{
  "id": 3687356,
  "title": "OWASP A03 & A04: Understanding Software Supply Chain and Cryptographic Failures",
  "url": "https://urgent.news/2026/08/27/owasp-a03-a04-understanding-software-supply-chain-and-cryptographic",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-27T06:30:34.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/samyuktha_saravanan_97001/owasp-a03-a04-understanding-software-supply-chain-and-cryptographic-failures-4cmd"
  },
  "original_language": "en",
  "account": "The OWASP A03 and A04 categories address software supply chain and cryptographic failures, respectively. A03 focuses on vulnerabilities introduced through third-party dependencies, insecure build pipelines, and unverified components. A04 covers inadequate protection of sensitive information, including improper encryption, insecure data transmission, and unprotected storage.\n\nThe author examines an authorized web application to illustrate these concepts in practice. For A03, the author reviewed client-side resources, including JavaScript files, CSS, JavaScript and asset files, external runtime resources like Google Fonts, and external references like social media and app-store links. No obvious third-party imports or compromised components were identified, so no A03 finding was confirmed.\n\nFor A04, the author assessed the application's adherence to HTTPS, checked for sensitive data in URLs, Local Storage and Session Storage, and cookie attributes. The application redirected successfully to HTTPS, no sensitive information was found in URLs, and no authentication data appeared in Local or Session Storage. However, the author could not fully assess authentication cookie attributes as the production backend was not fully built out. Additionally, the author could not test real login and dashboard functionality due to the demo status of the available resources. No A04 cryptographic failures were confirmed within the accessible functionality.",
  "summary": "By Samyuktha Introduction Some categories in the OWASP Top 10 are about what's broken in your own code. A03 and A04 are about something a little different — whether you can trust what your application depends on, and whether sensitive data is actually protected wherever it lives or travels. This post covers what I learned about both categories, and how I applied that thinking to an authorized web…",
  "key_points": [
    "OWASP A03 focuses on vulnerabilities from third-party dependencies and insecure build pipelines",
    "A04 addresses inadequate protection of sensitive information like encryption and data transmission"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}