Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP Beyond the Top 10: API Security, LLM Top 10, ASVS and the Cheat Sheet Series
We step outside the Top 10: the API Security Top 10 (2023) and the split between BOLA, BOPLA and BFLA, preventing property-level data exposure with a response DTO, the Top 10 for LLM Applications (2025), ASVS 5.0 and the Cheat Sheet Series. We also talk about how the series continues with new Top 10 editions and which security series come next.
Putting the OWASP Top 10 Together: Secure Defaults for ASP.NET Core and Angular
We put the ten categories together in a single Program.cs: fallback policy, cookie flags, ProblemDetails, rate limiting that returns 429, security headers and rejecting unknown JSON fields. We verify everything with curl, do SAST with the .NET analyzers, write security regression tests with WebApplicationFactory, and talk about DAST and moving to ASVS 5.0.