OWASP basics for website owners (no jargon version)

OWASP sounds like enterprise security theater. It's not. The OWASP Top 10 is basically a prioritized list of ways websites get hacked—and most items apply to small sites, not just banks.

1. Broken access control

Plain English: Pages or APIs that should be private are reachable by anyone.

Examples: /admin, /wp-admin, API keys in JavaScript, user IDs you can change in the URL to see someone else's data.

What we check: Admin path exposure, authentication surface hints, directory listings.

2. Security misconfiguration

Plain English: Default settings left on, debug mode in production, directory listing enabled, server banners leaking version info.

This is the most common category for vibe-coded apps because frameworks ship with dev-friendly defaults.

What we check: HTTP headers, error pages, exposed config files, server fingerprinting.

3. Injection (SQL, XSS, command)

Plain English: Your site trusts user input too much and runs it as code or queries.

A contact form, search box, or URL parameter can become an attack vector if output isn't sanitized.

What we check: Basic reflection probes, form surface mapping, input echo safety checks across crawled pages.

4. Cryptographic failures

Plain English: Weak TLS, expired certificates, mixed HTTP/HTTPS content.

What we check: Certificate validity, TLS configuration, redirect chains to HTTPS.

5. Vulnerable and outdated components

Plain English: WordPress 6.x with a plugin from 2019, or a JavaScript library with a known CVE.

What we check: CMS and technology fingerprinting, common vulnerability signals.

You don't need to memorize the list

Run periodic scans. Fix critical and high items first. Re-scan after every major deploy.

OWASP isn't homework—it's a shared vocabulary for "the stuff that actually breaks sites." VibeScan maps findings back to these categories so you know whether you're fixing a cosmetic header or a real attack surface.