OWASP Top 10 Risk for Citizen Development - CD-SEC-02 Account Impersonation - Mitigation

Oct 13, 2026

Upload by Stanley

Explores the OWASP Citizen Development Top 10 Project, which identifies major security and governance risks that emerge when citizen developers build software using Low Code/No Code platforms, AI-assisted coding, and AI agents. Defines the scope from business users and hobbyists creating applications at scale, and clarifies the target audience of security professionals and citizen creators. Provides structured mitigations and explains how key risks manifest across these technologies.

LanguageEnglish

CategoryGeneral

FormatPDF

Pages40

Reading Time14 min

AccessFree to download

Overview

Scope

Audience

Mission

CD-SEC-01: Blind Trust

CD-SEC-02: Account Impersonation

CD-SEC-03: Authorization Misuse

CD-SEC-04: Sensitive Data Leakage and Handling Failures

CD-SEC-05: Authentication and Secure Communication Failures

CD-SEC-06: Vulnerable and Untrusted Components

CD-SEC-07: Security Misconﬁguration

CD-SEC-08: Injection Handling Failures

CD-SEC-09: Asset Management Failures

CD-SEC-10: Security Logging and Monitoring Failures

When Risks Become Reality

Acknowledgements

OWASP Top 10 Risk for Citizen Development Overview Since Gartner introduced the term “Citizen Developer” in 2009, advances in platforms such as Microsoft Power Platform, SAP, ServiceNow, and Salesforce, along with AI assisted tools like Base44, Cursor, and Replit, have enabled people across all backgrounds to build sophisticated software at scale. This movement has accelerated innovation but also raised new concerns around security and governance. The OWASP Citizen Development Top 10 Project addresses these challenges by identifying the most pressing risks that arise from citizen development of software built with Low Code No Code, AI assisted coding, and AI agent technologies. Scope Citizen developers can be business users improving eﬃciency in their daily work or hobbyists creating entirely new applications. By lowering barriers to entry, business innovation platforms and AI assisted technologies have redeﬁ ned how software is created, removing long standing resource constraints from traditional development teams. This expanded ability to create at scale introduces unique risks for organizations. Originally focused on Low Code No Code platforms, this OWASP project broadened its scope toreﬂect the wider landscape of citizen development and the technologies that enable it. The Top 10 risks therefore cover threats introduced through business innovation platforms, AI assisted coding, and AI agents. Audience The OWASP Top 10 Security Risks for Citizen Development is primarily aimed at security professionals who are tasked with enabling safe adoption of these technologies. They provide the critical guardrails that balance rapid innovation with secure practices. The project also speaks directly to citizen developers, giving them an understanding of how their work may create risks and how to avoid common pitfalls. Governance bodies gain structured recommendations to align oversight with organizational goals and regulatory requirements, strengthening accountability across citizen development initiatives. The key crossover focus for this document is to facilitate collaboration between the business and security and governance. Mission The mission of the OWASP Citizen Development Top 10 Project is to help organizations identify, prioritize, and mitigate risks tied to citizen development. The list explains how these risks manifest across various technologies and oﬀers concrete mitigations to reduce them. By providing accessible examples and guidance, the project equips both technical and nontechnical creators to make secure by default choices. Its goal is to establish the foundations that allow innovation to thrive while maintaining strong security practices. Table of Contents Overview 1 Scope 1 Audience 2 Mission 2 CD-SEC-01: Blind Trust 4 CD-SEC-02: Account Impersonation 9 CD-SEC-03: Authorization Misuse 12 CD-SEC-04: Sensitive Data Leakage and Handling Failures 15 CD-SEC-05: Authentication and Secure Communication Failures 19 CD-SEC-06: Vulnerable and Untrusted Components 22 CD-SEC-07: Security Misconﬁguration 25 CD-SEC-08: Injection Handling Failures 28 CD-SEC-09: Asset Management Failures 31 CD-SEC-10: Security Logging and Monitoring Failures 34 When Risks Become Reality 37 Microsoft Power Apps Portals Data Leak (2021) 37 Systemic AI Code Vulnerability Reports (2025) 38 Passion. io Breach (2025) 39 Acknowledgements 40 CD-SEC-01: Blind Trust Description Blind trust refers to the uncritical acceptance of outputs, recommendations, or artifacts produced by an automated system, platform, or model without independent veriﬁcation of their accuracy, integrity, or security. In software development contexts—particularly AI-assisted and low-code/ no-code environments—blind trust manifests when developers assume that system-generated code, templates, or components are inherently safe or correct, leading to overlooked vulnerabilities and systemic security risks. Blind Tr

FAQs

What risks does the OWASP Citizen Development Top 10 Project focus on?

It focuses on the most pressing security and governance risks that arise from citizen development of software built with Low Code/No Code, AI-assisted coding, and AI agent technologies.

Who is the intended audience for this document?

Primarily security professionals responsible for enabling safe adoption, with additional guidance for citizen developers and governance bodies aligning oversight with organizational and regulatory requirements.

What does “blind trust” mean in low-code/no-code and AI-assisted development?

It refers to uncritical acceptance of outputs and artifacts from automated systems or models without independent verification, which can lead to overlooked vulnerabilities and insecure defaults.

Oct 13, 2026

Upload by Stanley