Notifications
Clear all
Topic starter
02/08/2026 9:44 am
TL;DR: OWASP’s 2025 Top 10 adds Software Supply Chain Failures and Mishandling of Exceptional Conditions, while rolling SSRF into Broken Access Control, reflecting a broader shift from code-only risk toward lifecycle and access-control failures, according to Semgrep’s analysis. The practical takeaway is that AppSec programmes now need to govern build integrity, exception handling, and access paths alongside traditional vulnerability classes.
NHIMG editorial — based on content published by Semgrep: the OWASP Foundation’s 2025 Top 10 release and Semgrep’s analysis of the implications for application security
By the numbers:
- Semgrep contributed insights derived from 127M security findings, 340k repositories, and 13k organizations.
- Semgrep updated all 4,000+ Semgrep rules to use the new OWASP Top 10 mappings.
Questions worth separating out
Q: How should security teams govern software supply chain risk in application delivery?
A: Treat software supply chain risk as a lifecycle control problem, not just a vulnerability-management issue.
Q: Why does SSRF belong in access control discussions?
A: SSRF matters because it can make a trusted service send requests that the attacker could not send directly.
Q: What do security teams get wrong about exception handling?
A: Many teams treat exception handling as a reliability concern and stop there.
Practitioner guidance
- Map pipeline identities to supply chain trust paths Inventory every CI/CD service account, deployment token, and signing credential that can alter build artefacts or release packages.
- Test exception paths for data leakage Add security tests for verbose error messages, stack traces, and crash behaviour in pre-production and production-like environments.
- Re-classify SSRF as an authorisation issue Review service-to-service request flows, metadata access, and internal callbacks as permission boundaries rather than only as network paths.
What's in the full article
Semgrep's full article covers the operational detail this post intentionally leaves for the source:
- Rule-by-rule OWASP 2025 mapping changes across Semgrep’s 4,000+ rules, useful for teams updating scanning workflows
- Examples of how specific findings are re-categorised under the new Top 10 structure, including injection and access control
- Context on how the new taxonomy affects practitioners using the Semgrep AppSec Platform
- Links to the updated Semgrep Registry mappings for implementation teams that need to operationalise the changes
👉 Read Semgrep’s analysis of the 2025 OWASP Top 10 changes →
OWASP Top 10 2025: what appsec teams need to change now?
Explore further
02/08/2026 12:37 pm
Software supply chain risk is now an identity problem as much as a code problem. The new OWASP category reflects how much of application trust depends on service accounts, CI/CD tokens, and automation credentials. Once those identities are over-scoped or poorly governed, attackers can tamper with builds, packages, or updates without needing a traditional exploit chain. The control gap is no longer only code review. It is also whether machine identities are constrained enough to protect the software lifecycle.
A question worth separating out:
Q: What is the difference between code-level bugs and software supply chain failures?
A: Code-level bugs live inside the application, while software supply chain failures affect the artefacts, dependencies, and update paths that deliver the application. The difference matters because a secure codebase can still ship compromised software if the build or dependency chain is not trusted. Teams need controls that cover provenance, signing, and release governance, not only static analysis.
👉 Read our full editorial: OWASP Top 10 2025 shifts appsec risk toward supply chains
