Available inEnglishFrenchGermanHindiPortugueseRussianSpanish
Web Security for Developers (OWASP Top 10)
Spot the vulnerability in a pull request and say the one-line fix, from IDOR and injection to a poisoned dependency. For developers who ship HTTP APIs, with no security background assumed. One hundred and thirty-six cards follow the ten OWASP Top 10:2025 categories in published order, most of them a short read of a diff; it stops at code review, with no exploitation, network security or compliance paperwork.
GET /api/orders/1024 returns your order. Changing the URL to /api/orders/1023 returns someone else's. Name the vulnerability class.
Insecure direct object reference (IDOR)
— Only the id in the URL changed.
Source
IDOR is CWE-639, Authorization Bypass Through User-Controlled Key: the app trusts an identifier the client supplies instead of re-checking ownership on the server. OWASP Top 10:2025 keeps Broken Access Control at A01, the top category since 2021. Commonly confused with CSRF, which forges a request from the victim's own browser rather than walking an id chosen by the attacker.