Security is hard. In 2019, keeping web applications secure is an incredibly difficult task, in the face of ever-increasing diversity of software security problems. The goal of this talk is to give developers hints and best practices for ensuring the security of their Odoo code and avoiding common pitfalls. Based on the famous OWASP Top 10, and a history of security trainings given in Odoo R&D, this presentation will attempt to cover the most common security bugs found in Odoo apps, describing how they work, their impact, and how to detect and fix them during code reviews.

Prerequisites: some development experience, not necessarily in Odoo, but ideally in Python and/or Javascript. Most of the issues will be discussed on a high level, but there will also be a few specific code analysis examples.