Build security into development
Use secure defaults, protect dependencies and secrets, and prioritize real-world vulnerabilities.
- Map common failures to the OWASP Top 10:2025
- Keep secrets out of code and dependencies up to date
- Choose security checks for design, code and release
- Inventory exposed assets and prioritize vulnerabilities using exploitation and business impact
The OWASP Top 10:2025 ranks the most critical web application risks:
| Category | |
|---|---|
| A01 | Broken Access Control |
| A02 | Security Misconfiguration |
| A03 | Software Supply Chain Failures |
| A04 | Cryptographic Failures |
| A05 | Injection |
| A06 | Insecure Design |
| A07 | Authentication Failures |
| A08 | Software or Data Integrity Failures |
| A09 | Security Logging and Alerting Failures |
| A10 | Mishandling of Exceptional Conditions |
New in 2025: supply chain failures - vulnerable or malicious dependencies, compromised build systems - and mishandling exceptional conditions, like failing open when an error occurs.
Try it
Up to 15 XPWhich Top 10 category?
Match each finding to its OWASP Top 10:2025 category.
“Any signed-in user can call DELETE /api/users/{id}”
“The production server shows full stack traces and has the default admin password”
“A build pulls a typosquatted package “reqeusts” that steals environment variables”
“Passwords are stored as unsalted MD5 hashes”
“When the permission service times out, the code allows the request”
“A storage bucket is publicly listable”
“Dependencies are unpinned, so each build may fetch a different version”
Secrets and dependencies
Secrets (API keys, database passwords, private keys) don’t belong in source code: repositories get cloned, forked and leaked, and Git history keeps deleted lines forever. Load them from a secrets manager or environment, scan commits for them, and rotate any secret that was ever committed.
Most of an application is other people’s code. Protect the supply chain: pin versions with a lockfile, verify checksums, keep a software bill of materials (SBOM), watch advisories with a scanner, update promptly, and be wary of new or lookalike package names.
No single check finds everything, so teams layer them: threat modeling at design, code review and static analysis (SAST) while coding, software composition analysis (SCA) for dependencies, dynamic testing (DAST) and penetration testing against running systems.
Log4Shell: dangerous input in a common library
Apache Log4j Core could interpret attacker-controlled text in a logged message as a JNDI lookup. In affected configurations, this could lead to remote code execution.
- 01An attacker places crafted text in a field the application logs.
- 02A vulnerable Log4j Core version processes the lookup.
- 03The lookup can reach an attacker-controlled endpoint and load code.
- 04Defenders inventory affected apps, update, verify, and investigate exposure.
Find the vulnerable thing, then verify the fix
A scanner cannot protect a server it does not know exists. Keep an asset inventory of deployed applications, devices, cloud resources, owners and software versions. Compare it with advisories and scan results. The Equifax case showed how an unpatched public system and a scan that missed it can turn a known flaw into a breach.
Do not sort a patch queue by a severity number alone. Ask: Is the flaw being exploited? Is the system reachable? What data or business process does it protect? Is there a safe fix or temporary mitigation? CISA’s Known Exploited Vulnerabilities catalog identifies flaws exploited in the wild. A known-exploited issue on a public service deserves urgent attention even if a different scanner result has a higher numeric score.
The cycle is discover → prioritize → remediate or mitigate → verify. If a patch cannot be applied immediately, restrict access or disable the affected feature, then track the remaining risk. Re-scan or otherwise confirm the vulnerable version is gone after deployment. CISA’s vulnerability response playbook describes these steps.
Try it
Up to 15 XPAudit the patch plan
A team wrote this weekly vulnerability plan. Find the decisions that leave important exposure untreated.
Click every suspicious section. There are 3.
Practice: triage a dependency scan
Try it
Up to 15 XPWhat should you fix first?
Scanners report a lot. Part of the job is deciding what matters.
Which one do you fix today?
Key takeaways
The OWASP Top 10:2025 starts with broken access control, misconfiguration and supply chain failures.
Keep secrets out of code; rotate any that leak.
Pin, verify and update dependencies; layer review, SAST, SCA and DAST.
Inventory assets, prioritize exploited and exposed weaknesses, and verify remediation on the deployed system.
Lesson quiz
7 questions · pass with 5 correct · up to 50 XP
Passing this quiz completes the lesson and keeps your streak going. Questions you miss come back in review sessions later.
Practice: write Python
Write Python in the editor and run it against sample inputs. Python runs locally in your browser using a WebAssembly runtime.
Scan a commit for secrets
The input is several files: each starts with a line === PATH, followed by its lines. For each line (numbered from 1 within its file) report the first match of:
AKIAfollowed by 16 uppercase letters or digits →AWS access key-----BEGIN ... PRIVATE KEY-----→private keypassword,secretorapi_key(any case, possibly with a prefix likedb_), then=, then a quoted literal →hardcoded secret
Print PATH:LINE: TYPE.
- Three files
Python runs in a sandboxed browser worker with a 60 second time limit. Its runtime loads from the Pyodide CDN; your code stays in this browser.
Questions about this lesson
Stuck? Ask. Figured something out? Share it. Explaining is one of the best ways to learn.
Loading posts…