Learn the OWASP Top 10
Clear, practical lessons on the most critical security risks - across ten OWASP projects: Web, API, Mobile, LLM, Kubernetes, CI/CD, ML, Smart Contracts, and Serverless, plus the Proactive Controls to defend against them. Every edition, easy to navigate.
Choose a category
Pick an area, then an edition - the most recent is selected by default.Web Application Top 10
The original OWASP Top 10 - the most critical security risks to web applications.
API Security Top 10
Risks specific to APIs - object/function authorization, resource consumption, and more.
Mobile Top 10
The OWASP Mobile Top 10 (2024) - the top risks for mobile applications.
LLM & GenAI Top 10
The OWASP Top 10 for Large Language Model applications - prompt injection, agents, RAG, and more.
Kubernetes Top 10
The OWASP Kubernetes Top 10 - the most common security risks in Kubernetes clusters.
CI/CD Top 10
The OWASP Top 10 CI/CD Security Risks - how build and delivery pipelines get attacked.
ML Security Top 10
The OWASP Machine Learning Security Top 10 - attacks against ML models and pipelines.
Smart Contract Top 10
The OWASP Smart Contract Top 10 (2025) - the top risks in Solidity/EVM smart contracts.
Serverless Top 10
The OWASP Serverless Top 10 - the security weaknesses specific to serverless (FaaS) applications.
Proactive Controls Top 10
The OWASP Top 10 Proactive Controls (2024) - the defensive techniques every developer should build in.
▪ Cheat sheets
Quick, one-page references for every vulnerability - what it is, how it’s attacked, and how to prevent it.
▪ Practice locally
Hands-on vulnerable labs you run on your own machine with Docker or a Codespace - never exposed online.
▪ Official OWASP ↗
The canonical OWASP Top 10 projects and documentation on owasp.org.