# OWASP Citizen Development Top 10 — designpattern.fyi

> Security risks for low-code/no-code platforms, AI-assisted coding, and citizen development governance.

- **Section**: OWASP Citizen Development Top 10
- **Canonical URL**: https://designpattern.fyi/owasp_citizen_development/

---

## Patterns in this Category


### [CD-SEC-01 - Blind Trust](https://designpattern.fyi/owasp_citizen_development/cdsec01_blind_trust/)
- **Summary**: Developers accept AI-generated code, marketplace templates, and platform defaults as correct and safe without verification.
- **Subcategory**: top10


### [CD-SEC-02 - Account Impersonation](https://designpattern.fyi/owasp_citizen_development/cdsec02_account_impersonation/)
- **Summary**: Apps run under shared or personal identities rather than dedicated, scoped identities.
- **Subcategory**: top10


### [CD-SEC-03 - Authorization Misuse](https://designpattern.fyi/owasp_citizen_development/cdsec03_authorization_misuse/)
- **Summary**: OAuth tokens, refresh tokens, and API keys are provisioned broadly and persist indefinitely.
- **Subcategory**: top10


### [CD-SEC-04 - Sensitive Data Leakage and Handling Failures](https://designpattern.fyi/owasp_citizen_development/cdsec04_sensitive_data_leakage/)
- **Summary**: Platforms have no semantic understanding of which fields are sensitive, leading to PII/PHI exposure.
- **Subcategory**: top10


### [CD-SEC-05 - Authentication and Secure Communication Failures](https://designpattern.fyi/owasp_citizen_development/cdsec05_authentication_communication_failures/)
- **Summary**: Functionality-first defaults lead to disabled TLS validation, HTTP instead of HTTPS, hardcoded bearer tokens, and missing MFA.
- **Subcategory**: top10


### [CD-SEC-06 - Vulnerable and Untrusted Components](https://designpattern.fyi/owasp_citizen_development/cdsec06_vulnerable_untrusted_components/)
- **Summary**: Nested sub-workflows and marketplace components inherit none of the parent app's security review.
- **Subcategory**: top10


### [CD-SEC-07 - Security Misconfiguration](https://designpattern.fyi/owasp_citizen_development/cdsec07_security_misconfiguration/)
- **Summary**: AI coding assistants don't volunteer security best practices, leading to functional but insecure defaults.
- **Subcategory**: top10


### [CD-SEC-08 - Injection Handling Failures](https://designpattern.fyi/owasp_citizen_development/cdsec08_injection_handling_failures/)
- **Summary**: Apps dynamically query data from user input without sanitization, often using platform-specific syntax.
- **Subcategory**: top10


### [CD-SEC-09 - Asset Management Failures](https://designpattern.fyi/owasp_citizen_development/cdsec09_asset_management_failures/)
- **Summary**: Apps are trivially easy to create and just as easy to forget, creating orphaned, business-critical dependencies.
- **Subcategory**: top10


### [CD-SEC-10 - Security Logging and Monitoring Failures](https://designpattern.fyi/owasp_citizen_development/cdsec10_logging_monitoring_failures/)
- **Summary**: Citizen-built apps swing between no logging at all or debug-level over-logging left on in production.
- **Subcategory**: top10



---

## Machine-Readable Resources
- **JSON Feed**: https://www.designpattern.fyi/api/patterns.json
- **OpenAPI 3.1**: https://www.designpattern.fyi/api/openapi.json
- **llms.txt**: https://www.designpattern.fyi/llms.txt