The OWASP Top 10 is a widely recognized list of the most critical web application security risks. One example is Broken Access Control, where a user can access data or functionality they should not have permission to use. A common example is changing a URL from /profile/123 to /profile/124 and viewing another user's profile if authorization checks are missing. Best practices include implementing server-side authorization, least privilege, and regular security testing. Challenge: Research the 10 categories and explain why each poses a risk.