OWASP Citizen Development Top 10
OWASP Citizen Development Top 10 - An OWASP other project
About OWASP Citizen Development Top 10
Overview
Since Gartner introduced the term “Citizen Developer” in 2009, advances in platforms such as Microsoft Power Platform, SAP, ServiceNow, and Salesforce, along with AI assisted tools like Base44, Cursor, and Replit, have enabled people across all backgrounds to build sophisticated software at scale.
This movement has accelerated innovation but also raised new concerns around security and governance. The OWASP Citizen Development Top 10 Project addresses these challenges by identifying the most pressing risks that arise from citizen development of software built with Low Code No Code, AI assisted coding, and AI agent technologies.
Scope
Citizen developers can be business users improving efficiency in their daily work or hobbyists creating entirely new applications. By lowering barriers to entry, business innovation platforms and AI assisted technologies have redefined how software is created, removing long standing resource constraints from traditional development teams.
This expanded ability to create at scale introduces unique risks for organizations. Originally focused on Low Code No Code platforms, this OWASP project broadened its scope to reflect the wider landscape of citizen development and the technologies that enable it. The Top 10 risks therefore cover threats introduced through business innovation platforms, AI assisted coding, and AI agents.
Audience
The OWASP Top 10 Security Risks for Citizen Development is primarily aimed at security professionals who are tasked with enabling safe adoption of these technologies. They provide the critical guardrails that balance rapid innovation with secure practices.
The project also speaks directly to citizen developers, giving them an understanding of how their work may create risks and how to avoid common pitfalls. Governance bodies gain structured recommendations to align oversight with organizational goals and regulatory requirements, strengthening accountability across citizen development initiatives.
The key crossover focus for this document is to facilitate collaboration between the business and security and governance.
Mission
The mission of the OWASP Citizen Development Top 10 Project is to help organizations identify, prioritize, and mitigate risks tied to citizen development. The list explains how these risks manifest across various technologies and offers concrete mitigations to reduce them.
By providing accessible examples and guidance, the project equips both technical and non technical creators to make secure by default choices. Its goal is to establish the foundations that allow innovation to thrive while maintaining strong security practices.
Project Information
Other Project
Classification
Other
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.