Software or Data Integrity Failures
Unsigned updates, insecure deserialization, and CI or dependency paths that accept code or data without an integrity check. Sibling to supply chain failures: this slot is the missing check, A03 is the ecosystem around it.
OWASP rank: 8
Practical checks
- Find parsers that turn data into objects or templates: uploads, webhooks, cache, session stores
- Check Subresource Integrity on third-party scripts that run in the app origin
- Ask whether an update or plugin path verifies a signature before executing
- A deserialization gadget is not impact until you show what the parser does with attacker-controlled data inside scope
- Keep tests on objects you created