What are the most common application security threats?
Design and test against at least these threats:
- Broken object authorization (IDOR/BOLA), role bypass and tenant/row-level policy leakage
- Injection: SQL, XSS, SSRF, command injection, path traversal, unsafe deserialization, malicious uploads
- Identity attacks: credential stuffing, admin compromise, session theft or fixation, phishing, OAuth misconfiguration
- Abuse: API abuse, account enumeration, scraping, spam sign-ups, cost exhaustion and denial of service
- Race conditions: double booking, duplicate refunds/payments, replayed webhooks, stale updates
- Leaks: secrets in code, CI logs or client bundles; public buckets; unredacted error telemetry
- Supply chain: vulnerable dependencies, compromised CI actions, unreviewed AI-written code
- AI risks: prompt injection and agent over-permission
Verify against OWASP ASVS 5.0, OWASP Top 10:2025 and the OWASP API Security Top 10 (2023), using negative-permission tests, dependency and secret scans, authorised staging DAST and human review of sensitive flows. Claim discipline: no system can be promised "unhackable" — a defensible claim is that known risks are reduced, tested, monitored and recoverable.