The OWASP Top 10 (2021) ranks risks by prevalence across aggregated remediation and fuzzing data. Broken access control took the top spot and stays there in the API edition: the OWASP API Security Top 10 (2023) puts BOLA first. An automated scanner catches outdated dependencies and missing headers. The same scanner misses the endpoint that returns someone else's order when you change the ID in the URL.

Injection: parameterize and keep parameterizing

Parameterized queries kill SQL injection: values become parameters, separated from the command text. ORMs handle the common case and slip on the raw path; a query() with a template string reopens the hole. Injection shows up in LDAP, NoSQL, and spreadsheet formulas. An LLM feature brings prompt injection: user text becomes model instructions. You separate system data from user data and validate output against a schema before any action with real effect.

Broken access control: the two-user test

For every resource addressable by ID, you create two test users, authenticate as A, read A's resource, authenticate as B, and try to read the same resource. IDOR and BOLA die in that test. In multi-tenant systems, the tenant filter lives in the data layer, on every query; a forgotten join leaks another customer's rows. Giant payloads with no size limit and endpoints with no rate limit join the same OWASP API Security list, at item 4 and item 9.

Cryptographic failures and XSS

Passwords live in Argon2id or bcrypt, with cost tuned to production hardware; raw MD5 or SHA-256 falls to a rainbow table in hours. Sensitive data at rest uses the cloud provider's encryption and TLS 1.3 in transit, with HSTS locking the protocol. XSS dies with context-aware output encoding and a restrictive Content-Security-Policy; a nonce on the script tag aligns CSP with the build-generated bundle.

The fifteen-minute checklist

You pin the headers: CSP, HSTS, X-Content-Type-Options: nosniff, frame-ancestors with no external origin. You turn on dependency scanning in CI that fails on critical vulnerabilities, and secret scanning on the repository. You write an automated access-control test per endpoint and run the suite on every merge. The OWASP Cheat Sheet Series ships per-framework implementations for each item; the team picks one cheat sheet per sprint and closes one real risk at a time.