Anyone whose security program is to only address the @OWASP Top Ten will have •massive• security gaps no matter what we put in it. And no one is suggesting that dev’s should skip logging. This is called a “straw man argument” and is a form of manipulation. #booo