Secure Coding Principles (OWASP Top 10)
The most common vulnerabilities according to OWASP
The OWASP Top 10 is the most widely used reference for prioritizing web application security risks, and although it changes from edition to edition, certain categories stay constant: broken access control (letting a user access data that doesn't belong to them), injection (SQL, commands or other unvalidated data that ends up being executed), poor security configuration, and use of components with known vulnerabilities that haven't been updated. It's not a list to memorize but a guide for prioritizing effort: a team with limited resources gets more security value from systematically reviewing these categories than from trying to cover every possible vulnerability in a scattered way. Many of these flaws are prevented with simple practices, such as never trusting unvalidated input data and applying the principle of least privilege in every component.