OWASP Top 10: A Complete Guide to the Most Critical Web App Vulnerabilities

·2 views

The OWASP Top 10 is a periodically updated consensus document published by the Open Web Application Security Project, a nonprofit focused on improving software security. It identifies the ten most critical security risks facing web applications, serving as a key reference for developers, security engineers, and IT professionals. The most recent edition, released in 2021, introduced new vulnerability categories and restructured existing priorities to reflect the evolving threat landscape. Among the top risks are Broken Access Control, where users can exceed their intended permissions, and Cryptographic Failures, which involve weak encryption or transmission of sensitive data in plaintext. The guide pairs each vulnerability with practical code examples and recommended countermeasures to help organizations prevent and mitigate common attacks.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Expense Receipt PDF Fraud Costs Firms $40,000 Per Scheme as Controls Miss the File

The Association of Certified Fraud Examiners estimates expense reimbursement fraud causes a median loss of $40,000 per scheme, typically going undetected for around two years. Standard financial controls such as three-way matching and policy checks validate data extracted from receipts but never inspect the actual uploaded PDF file itself. Employee-submitted travel and entertainment receipts are especially vulnerable because they are self-submitted, individually small, and usually fall below the approval or sampling thresholds that would trigger closer review. A fraudster can quietly alter a hotel folio — raising a room rate from $189 to $312, for example — and the edited file is unlikely to be caught through visual spot-checks alone. This structural blind spot in expense reimbursement workflows means repeated small edits across many claims can accumulate into significant losses before any alarm is raised.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Proxy Rotation Strategies Help Developers Avoid IP Bans at Scale

Proxy rotation — cycling through multiple IP addresses to distribute traffic — has become a critical practice for developers and businesses running web scraping, API testing, or market research at scale. Without rotation, a single IP can quickly get rate-limited or permanently banned by anti-scraping systems that flag unusual request patterns. Experts recommend pairing rotation with randomized delays of 2–10 seconds between requests to mimic normal user behavior and reduce detection risk. Different rotation strategies suit different workloads: per-request rotation works best for heavy scraping, session-based rotation balances safety and efficiency, and adaptive rotation responds dynamically to error codes like HTTP 429 or 403. The choice of proxy type and pool size also matters, with larger IP pools and smarter throttling significantly improving long-term success rates.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How DJI's Drone Tech Spawned Zhuoyu, China's Low-Cost Autonomous Driving Startup

Zhuoyu Autonomous Driving originated in 2016 as an internal DJI research project led by engineer Shen Shaojie, who had pioneered stereo-camera systems for drones at HKUST. The team recognized that machine vision for drones and environmental perception for vehicles shared the same underlying logic, prompting a pivot toward automotive applications. By 2018, the project had secured one of Shenzhen's first autonomous driving test permits and was conducting open-road trials using perception technology adapted from drone systems. Formally established as DJI's Automotive division in 2021, the company pursued a contrarian approach — relying on a seven-camera vision setup, no lidar, no HD maps, and as little as 32 TOPS of compute — to bring city-level driving assistance to EVs priced under RMB 100,000. Its Chengxing Platform debuted in the 2022 Baojun KiWi EV, drawing industry attention for delivering advanced driver assistance at an unprecedented price point.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Postman's Five-Scope Variable Model Prevents Accidental Token Leaks

Postman environment variables have two value fields — initial and current — where initial values sync to Postman's servers and can be shared across workspaces, while current values remain local to a user's machine. A common security mistake occurs when developers paste sensitive tokens like Bearer credentials into the initial value field, which can then sync and become accessible to teammates or even public workspaces. Postman resolves variables through five scopes in order of precedence: local, data, environment, collection, and global, with the narrowest matching scope taking priority. To prevent leaks, secrets should always be stored in current values only, optionally masked using the secret variable type, or kept in Postman Vault for local encryption that never syncs. In CI pipelines, exported environment files should be sanitised before committing, with actual credentials injected at runtime from a secure secret store using tools like Newman's --env-var flag.

0 comments Read more at DEV Community