OWASP Top 10 (2025 List) for Python Devs - Talk Python to Me Ep. 545
The OWASP Top 10 just got a fresh update, and there are some big changes: supply chain attacks, exceptional condition handling, and more. Tanya Janca is back on Talk Python to walk us through every single one of them. And we're not just talking theory, we're going to turn Claude Code loose on a real open source project and see what it finds. Let's do it. ▬▬▬▬ About the podcast ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ This video is the uncut, live recording of the Talk Python To Me podcast ( https://talkpython.fm ). We cover Python-focused topics every week and publish the edited and polished version in audio form. Subscribe in your podcast player of choice (100% free) at https://talkpython.fm/subscribe. ▬▬▬▬ Guests ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ Tanya Janca ▬▬▬▬ Links and resources from the show ▬▬▬▬▬▬▬▬▬▬▬▬ DevSec Station Podcast: https://www.devsecstation.com/ SheHacksPurple Newsletter: https://newsletter.shehackspurple.ca/ owasp.org: https://owasp.org owasp.org/Top10/2025: https://owasp.org/Top10/2025/ from here: https://github.com/awesome-selfhosted/awesome-selfhosted Kinto: https://github.com/Kinto/kinto A01:2025 - Broken Access Control: https://owasp.org/Top10/2025/A01_2025-Broken_Access_Control/ A02:2025 - SecuA02 Security Misconfiguration: https://owasp.org/Top10/2025/A02_2025-Security_Misconfiguration/ ASP.NET: https://ASP.NET A03:2025 - Software Supply Chain Failures: https://owasp.org/Top10/2025/A03_2025-Software_Supply_Chain_Failures/ A04:2025 - Cryptographic Failures: https://owasp.org/Top10/2025/A04_2025-Cryptographic_Failures/ A05:2025 - Injection: https://owasp.org/Top10/2025/A05_2025-Injection/ A06:2025 - Insecure Design: https://owasp.org/Top10/2025/A06_2025-Insecure_Design/ A07:2025 - Authentication Failures: https://owasp.org/Top10/2025/A07_2025-Authentication_Failures/ A08:2025 - Software or Data Integrity Failures: https://owasp.org/Top10/2025/A08_2025-Software_or_Data_Integrity_Failures/ A09:2025 - Security Logging and Alerting Failures: https://owasp.org/Top10/2025/A09_2025-Security_Logging_and_Alerting_Failures/ A10 Mishandling of Exceptional Conditions: https://owasp.org/Top10/2025/A10_2025-Mishandling_of_Exceptional_Conditions/ https://github.com/KeygraphHQ/shannon: https://github.com/KeygraphHQ/shannon anthropic.com/news/mozilla-firefox-security: https://www.anthropic.com/news/mozilla-firefox-security generalpurpose.com/the-distillation/claude-mythos-what-it-means-for-your-business: https://www.generalpurpose.com/the-distillation/claude-mythos-what-it-means-for-your-business Python Example Concepts: https://blobs.talkpython.fm/owasp-top-10-2025-python-example-concepts.html ▬▬▬▬ Dive deeper ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ Listen to the Talk Python To Me podcast at https://talkpython.fm and explore over 275 hours of Python courses at https://training.talkpython.fm/courses. ▬▬▬▬ Follow us on Social ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ Mastodon: Michael - https://fosstodon.org/@mkennedy & Talk Python - https://fosstodon.org/@talkpython Bluesky: Michael - https://bsky.app/profile/mkennedy.codes & Talk Python - https://bsky.app/profile/talkpython.fm X: Michael - https://x.com/mkennedy & Talk Python - https://x.com/talkpython