. That is the honest part most sales pages leave out. Most break-ins are not aimed at you. Your site was simply on a list. When Linkysoft is handed a system somebody else built, the first pass through this list almost always finds something.

So here is the single best question to ask a software supplier before you sign. Show me how you test against the OWASP Top 10, and show me the report from the last time you ran it. A supplier who works this way answers in a minute and sends you a file. A supplier who has never done it will talk about firewalls, encryption and how careful the team is. That answer is the warning. Ask in the first meeting, not after the build, because changing a design later costs several times more than getting it right once.

Linkysoft runs that check before a web application goes live, and again after every large change, because a new feature can reopen an old hole. If your system is already running and nobody has ever tested it, a short security review is the cheaper place to begin. Three days of proper testing usually tells an owner more than a year of worrying.