The OWASP Top 10 just got a fresh update, and there are some big changes: supply chain attacks, exceptional condition handling, and more. Tanya Janca is back on Talk Python to walk us through every single one of them. And we're not just talking theory, we're going to turn Claude Code loose on a real open source project and see what it finds. Let's do it. 
 
Episode sponsors 
 
<a href='https://talkpython.fm/temporal-replay'>Temporal</a>
<a href='https://talkpython.fm/training'>Talk Python Courses</a> 
 
<h2 class="links-heading mb-4">Links from the show</h2>
<div>DevSec Station Podcast: <a href="https://www.devsecstation.com/?featured_on=talkpython" target="_blank" >www.devsecstation.com</a> 
SheHacksPurple Newsletter: <a href="https://newsletter.shehackspurple.ca/?featured_on=talkpython" target="_blank" >newsletter.shehackspurple.ca</a> 
owasp.org: <a href="https://owasp.org?featured_on=talkpython" target="_blank" >owasp.org</a> 
owasp.org/Top10/2025: <a href="https://owasp.org/Top10/2025/?featured_on=talkpython" target="_blank" >owasp.org</a> 
from here: <a href="https://github.com/awesome-selfhosted/awesome-selfhosted?featured_on=talkpython" target="_blank" >github.com</a> 
Kinto: <a href="https://github.com/Kinto/kinto?featured_on=talkpython" target="_blank" >github.com</a> 
A01:2025 - Broken Access Control: <a href="https://owasp.org/Top10/2025/A01_2025-Broken_Access_Control/?featured_on=talkpython" target="_blank" >owasp.org</a> 
A02:2025 - SecuA02 Security Misconfiguration: <a href="https://owasp.org/Top10/2025/A02_2025-Security_Misconfiguration/?featured_on=talkpython" target="_blank" >owasp.org</a> 
ASP.NET: <a href="https://ASP.NET?featured_on=talkpython" target="_blank" >ASP.NET</a> 
A03:2025 - Software Supply Chain Failures: <a href="https://owasp.org/Top10/2025/A03_2025-Software_Supply_Chain_Failures/?featured_on=talkpython" target="_blank" >owasp.org</a> 
A04:2025 - Cryptographic Failures: <a href="https://owasp.org/Top10/2025/A04_2025-Cryptographic_Failures/?featured_on=talkpython" target="_blank" >owasp.org</a> 
A05:2025 - Injection: <a href="https://owasp.org/Top10/2025/A05_2025-Injection/?featured_on=talkpython" target="_blank" >owasp.org</a> 
A06:2025 - Insecure Design: <a href="https://owasp.org/Top10/2025/A06_2025-Insecure_Design/?featured_on=talkpython" target="_blank" >owasp.org</a> 
A07:2025 - Authentication Failures: <a href="https://owasp.org/Top10/2025/A07_2025-Authentication_Failures/?featured_on=talkpython" target="_blank" >owasp.org</a> 
A08:2025 - Software or Data Integrity Failures: <a href="https://owasp.org/Top10/2025/A08_2025-Software_or_Data_Integrity_Failures/?featured_on=talkpython" target="_blank" >owasp.org</a> 
A09:2025 - Security Logging and Alerting Failures: <a href="https://owasp.org/Top10/2025/A09_2025-Security_Logging_and_Alerting_Failures/?featured_on=talkpython" target="_blank" >owasp.org</a> 
A10 Mishandling of Exceptional Conditions: <a href="https://owasp.org/Top10/2025/A10_2025-Mishandling_of_Exceptional_Conditions/?featured_on=talkpython" target="_blank" >owasp.org</a> 
https://github.com/KeygraphHQ/shannon: <a href="https://github.com/KeygraphHQ/shannon?featured_on=talkpython" target="_blank" >github.com</a> 
anthropic.com/news/mozilla-firefox-security: <a href="https://www.anthropic.com/news/mozilla-firefox-security?featured_on=talkpython" target="_blank" >www.anthropic.com</a> 
generalpurpose.com/the-distillation/claude-mythos-what-it-means-for-your-business: <a href="https://www.generalpurpose.com/the-distillation/claude-mythos-what-it-means-for-your-business?featured_on=talkpython" target="_blank" >www.generalpurpose.com</a> 
Python Example Concepts: <a href="https://blobs.talkpython.fm/owasp-top-10-2025-python-example-concepts.html" target="_blank" >blobs.talkpython.fm</a> 
 
Watch this episode on YouTube: <a href="https://www.youtube.com/watch?v=ffid3jWA0JE" target="_blank" >youtube.com</a> 
Episode #545 deep-dive: <a href="https://talkpython.fm/episodes/show/545/owasp-top-10-2025-list-for-python-devs#takeaways-anchor" target="_blank" >talkpython.fm/545</a> 
Episode transcripts: <a href="https://talkpython.fm/episodes/transcript/545/owasp-top-10-2025-list-for-python-devs" target="_blank" >talkpython.fm</a> 
 
Theme Song: Developer Rap 
🥁 Served in a Flask 🎸: <a href="https://talkpython.fm/flasksong" target="_blank" >talkpython.fm/flasksong</a> 
 
---== Don't be a stranger ==--- 
YouTube: <a href="https://talkpython.fm/youtube" target="_blank" > youtube.com/@talkpython</a> 
 
Bluesky: <a href="https://bsky.app/profile/talkpython.fm" target="_blank" >@talkpython.fm</a> 
Mastodon: <a href="https://fosstodon.org/web/@talkpython" target="_blank" > @talkpython@fosstodon.org</a> 
X.com: <a href="https://x.com/talkpython" target="_blank" > @talkpython</a> 
 
Michael on Bluesky: <a href="https://bsky.app/profile/mkennedy.codes?featured_on=talkpython" target="_blank" >@mkennedy.codes</a> 
Michael on Mastodon: <a href="https://fosstodon.org/web/@mkennedy" target="_blank" > @mkennedy@fosstodon.org</a> 
Michael on X.com: <a href="https://x.com/mkennedy?featured_on=talkpython" target="_blank" > @mkennedy</a> </div>

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

#545: OWASP Top 10 (2025 List) for Python Devs

Talk Python To Me

AI Chapters

AI Insights

Reviews