The OWASP Top 10 is the industry reference for web application risk. It is also written for large organizations, which makes it easy to dismiss when you are one person. Here it is translated into what actually threatens a small app.
Broken access control
The number one risk, and the most common indie version is simple: an endpoint that checks you are logged in but not that the record belongs to you. If /api/orders/123 returns anyone's order, that is broken access control.
Injection
User input treated as code. SQL injection is the classic, but it also shows up in NoSQL queries, shell commands, and template rendering. The fix is always the same: parameterize, never concatenate.
Cryptographic and auth failures
Weak password hashing, tokens that never expire, secrets in the code, cookies without the Secure and SameSite flags. Small apps get these wrong because auth is copied, not understood.
You do not need to memorize the list. You need to know which items you are most likely to have shipped, and check those.
Security misconfiguration
Debug mode on in production, default credentials left in place, verbose error messages that leak stack traces. This category is pure carelessness, which means it is entirely preventable.
The rest, briefly
Vulnerable dependencies, insecure design, data integrity failures, insufficient logging, and server-side request forgery round out the list. For a solo dev, the practical move is to run a scanner that maps its findings to these categories, so "OWASP Top 10" becomes a list of specific lines in your code instead of an abstraction.