OWASP Top 10 for Vibe Coders: The Plain English Version

What Is the OWASP Top 10?

OWASP (Open Worldwide Application Security Project) is a nonprofit that publishes free security resources. Their Top 10 list, updated every few years (latest: 2021, with 2025 revision in progress), is the industry standard reference for web application security risks. It is used by companies of all sizes, required by compliance frameworks (PCI-DSS, SOC 2, ISO 27001), and expected knowledge for any software engineer.

According to OWASP's own data, the Top 10 categories account for over 90% of all web application vulnerabilities discovered in real-world assessments. The 2024 Veracode State of Software Security report found that 76% of applications had at least one flaw from the OWASP Top 10. For AI-generated applications, the percentage is likely higher because AI tools optimize for functionality, not security.

The OWASP Top 10 Mapped to AI Code Patterns

A01: Broken Access Control

This is number one for a reason: it appears in 94% of applications tested (OWASP data). In vibe-coded apps, it looks like this:

// ❌ BAD - No ownership check (any logged-in user can read any record)
app.get('/api/invoices/:id', auth, async (req, res) => {
  const invoice = await db.query('SELECT * FROM invoices WHERE id = $1', [req.params.id]);
  res.json(invoice);
});

// ✅ GOOD - Ownership check ensures users only access their own data
app.get('/api/invoices/:id', auth, async (req, res) => {
  const invoice = await db.query(
    'SELECT * FROM invoices WHERE id = $1 AND user_id = $2',
    [req.params.id, req.user.id]
  );
  if (!invoice) return res.status(404).json({ error: 'Not found' });
  res.json(invoice);
});

A03: Injection

The classic vulnerability. AI tools still generate string interpolation in database queries:

// ❌ BAD - SQL injection via string interpolation
const users = await db.query(`SELECT * FROM users WHERE name = '${req.body.name}'`);

// ✅ GOOD - Parameterized query
const users = await db.query('SELECT * FROM users WHERE name = $1', [req.body.name]);

A05: Security Misconfiguration

The most common pattern in AI-generated code is overly permissive CORS:

// ❌ BAD - Accepts requests from any origin
app.use(cors({ origin: '*' }));

// ✅ GOOD - Whitelist specific origins
app.use(cors({
  origin: ['https://myapp.com', 'https://staging.myapp.com'],
  credentials: true,
}));

How Many OWASP Issues Does Your App Have?

Based on patterns seen across thousands of AI-generated codebases:

How to Check Your App Against the OWASP Top 10

1. Run an automated scan. VibeDoctor (vibedoctor.io) checks your codebase and deployed site against patterns from every OWASP Top 10 category. It generates a report showing exactly which issues are present and how to fix them. Designed specifically for vibe-coded apps.
2. Fix critical items first. A01 (access control) and A03 (injection) cause the most damage. Focus there before moving to lower-severity items.
3. Add security headers. Addresses A05 (misconfiguration) and takes under 15 minutes with any framework.
4. Update dependencies. Run npm audit weekly to address A06 (vulnerable components).
5. Add authentication middleware to every API route that reads or writes user data. This is the single highest-impact fix.

FAQ