OWASP on Aby Georgehttps://abygeorgea.com/categories/owasp/Recent content in OWASP on Aby GeorgeHugoen-usTue, 01 Jul 2025 08:25:31 +1000Dependency and Secrets Scanning: Closing the Gap ZAP Doesn't Coverhttps://abygeorgea.com/blog/2025/07/01/dependency-and-secrets-scanning-in-cicd/Tue, 01 Jul 2025 08:25:31 +1000https://abygeorgea.com/blog/2025/07/01/dependency-and-secrets-scanning-in-cicd/Wiring dependency vulnerability scanning and secrets scanning into CI, catching supply chain and credential leak risks that API level testing never sees.Automating Security Regression with OWASP ZAP in CI/CDhttps://abygeorgea.com/blog/2025/06/17/automating-security-scans-with-owasp-zap/Tue, 17 Jun 2025 08:25:31 +1000https://abygeorgea.com/blog/2025/06/17/automating-security-scans-with-owasp-zap/Wiring OWASP ZAP's baseline and full scans into a CI pipeline, and triaging findings without drowning the team in false positives.Testing Authentication and Excessive Data Exposure in REST APIshttps://abygeorgea.com/blog/2025/06/03/testing-authentication-and-data-exposure-in-apis/Tue, 03 Jun 2025 08:25:31 +1000https://abygeorgea.com/blog/2025/06/03/testing-authentication-and-data-exposure-in-apis/Practical test cases for broken authentication and excessive data exposure, two of the more common OWASP API Security risks in Java REST APIs.Testing for Broken Object Level Authorization (BOLA)https://abygeorgea.com/blog/2025/05/20/testing-broken-object-level-authorization/Tue, 20 May 2025 08:25:31 +1000https://abygeorgea.com/blog/2025/05/20/testing-broken-object-level-authorization/Writing practical test cases for Broken Object Level Authorization, the top ranked OWASP API Security risk, against a Java REST API.Inside the OWASP API Security Top 10https://abygeorgea.com/blog/2025/05/06/owasp-api-security-top-10-overview/Tue, 06 May 2025 08:25:31 +1000https://abygeorgea.com/blog/2025/05/06/owasp-api-security-top-10-overview/Why the OWASP API Security Top 10 exists as a separate list from the general OWASP Top 10, and what it covers at a glance.