Several community references anchor day-to-day security work. The OWASP Top 10 is a regularly updated list of the ten most critical web application security risks, published by the Open Worldwide Application Security Project. Common Weakness Enumeration (CWE) is a community-developed catalog of software and hardware weaknesses, each with a unique CWE-ID, while Common Vulnerabilities and Exposures (CVE) assigns unique IDs to publicly known vulnerabilities. The Common Vulnerability Scoring System (CVSS) scores each vulnerability on a 0.0–10.0 scale based on impact, exploitability, and scope. Together, these help prioritize patches, communicate risk, and standardize reporting across teams and vendors.
Threat modeling frameworks such as STRIDE categorize what can go wrong for each system element into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege, while DREAD scores each threat on Damage, Reproducibility, Exploitability, Affected users, and Discoverability. More broadly, modern systems embrace zero trust architecture — assuming no implicit trust based on network location and verifying identity, device, and context for every request — and tightly manage the attack surface, meaning every endpoint, parameter, and API that accepts user input.
Token-based APIs have their own pitfalls. API keys are opaque long-lived identifiers identifying the calling application, while OAuth tokens (often JWTs) are scoped, time-limited credentials representing delegated user access. Putting authorization-relevant claims like roles in a JWT is dangerous if the server does not re-check them server-side, because clients cannot be trusted. Classic JWT issues include alg=none acceptance (allowing unsigned tokens) and key confusion between HS and RS algorithms, where a public RSA key gets used as an HMAC secret. Defensive tokens carry explicit aud (audience) claims so a token issued for service A is rejected by service B, iss (issuer) claims so relying parties accept only trusted issuers, and nbf/exp time-window claims so a leaked token has a bounded lifetime. Refresh tokens extend sessions but must be stored and rotated securely. Outside JWTs, HMAC-signed webhooks let receivers verify both integrity and authenticity of callbacks, and signature comparisons must run in constant time to prevent timing oracles. Nonces are single-use, server-tracked values that prevent replay of captured requests, and signed requests should include a bounded timestamp window so a captured signature cannot be reused indefinitely. Finally, logs often outlive production data paths and are far more widely accessed: secrets, Authorization headers, and tokens should never be logged in the clear, and detailed internal error messages should be avoided in user-facing responses because they leak infrastructure, query, and validation details useful to attackers.