# The OWASP Top 10, Explained

Somebody on your team says "we should check this against the OWASP Top 10," and you nod - but quietly, you're not sure what that *is*. A standard? A law? A scanner you're supposed to run? You've seen the acronym in security audits, compliance checklists, and job descriptions, always assumed you already know it.

Here's the relief: the OWASP Top 10 is not a test you can fail and not a tool you have to install. It's a **field guide to the usual suspects** - the handful of mistakes that account for most real-world break-ins, written down so the whole industry can point at the same list and use the same words.

## How to read this

- **Just need the lay of the land?** Phase 1 explains what OWASP and the Top 10 are in five minutes, and Phase 2 has a scannable table of the big categories - skim that and you'll hold your own in any security conversation.
- **Want it to actually stick?** Read in order. Each phase builds on the last: what the list *is*, what's *on it*, and how to *use it without lying to yourself*.

## The phases

1. **[What OWASP & the Top 10 Are](01-what-owasp-is.md)** - the nonprofit, the list, and why "a shared checklist and vocabulary" is the whole point.
2. **[The Big Categories, in Plain English](02-the-big-categories.md)** - a walk through the recurring risks, each as a one-line "what it is + the fix," with a scannable table.
3. **[How to Actually Use It](03-how-to-use-it.md)** - it's a checklist, not a guarantee: thread it into design, code review, and dependency updates, and avoid the trap of "we checked it once."

> Deep dives on individual risks live in their own guides - [SQL injection and XSS](/guides/sql-injection-and-xss), [authentication vs. authorization](/guides/auth-vs-authz), and [what security actually means](/guides/what-security-means). This guide is the map that points to all of them.