> For the complete documentation index, see [llms.txt](https://ahmed-tarek.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design.md).

# A06 Insecure Design

- [Race Conditions](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/race-conditions.md)
- [HTTP Request Smuggling](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/http-request-smuggling.md)
- [UI Attacks](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/ui-attacks.md)
- [Insecure File Upload and Path Traversal](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/insecure-file-upload-and-path-traversal.md): CWE-73, CWE-434, CWE-646
- [Sensitive Data Storage: Encryption, Caching, and Cookies](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/sensitive-data-storage-encryption-caching-and-cookies.md): CWE-256, CWE-311, CWE-312, CWE-313, CWE-316, CWE-522, CWE-525, CWE-539, CWE-598
- [Privilege Escalation and Trust Boundaries](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a06-insecure-design/privilege-escalation-and-trust-boundaries.md): CWE-266, CWE-269, CWE-286, CWE-501, CWE-602