OWASP Top 10 for AI Products: A Practical Mapping

The full executive answer

On the classic Top 10 — the industry's standard list of the ten most common web-application flaws — the big ones are covered structurally, not by after-the-fact review. Broken access control (the #1 flaw industry-wide): every endpoint authenticates, roles come from a central policy file, and tenant isolation is database-enforced with CI gates. Injection: every API input is validated against a strict schema (Zod) before use, and database access goes through a query builder, not hand-written SQL. Server-side request forgery: outbound fetches to user-supplied URLs pass a dedicated SSRF guard that blocks internal addresses. Add rate limiting, bot protection on public forms, timing-safe secret comparison, and upload file-type sniffing — each is a named module in our platform code with its own tests. Static code analysis (CodeQL) runs on every push and a weekly OWASP ZAP scan probes the running application.

The LLM Top 10 is where we're genuinely differentiated, because the product's core risk IS the AI. LLM01, prompt injection — where an attacker hides instructions in a document to hijack the AI: every piece of untrusted text passes through a neutraliser that strips six categories of injection patterns and redacts personal data before the model ever sees it. LLM02, insecure output handling: every AI response is validated against a typed schema before it touches the product — free-form model output never executes or renders raw. LLM09, overreliance: board-tier outputs run dual-provider consensus (Anthropic and OpenAI cross-check each other), every number in generated prose must trace to a licensed source or it's rejected, and the product is explicitly positioned as decision support with a human in the loop.

Honest edges: the ZAP dynamic scan is currently advisory rather than build-blocking while we curate its baseline, and independent validation of the whole map awaits the external pen test on the Q4 2026 roadmap. But the mapping itself isn't a slideware exercise — each control is a file I can show you, with tests, in the repository.