Cette page existe en français. Voir en français
Esta página está disponible en español. Ver en español
Esta página está disponível em português. Ver em português
What's new
What's new in the question bank
Each batch of added or revised questions, with its OWASP Top 10:2025 family, its level and its origin. The text of the questions is never published here: it is kept for the assessments.
The question bank is updated regularly, following our security watch; last addition on 17 September 2026.
Data published by the application on 28 September 2026.
State of the bank
Questions by level
-
126
Beginner
-
130
Intermediate
-
118
Expert
With code to review
24%
The other questions cover the mechanisms you apply when you review.
Main languages of the code excerpts: JavaScript, Python, C#, Go, Java, PHP, SQL, TypeScript and YAML.
Coverage of the ten OWASP Top 10:2025 families
| OWASP family | Questions |
|---|---|
| A01 Broken Access Control | 32 |
| A02 Security Misconfiguration | 55 |
| A03 Software Supply Chain Failures | 42 |
| A04 Cryptographic Failures | 51 |
| A05 Injection | 36 |
| A06 Insecure Design | 41 |
| A07 Authentication Failures | 48 |
| A08 Software or Data Integrity Failures | 26 |
| A09 Security Logging and Alerting Failures | 26 |
| A10 Mishandling of Exceptional Conditions | 17 |
Batches, newest first
20 questions added
| Change | OWASP family | Level | Language | Origin |
|---|---|---|---|---|
| Added | A02 Security Misconfiguration | Beginner | No language specified | Written by the team |
| Added | A09 Security Logging and Alerting Failures | Beginner | No language specified | Written by the team |
| Added | A03 Software Supply Chain Failures | Beginner | No language specified | Written by the team |
| Added | A03 Software Supply Chain Failures | Beginner | No language specified | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Beginner | No language specified | Written by the team |
| Added | A02 Security Misconfiguration | Beginner | No language specified | Written by the team |
| Added | A01 Broken Access Control | Expert | No language specified | Written by the team |
| Added | A05 Injection | Expert | No language specified | Written by the team |
| Added | A04 Cryptographic Failures | Expert | No language specified | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Expert | No language specified | Written by the team |
| Added | A05 Injection | Expert | No language specified | Written by the team |
| Added | A06 Insecure Design | Expert | No language specified | Written by the team |
| Added | A01 Broken Access Control | Intermediate | No language specified | Written by the team |
| Added | A07 Authentication Failures | Intermediate | No language specified | Written by the team |
| Added | A09 Security Logging and Alerting Failures | Intermediate | No language specified | Written by the team |
| Added | A02 Security Misconfiguration | Intermediate | No language specified | Written by the team |
| Added | A05 Injection | Intermediate | No language specified | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Intermediate | No language specified | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Intermediate | No language specified | Written by the team |
| Added | A08 Software or Data Integrity Failures | Intermediate | No language specified | Written by the team |
33 questions revised
| Change | OWASP family | Level | Language | Origin |
|---|---|---|---|---|
| Revised | A05 Injection | Beginner | PHP | Rewording |
| Revised | A05 Injection | Beginner | JavaScript | Rewording |
| Revised | A04 Cryptographic Failures | Beginner | JavaScript | Rewording |
| Revised | A05 Injection | Beginner | Python | Rewording |
| Revised | A07 Authentication Failures | Beginner | JavaScript | Rewording |
| Revised | A05 Injection | Beginner | No language specified | Written by the team |
| Revised | A10 Mishandling of Exceptional Conditions | Beginner | No language specified | Written by the team |
| Revised | A10 Mishandling of Exceptional Conditions | Beginner | No language specified | Written by the team |
| Revised | A10 Mishandling of Exceptional Conditions | Beginner | No language specified | Written by the team |
| Revised | A10 Mishandling of Exceptional Conditions | Beginner | No language specified | Written by the team |
| Revised | A05 Injection | Expert | JavaScript | Rewording |
| Revised | A01 Broken Access Control | Expert | Go | Rewording |
| Revised | A06 Insecure Design | Expert | JavaScript | Rewording |
| Revised | A08 Software or Data Integrity Failures | Expert | YAML | Rewording |
| Revised | A04 Cryptographic Failures | Expert | Go | Rewording |
| Revised | A05 Injection | Expert | JavaScript | Rewording |
| Revised | A08 Software or Data Integrity Failures | Expert | JavaScript | Rewording |
| Revised | A03 Software Supply Chain Failures | Expert | No language specified | Written by the team |
| Revised | A02 Security Misconfiguration | Expert | JavaScript | Rewording |
| Revised | A10 Mishandling of Exceptional Conditions | Expert | No language specified | Written by the team |
| Revised | A03 Software Supply Chain Failures | Expert | No language specified | Written by the team |
| Revised | A07 Authentication Failures | Expert | No language specified | Written by the team |
| Revised | A06 Insecure Design | Expert | No language specified | Written by the team |
| Revised | A05 Injection | Intermediate | JavaScript | Rewording |
| Revised | A07 Authentication Failures | Intermediate | No language specified | Rewording |
| Revised | A02 Security Misconfiguration | Intermediate | No language specified | Rewording |
| Revised | A01 Broken Access Control | Intermediate | Python | Rewording |
| Revised | A02 Security Misconfiguration | Intermediate | YAML | Rewording |
| Revised | A02 Security Misconfiguration | Intermediate | JavaScript | Rewording |
| Revised | A06 Insecure Design | Intermediate | No language specified | Rewording |
| Revised | A02 Security Misconfiguration | Intermediate | No language specified | Rewording |
| Revised | A06 Insecure Design | Intermediate | No language specified | Rewording |
| Revised | A05 Injection | Intermediate | JavaScript | Rewording |
51 questions added
| Change | OWASP family | Level | Language | Origin |
|---|---|---|---|---|
| Added | A10 Mishandling of Exceptional Conditions | Beginner | Java | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Beginner | No language specified | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Beginner | No language specified | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Beginner | No language specified | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Beginner | No language specified | Written by the team |
| Added | A03 Software Supply Chain Failures | Beginner | JSON | Written by the team |
| Added | A03 Software Supply Chain Failures | Beginner | Dockerfile | Written by the team |
| Added | A03 Software Supply Chain Failures | Beginner | No language specified | Written by the team |
| Added | A03 Software Supply Chain Failures | Beginner | No language specified | Written by the team |
| Added | A01 Broken Access Control | Beginner | Java | Written by the team |
| Added | A04 Cryptographic Failures | Beginner | C# | Written by the team |
| Added | A09 Security Logging and Alerting Failures | Beginner | C# | Written by the team |
| Added | A05 Injection | Beginner | Python | Written by the team |
| Added | A02 Security Misconfiguration | Beginner | Python | Written by the team |
| Added | A09 Security Logging and Alerting Failures | Beginner | Go | Written by the team |
| Added | A07 Authentication Failures | Beginner | JavaScript | Written by the team |
| Added | A06 Insecure Design | Beginner | PHP | Written by the team |
| Added | A09 Security Logging and Alerting Failures | Beginner | TypeScript | Written by the team |
| Added | A08 Software or Data Integrity Failures | Beginner | TypeScript | Written by the team |
| Added | A08 Software or Data Integrity Failures | Beginner | PHP | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Expert | Go | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Expert | No language specified | Written by the team |
| Added | A03 Software Supply Chain Failures | Expert | YAML | Written by the team |
| Added | A03 Software Supply Chain Failures | Expert | No language specified | Written by the team |
| Added | A03 Software Supply Chain Failures | Expert | No language specified | Written by the team |
| Added | A07 Authentication Failures | Expert | C# | Written by the team |
| Added | A08 Software or Data Integrity Failures | Expert | Java | Written by the team |
| Added | A09 Security Logging and Alerting Failures | Expert | Java | Written by the team |
| Added | A06 Insecure Design | Expert | Go | Written by the team |
| Added | A01 Broken Access Control | Expert | Go | Written by the team |
| Added | A09 Security Logging and Alerting Failures | Expert | Python | Written by the team |
| Added | A06 Insecure Design | Expert | SQL | Written by the team |
| Added | A07 Authentication Failures | Expert | SQL | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Intermediate | C# | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Intermediate | Python | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Intermediate | No language specified | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Intermediate | No language specified | Written by the team |
| Added | A10 Mishandling of Exceptional Conditions | Intermediate | No language specified | Written by the team |
| Added | A03 Software Supply Chain Failures | Intermediate | Bash | Written by the team |
| Added | A03 Software Supply Chain Failures | Intermediate | No language specified | Written by the team |
| Added | A03 Software Supply Chain Failures | Intermediate | No language specified | Written by the team |
| Added | A01 Broken Access Control | Intermediate | C# | Written by the team |
| Added | A04 Cryptographic Failures | Intermediate | Java | Written by the team |
| Added | A07 Authentication Failures | Intermediate | Java | Written by the team |
| Added | A08 Software or Data Integrity Failures | Intermediate | C# | Written by the team |
| Added | A05 Injection | Intermediate | Go | Written by the team |
| Added | A01 Broken Access Control | Intermediate | Python | Written by the team |
| Added | A02 Security Misconfiguration | Intermediate | Python | Written by the team |
| Added | A07 Authentication Failures | Intermediate | PHP | Written by the team |
| Added | A06 Insecure Design | Intermediate | TypeScript | Written by the team |
| Added | A09 Security Logging and Alerting Failures | Intermediate | JavaScript | Written by the team |
See it for yourself
Four questions, no account needed. Your developers get twenty per assessment, drawn from this bank.