The OWASP Top 10 is an awareness document from the OWASP Foundation listing the most critical categories of web application security risk. It is revised periodically using community data.
Penetration testing is an authorised, simulated attack on a system to find exploitable weaknesses before real attackers do. Testers work within an agreed scope and report what they reached and how to fix it.
Static application security testing (SAST) analyses source or compiled code for security flaws without running it. It usually runs in the developer's editor or the CI pipeline.
A web application firewall (WAF) is a filter in front of web applications and APIs that inspects HTTP traffic. It blocks requests matching known attack patterns or abusive behaviour.
API security is the practice of protecting application programming interfaces from misuse. It controls who can call them, what data they can reach and how much they can request.
Dynamic application security testing (DAST) probes a running application from the outside with crafted requests. It watches how the application responds for signs of security weaknesses an attacker could use.
Prompt injection is an attack where text a model reads, such as a web page, email or document, carries instructions that override what the application intended. It is the main security risk for any model that can call tools.
A clear proven process, that delivers
You've seen our ideas - now go deeper.
Discover more insights, guides, and engineering practice.