OWASP Top 10 (2021) mapping
OWASP Top 10 (2021): 9 of 10 categories
15 rules map to 9 of 10 categories. The table also shows categories that static source or configuration checks cannot cover.
9 of 10 categories have compiled-in coverage
- 09 Categories coveredBacked by rules in the engine.
- 15 Rules mappedEach mapping is published and inspectable.
- ALL Unmapped categoriesEmpty categories remain visible in the table.
Reach describes how much of a category static source analysis
can see. Categories marked poor need runtime data or design
review.
| Category | Reach | Rules |
|---|---|---|
| A01:2021 Broken Access Control | partial | csrf-cross-origin-post, open-redirect |
| A02:2021 Cryptographic Failures | partial | weak-crypto |
| A03:2021 Injection | good | sql-injection |
| A04:2021 Insecure Design | poor | not reachable from source |
| A05:2021 Security Misconfiguration | good | cors-permissive, insecure-cookie, security-headers-missing, stack-trace-leak |
| A06:2021 Vulnerable and Outdated Components | partial | known-vulnerable-dependency, unpinned-dependency |
| A07:2021 Identification and Authentication Failures | partial | hardcoded-secret |
| A08:2021 Software and Data Integrity Failures | partial | ci-unpinned-action, install-lifecycle-script |
| A09:2021 Security Logging and Monitoring Failures | partial | sensitive-data-logged |
| A10:2021 Server-Side Request Forgery (SSRF) | good | ssrf |
Why A04 has no rules
Insecure Design covers choices such as a missing rate limit or an unsafe recovery flow. Those problems do not have a reliable AST pattern and need design review or runtime evidence.
The other taxonomy
Rules that read agent configuration map to OWASP ASI 2026 instead, and that table is separate because agent-config findings do not increase application Top 10 coverage.
npx owlwarden coverage # printed from the engine you have installedKeep reading
- owlwarden turnWhich of these did I just do?
- RulesTrigger, confidence, and framework-specific fix.
- Agent configHooks, MCP servers, instructions, and editor tasks.
- owlwarden vetCheck a repository before you open it.
- owlwarden sealNotice when your agent's execution surface moves.
- ExposureWhich of these findings do I fix first?
- RuntimesDoes this fix run on Bun, Deno, or Workers?
- CoverageMapped rules and categories static analysis cannot cover.