Seven years ago, I used the OWASP guidelines to start a greenfield project for a brand new client at the consultoware company I was working for. The project required compliance with several government regulations, including HIPAA and Sarbanes-Oxley, with planned auditing.<p>I was new there, but not new to software development. I ignored the other developers in the company &quot;ordering&quot; me to use their existing codebase. I had not been very impressed with their home-rolled auth system, including plain-text passwords. I got around it by hacking together a mockup that looked like it was using their site template, so they just assumed the rest of the project was built on it.<p>I kept myself a scorecard on how I was doing against OWASP&#x27;s Top Ten. Six months later, we got a surprise early audit, everyone freaked out, but I chilled because I knew we were good. We passed with flying colors. The software also just so happened to be the best-performing project in the company (which isn&#x27;t really saying much) and everyone was scrambling to scrap their codebases and build on mine (which itself is another problem). It became the only project in the company to have more than two developers working on it at any one time (I had three people under me! Wow!). The documentation I wrote for it--which was mostly just explaining OWASP and what it meant in regards to our technology stack--became the gold standard in the company.<p>Now, this is not at all to say this was a great feat. But if you&#x27;re working in the sort of consultoware shop that can&#x27;t seem to keep anyone with more than 5 years of experience under their belt (which is a lot of people), you can do far, far worse than following OWASP religiously.<p>I eventually left when it became clear I was the &quot;mule that works&quot;, i.e. &quot;you don&#x27;t beat the mule that doesn&#x27;t work.&quot; It was rationalized that, because we were doing so well, instead of putting more resources into my team to double-down on our track record, it would be better to scatter the team around to the poorer projects, apparently under some plan that success is catching or something. Also, management still expected me to maintain the project on my own at the same productivity level as four people.