The OWASP Top 10 is a regularly updated list, published by the Open Worldwide Application Security Project, of the ten most significant categories of web application security risk. It is a broad awareness standard used across the industry to prioritize what to defend against, covering areas like broken access control, injection, and cryptographic failures.
What it covers
The list groups risks into categories rather than single bugs. Recent editions lead with Broken Access Control, followed by Cryptographic Failures and Injection, and include Security Misconfiguration and Vulnerable Components. Each category is a family of related weaknesses, so a single finding usually maps to one of them.
How to use it
Treat it as a checklist of what to verify, not a scanner. It tells you the classes of problem worth checking for; you still need to look at your own code or run a scan to find where those classes actually appear in your app.
What this means for AI-generated code
The issues AI coding tools introduce most, hardcoded secrets, missing authorization, and injection, sit squarely in the top OWASP categories. That is why AI-built apps tend to fail in predictable, well-understood ways rather than exotic ones.