OWASP is a non-profit producing free web security resources. The
OWASP Top 10 lists most critical web application security risks. 2021: Broken Access Control (#1), Cryptographic Failures (#2), Injection (#3).
Every developer and security professional should know OWASP Top 10. Used as baseline security requirement in many organizations and contracts. OWASP also produces ASVS (Application Security Verification Standard) for detailed requirements.