[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-572220-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-572220-en":126},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","owasp-top-10-risk-for-citizen-development-cd-sec-02-account-impersonation-mitigation","OWASP Top 10 Risk for Citizen Development - CD-SEC-02 Account Impersonation - Mitigation","","Explores the OWASP Citizen Development Top 10 Project, which identifies major security and governance risks that emerge when citizen developers build software using Low Code/No Code platforms, AI-assisted coding, and AI agents. Defines the scope from business users and hobbyists creating applications at scale, and clarifies the target audience of security professionals and citizen creators. Provides structured mitigations and explains how key risks manifest across these technologies.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/general/","General",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/owasp-top-10-risk-for-citizen-development-cd-sec-02-account-impersonation-mitigation/572220/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/owasp-top-10-risk-for-citizen-development-cd-sec-02-account-impersonation-mitigation/572220.png","ImageObject",442,249,{"name":42,"@type":43},"Stanley","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-22","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",5,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What risks does the OWASP Citizen Development Top 10 Project focus on?","Question",{"text":63,"@type":64},"It focuses on the most pressing security and governance risks that arise from citizen development of software built with Low Code/No Code, AI-assisted coding, and AI agent technologies.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"Who is the intended audience for this document?",{"text":68,"@type":64},"Primarily security professionals responsible for enabling safe adoption, with additional guidance for citizen developers and governance bodies aligning oversight with organizational and regulatory requirements.",{"name":70,"@type":61,"acceptedAnswer":71},"What does “blind trust” mean in low-code/no-code and AI-assisted development?",{"text":72,"@type":64},"It refers to uncritical acceptance of outputs and artifacts from automated systems or models without independent verification, which can lead to overlooked vulnerabilities and insecure defaults.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},572220,1792164816,{"code":4,"msg":82,"data":83},"success",[84,89,94,99,104,109,114,119,123],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":86,"show_sort_weight":87,"slug":88},11,"Presentations",90,"presentations",{"id":90,"doc_module":22,"doc_module_name":25,"category_name":91,"show_sort_weight":92,"slug":93},12,"Resumes",80,"resumes",{"id":95,"doc_module":22,"doc_module_name":25,"category_name":96,"show_sort_weight":97,"slug":98},14,"Invoices",70,"invoices",{"id":100,"doc_module":22,"doc_module_name":25,"category_name":101,"show_sort_weight":102,"slug":103},15,"Posters",60,"posters",{"id":105,"doc_module":22,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},16,"Social Media",50,"social-media",{"id":110,"doc_module":22,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},17,"Forms",40,"forms",{"id":115,"doc_module":22,"doc_module_name":25,"category_name":116,"show_sort_weight":117,"slug":118},18,"Letters",30,"letters",{"id":120,"doc_module":22,"doc_module_name":25,"category_name":121,"show_sort_weight":55,"slug":122},21,"Paper Templates","papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":4,"slug":125},158,"general-158",{"code":4,"msg":82,"data":127},{"doc_id":79,"user_id":128,"nickname":42,"user_avatar":129,"doc_module":22,"category_id":124,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":112,"language":135,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":12,"update_tm":139,"read_time":95},2336477405376,"https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","OWASP Top 10 Risk for Citizen Development  \nOverview  \nSince Gartner introduced the term “Citizen Developer” in 2009, advances in platforms such as Microsoft Power Platform, SAP, ServiceNow, and Salesforce, along with AI assisted tools like Base44, Cursor, and Replit, have enabled people across all backgrounds to build sophisticated software at scale.  \nThis movement has accelerated innovation but also raised new concerns around security and governance. The OWASP Citizen Development Top 10 Project addresses these challenges by identifying the most pressing risks that arise from citizen development of software built with Low Code No Code, AI assisted coding, and AI agent technologies.  \nScope  \nCitizen developers can be business users improving efficiency in their daily work or hobbyists creating entirely new applications. By lowering barriers to entry, business innovation platforms and AI assisted technologies have redefi ned how software is created, removing long standing resource constraints from traditional development teams.  \nThis expanded ability to create at scale introduces unique risks for organizations. Originally focused on Low Code No Code platforms, this OWASP project broadened its scope toreflect the wider landscape of citizen development and the technologies that enable it. The Top 10 risks therefore cover threats introduced through business innovation platforms, AI assisted coding, and AI agents.  \nAudience  \nThe OWASP Top 10 Security Risks for Citizen Development is primarily aimed at security professionals who are tasked with enabling safe adoption of these technologies. They provide the critical guardrails that balance rapid innovation with secure practices.  \nThe project also speaks directly to citizen developers, giving them an understanding of how their work may create risks and how to avoid common pitfalls. Governance bodies gain structured recommendations to align oversight with organizational goals and regulatory requirements, strengthening accountability across citizen development initiatives.  \nThe key crossover focus for this document is to facilitate collaboration between the business and security and governance.  \nMission  \nThe mission of the OWASP Citizen Development Top 10 Project is to help organizations identify, prioritize, and mitigate risks tied to citizen development. The list explains how these risks manifest across various technologies and offers concrete mitigations to reduce them.  \nBy providing accessible examples and guidance, the project equips both technical and nontechnical creators to make secure by default choices. Its goal is to establish the foundations that allow innovation to thrive while maintaining strong security practices.  \nTable of Contents  \nOverview 1  \nScope 1  \nAudience 2  \nMission 2  \nCD-SEC-01: Blind Trust 4  \nCD-SEC-02: Account Impersonation 9  \nCD-SEC-03: Authorization Misuse 12  \nCD-SEC-04: Sensitive Data Leakage and Handling Failures 15  \nCD-SEC-05: Authentication and Secure Communication Failures 19  \nCD-SEC-06: Vulnerable and Untrusted Components 22  \nCD-SEC-07: Security Misconfiguration 25  \nCD-SEC-08: Injection Handling Failures 28  \nCD-SEC-09: Asset Management Failures 31  \nCD-SEC-10: Security Logging and Monitoring Failures 34  \nWhen Risks Become Reality 37  \nMicrosoft Power Apps Portals Data Leak (2021) 37  \nSystemic AI Code Vulnerability Reports (2025) 38  \nPassion. io Breach (2025) 39  \nAcknowledgements 40  \nCD-SEC-01: Blind Trust  \nDescription  \nBlind trust refers to the uncritical acceptance of outputs, recommendations, or artifacts produced by an automated system, platform, or model without independent verification of their accuracy, integrity, or security. In software development contexts—particularly  \nAI-assisted and low-code/ no-code environments—blind trust manifests when developers assume that system-generated code, templates, or components are inherently safe or correct, leading to overlooked vulnerabilities and systemic security risks.  \nBlind Tr","cbCaijLjrvbPk0Sr","https://ap.wps.com/l/cbCaijLjrvbPk0Sr","pdf",850583,"English","# Overview\n# Scope\n# Audience\n# Mission\n# CD-SEC-01: Blind Trust\n# CD-SEC-02: Account Impersonation\n# CD-SEC-03: Authorization Misuse\n# CD-SEC-04: Sensitive Data Leakage and Handling Failures\n# CD-SEC-05: Authentication and Secure Communication Failures\n# CD-SEC-06: Vulnerable and Untrusted Components\n# CD-SEC-07: Security Misconfiguration\n# CD-SEC-08: Injection Handling Failures\n# CD-SEC-09: Asset Management Failures\n# CD-SEC-10: Security Logging and Monitoring Failures\n# When Risks Become Reality\n# Acknowledgements","[{\"question\":\"What risks does the OWASP Citizen Development Top 10 Project focus on?\",\"answer\":\"It focuses on the most pressing security and governance risks that arise from citizen development of software built with Low Code/No Code, AI-assisted coding, and AI agent technologies.\"},{\"question\":\"Who is the intended audience for this document?\",\"answer\":\"Primarily security professionals responsible for enabling safe adoption, with additional guidance for citizen developers and governance bodies aligning oversight with organizational and regulatory requirements.\"},{\"question\":\"What does “blind trust” mean in low-code/no-code and AI-assisted development?\",\"answer\":\"It refers to uncritical acceptance of outputs and artifacts from automated systems or models without independent verification, which can lead to overlooked vulnerabilities and insecure defaults.\"}]","OWASP Top 10 Risk for Citizen Development - CD-SEC-02 Account Impersonation - Mitigation | PDF",1791926220]