OWASP calls its Top 10 a bare minimum, not a standard

The workload

A one-person team that wants a security baseline for its code has no regulator telling it where to start. The OWASP Top 10:2021 is the reference most solo-founder checklists point to instead: ten named categories of web-application weakness, ranked A01 through A10, published by the Open Worldwide Application Security Project (OWASP), a nonprofit standards body. Working through it means reading ten short pages, mapping each category to the parts of an application that touch it — access checks, cryptography, input handling, configuration, dependencies, authentication, logging, and outbound requests — and deciding which apply to a given stack. That is a reading and triage task, not a certification exam; the document names risk categories, not a checklist a founder finishes once.

What the documents show

OWASP's own introduction to the 2021 edition states, verified, that the ranking draws on eight of the ten categories from contributed data and two chosen from a community survey, because contributed data lags newly discovered attack techniques. The categories, in the order OWASP's edition page lists them, are Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and Server-Side Request Forgery. A second page, How to use the OWASP Top 10 as a standard, adds what the first does not: OWASP's own text says using it as a coding or testing standard makes it 'the bare minimum and just a starting point.' A third page, OWASP's Top 10 project page, lists three editions to date — 2017, 2021 and 2025 — confirming a periodically revised document, not a fixed rulebook.

The operating cost

The Top 10 itself carries no fee; it is free to read on owasp.org. The cost is staff time: working through ten categories against a codebase and fixing what is found. None of the three pages states a number of hours this takes, and the documents give no basis to estimate one without knowing the codebase's size, so no figure is given here.

The stop condition

OWASP's standard-use page states the list is a floor, not a ceiling, so no cited point marks review complete. This is an editorial judgment: a reasonable stop condition treats the Top 10 as the entry criterion for a code review, not its outcome, moving to a named framework, such as OWASP's own Application Security Verification Standard, once a product handles payment or regulated personal data, since the standard-use page recommends that path for anyone wanting more than a bare minimum.

• Which of the ten 2021 categories touch code this product ships today?
• Is the Top 10 being used to open a review, or treated as though it closes one?
• Does the product's data sensitivity justify moving to a fuller standard than the Top 10?

The Top 10 tells a solo founder where documented attackers have concentrated in the recent past, ranked by a mix of submitted data and practitioner opinion, and it says so itself. It does not tell them they are secure.