# OWASP Top 10 (2025) Ref

| ID | Risk | Mitigation |
|----|------|------------|
| A01 | **Broken Access Control** | Enforce permissions on every request. Deny by default. Use random IDs. |
| A02 | **Cryptographic Failures** | Encrypt data at rest/transit. Don't check in keys. Use strong algos. |
| A03 | **Injection** | Parameterize SQL. Sanitize HTML. Validate inputs (Zod). |
| A04 | **Insecure Design** | Threat model early. Rate limit. Secure defaults. |
| A05 | **Security Misconfiguration** | Harden headers. Disable default accounts. Automate config checks. |
| A06 | **Vulnerable Components** | `pnpm audit`. Weekly updates. Remove unused deps. |
| A07 | **Auth Failures** | Multi-factor auth. Strong password policy. Secure sessions. |
| A08 | **Integrity Failures** | Sign commits. Verify CI artifacts. Use SRI. |
| A09 | **Logging Failures** | Log auth events. Centralize logs. Monitor for anomalies. |
| A10 | **SSRF** | Validate URLs. Don't make arbitrary requests from user input. |
