Make risks visible
OWASP Top 10 is an awareness framework for web application security. It is not a certification or an exhaustive list of vulnerabilities. Consult the official release.
A simple example
A student should see only their own result. If changing an identifier in a URL exposes another student’s record, server-side authorisation is missing.
Developer habits
Validate inputs, render output safely, check permissions on each request and fail closed. Do not rely solely on interface controls.