Making the OWASP top ten in the vibe code era
Ryan welcomes back Tanya Janca, now part of the OWASP Top 10 team, to discuss what changed in the latest OWASP Top 10 release, how the list shifted from “outdated components” to a broader software supply chain focus, and why they added memory safety and vibe-coding as awareness items.
Episode notes:
The OWASP Top 10 for 2025 is the latest standard awareness document for developers and web application security that represents a broad consensus about the most critical security risks to web applications.
Learn more about Tanya’s work at her website and her new podcast DevSec Station. You can learn how to prompt your AI for secure code with her prompt library.
Read Tanya’s articles on our blog.
Congrats to Populist badge winner Rob Kielty for winning the badge on their answer to How can I tell IntelliJ's "Find in Files" to ignore generated files?.
TRANSCRIPT
See Privacy Policy at https://art19.com/privacy and California Privacy Notice at https://art19.com/privacy#do-not-sell-my-info.
#545: OWASP Top 10 (2025 List) for Python Devs
The OWASP Top 10 just got a fresh update, and there are some big changes: supply chain attacks, exceptional condition handling, and more. Tanya Janca is back on Talk Python to walk us through every single one of them. And we're not just talking theory, we're going to turn Claude Code loose on a real open source project and see what it finds. Let's do it.
Episode sponsors
Temporal
Talk Python Courses
Links from the show
DevSec Station Podcast: www.devsecstation.com
SheHacksPurple Newsletter: newsletter.shehackspurple.ca
owasp.org: owasp.org
owasp.org/Top10/2025: owasp.org
from here: github.com
Kinto: github.com
A01:2025 - Broken Access Control: owasp.org
A02:2025 - SecuA02 Security Misconfiguration: owasp.org
ASP.NET: ASP.NET
A03:2025 - Software Supply Chain Failures: owasp.org
A04:2025 - Cryptographic Failures: owasp.org
A05:2025 - Injection: owasp.org
A06:2025 - Insecure Design: owasp.org
A07:2025 - Authentication Failures: owasp.org
A08:2025 - Software or Data Integrity Failures: owasp.org
A09:2025 - Security Logging and Alerting Failures: owasp.org
A10 Mishandling of Exceptional Conditions: owasp.org
https://github.com/KeygraphHQ/shannon: github.com
anthropic.com/news/mozilla-firefox-security: www.anthropic.com
generalpurpose.com/the-distillation/claude-mythos-what-it-means-for-your-business: www.generalpurpose.com
Python Example Concepts: blobs.talkpython.fm
Watch this episode on YouTube: youtube.com
Episode #545 deep-dive: talkpython.fm/545
Episode transcripts: talkpython.fm
Theme Song: Developer Rap
🥁 Served in a Flask 🎸: talkpython.fm/flasksong
---== Don't be a stranger ==---
YouTube: youtube.com/@talkpython
Bluesky: @talkpython.fm
Mastodon: @talkpython@fosstodon.org
X.com: @talkpython
Michael on Bluesky: @mkennedy.codes
Michael on Mastodon: @mkennedy@fosstodon.org
Michael on X.com: @mkennedy
165: Tanya
Tanya Janca is a globally recognized AppSec (application security) expert and founder of We Hack Purple. In this episode, she shares wild stories from the front lines of cybersecurity. She shares stories of when she was a penetration tester to an incident responder.
You can sign up for her newsletter at https://newsletter.shehackspurple.ca/
Sponsors
Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com.
This episode is sponsored by Hims. Hims offers access to ED treatment options ranging from trusted generics that cost up to 95% less than brand names to Hard Mints, if prescribed. To get simple, online access to personalized, affordable care for ED, Hair Loss, Weight Loss, and more, visit https://hims.com/darknet.
Support for this show comes from Drata. Drata is the trust management platform that uses AI-driven automation to modernize governance, risk, and compliance, helping thousands of businesses stay audit-ready and scale securely. Learn more at drata.com/darknetdiaries.
View all active sponsors.
Books
Alice and Bob Learn Secure Coding by Tanya Janca
Alice and Bob Learn Application Security by Tanya Janca
Secure coding beyond just memory safety
Semgrep is an AppSec platform that lets devs deploy static application security testing (SAST), software composition analysis (SCA), and secret scans. Explore their docs.
Tanya is the author of Alice and Bob Learn Secure Coding and Alice and Bob Learn Application Security.
She’s also written for our blog:Three layers to secure a software development organization and Continuous delivery, meet continuous security.
Secure coding might be an issue of national security.
Follow Tanya on LinkedIn or check out her website.
Stack Overflow user Reishin earned a Populist badge with their answer to piping from stdin to a python code in a bash script.
See Privacy Policy at https://art19.com/privacy and California Privacy Notice at https://art19.com/privacy#do-not-sell-my-info.
#485: Secure coding for Python with SheHacksPurple
See the full show notes for this episode on the website at talkpython.fm/485
Building Secure Applications with Tanya Janca
About Tanya Janca
Tanya Janca is the co-founder and CEO of Security Sidekick. Her obsession with securing software runs deep, from starting her company, to running her own OWASP chapter for 4 years and founding the OWASP DevSlop open-source and education project. With her countless blog articles, workshops and talks, her focus is clear. Tanya is also an advocate for diversity and inclusion, co-founding the international women’s organization WoSEC, starting the online #MentoringMonday initiative, and personally mentoring, advocating for and enabling countless other women in her field. As a professional computer geek of 20+ years, she is a person who is truly fascinated by the ‘science’ of computer science.
Links
Twitter Username: @shehackspurple
LinkedIn URL: https://www.linkedin.com/in/tanya-janca-60ab0998/
Personal site: https://dev.to/shehackspurple
Company site: https://securitysidekick.dev
Sponsor: www.manifold.co