Yeah, that caught me by surprise. Based on the title, I was expecting something more like the OWASP top 10 -- something I could consult while doing a security r

Yeah, that caught me by surprise. Based on the title, I was expecting something more like the OWASP top 10 -- something I could consult while doing a security review of a web application I'm developing.