YTYK You think you know

Card 13 of 18 Integrity and operations ●●○ Working knowledge

A08: integrity, one level below the supply chain

Software or Data Integrity Failures stays at #8. It is about failing to maintain trust boundaries and verify the integrity of software, code and data artifacts — explicitly at a lower level than A03 Software Supply Chain Failures. Its signature weakness is deserialisation of untrusted data.

Why it is like this

A03 asks whether the thing you received came from where you think. A08 asks whether your code verifies anything before acting on what it received. They are the same question at two different altitudes.

Not to be confused with

A duplicate of A03. The renaming from *Software and Data Integrity Failures* to *Software or Data Integrity Failures* was a deliberate clarification: either kind of integrity failure qualifies on its own.

In practice

Accepting a serialised object from a client and reconstructing it without verification is A08. Accepting a package from a compromised registry is A03.

Source: OWASP Top 10:2025 — A08:2025 Software or Data Integrity Failures. Read on .

The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.

Predict Check yourself

An auto-update mechanism applies an update without verifying its signature. A03 or A08?

  1. A08 — this is a failure to verify integrity at the point of use, which is the lower level A08 describes; A03 covers compromise of the distribution ecosystem itself.
  2. A03, because updates are part of the supply chain.
  3. Neither; unsigned updates are a configuration issue under A02.
  4. Both equally — the categories are defined as identical.
Show the answer

A08 — this is a failure to verify integrity at the point of use, which is the lower level A08 describes; A03 covers compromise of the distribution ecosystem itself.

The distinction the project draws is altitude: A03 is the ecosystem, A08 is your code trusting something without checking it.