Back
What is OWASP?
A short explainer for the OWASP labels in your scan report.
The short answer
OWASP is the Open Worldwide Application Security Project, a non-profit that publishes the most widely-used reference for web application security risks. Their flagship document is the OWASP Top 10 - a ranked list, refreshed every few years, of the most critical web application security risks based on real-world data from thousands of organizations.
When a finding in your scan shows an OWASP A0X tag (e.g. A03:2021), that's where it falls in the current Top 10. It tells you the category of risk, not the specific exploit.
The 2021 Top 10
- A01 - Broken Access Control. Users can act outside their permissions (read other users' data, modify, delete).
- A02 - Cryptographic Failures. Sensitive data exposed because of weak or missing encryption (HTTPS, password hashing, secret storage).
- A03 - Injection. User input ends up in a SQL query, command, or template without proper escaping (SQL injection, XSS).
- A04 - Insecure Design. Missing security controls in the architecture itself, not just bugs in the code.
- A05 - Security Misconfiguration. Default credentials, verbose errors, missing security headers, exposed admin panels.
- A06 - Vulnerable & Outdated Components. Libraries, frameworks, or services with known CVEs that haven't been patched.
- A07 - Identification & Authentication Failures. Weak passwords, broken session management, missing MFA, credential stuffing.
- A08 - Software & Data Integrity Failures. Trusting unverified data, plugins, or update sources.
- A09 - Security Logging & Monitoring Failures. Attacks happen and no one notices for weeks.
- A10 - Server-Side Request Forgery (SSRF). Server fetches a URL chosen by user input, gets used to reach internal services.
How findings map to OWASP
Each scan finding gets tagged with the OWASP category it most closely matches. A "Missing Content-Security-Policy" finding maps to A05 (Security Misconfiguration). A "Server Version Disclosed" finding also maps to A05. An outdated jQuery with known XSS CVEs maps to A06. The mapping is approximate - OWASP categories are broad, and a single misconfiguration can touch several.
Reading this because of an OWASP tag in your scan? Your full report is at
your dashboard.