## OWASP Top 10

The Ten Commandments of Web Security. Updated every few years (2021 is current).

1.  **Broken Access Control**: User A can see User B's data.
2.  **Cryptographic Failures**: Storing passwords in cleartext.
3.  **Injection**: SQLi, Command Injection.
4.  **Insecure Design**: Logic flaws.
5.  **Security Misconfiguration**: Default passwords, Verbose error messages.
6.  **Vulnerable Components**: Using an old jQuery library with known bugs.
...
(Memorize the top 3 at least!)