Incorrect order is applied? about api-security HOT 4 CLOSED

I agree entirely with your comments on the subject on some of the other issues.

An awareness document for the top vulnerabilities in APIs that omits the most serious vulnerabilities in APIs is ...challenging

from api-security.

Would love to see a table listing out the entries (along with the other important API risks I've mentioned) and the details of this calculation. I think it will make clear that the entries aren't the right ones.

from api-security.

For reference, the current scores look like:

I've heard lots of people suggest it's not an ordered list, completely unaware of the scoring used.

from api-security.

Whether they're aware of it or not, a massive amount of data science, led by Dr. Brian Glas, was performed for the main OWASP T10. I know for a fact the outcome represents months of work for a team of people. Read the methodology section in the document. https://owasp.org/Top10/A00_2021_Introduction/

My request was to do this exercise for the list of categories I suggested, in addition to these, so that we could see how you've rated all the risks side-by-side. It's very obvious to me that the risks here -- like mass assignment (infrequent, often harmless) are way less serious than the use of insecure libraries in APIs (incredibly prevalent, often highly dangerous).

I guess it doesn't matter since it's obvious. The remaining question is whether the API T10 will be changed to cover the top risks to APIs. Or will it remain a document that only includes risks not covered in the Main T10 and only for APIs written in the past few years.

from api-security.