The Problem
You walked the AI-generated diff through the OWASP Top 10 and it came back clean. No SQL injection, auth checks in place, secrets in env vars, dependencies patched. You ship. A week later, the Python service deserializes a malicious pickle from an internal queue and someone owns your worker fleet. OWASP didn't fail; it just doesn't have a category for "your language's specific footgun."
The core issue: each language has a private collection of security pitfalls that don't map cleanly to OWASP categories. Python's pickle. JavaScript's __proto__. Go's unsynchronized maps. Rust's unwrap(). Java's readObject(). AI reproduces these patterns because they're idiomatic and appear constantly in training data — "typical" code in each language is also "typical-vulnerable" code in each language.
The Core Insight
OWASP covers what attackers do to web apps. Language footguns cover what your runtime lets attackers do once they're inside. You need both passes. The OWASP checklist (covered in the sibling guide) handles the generic categories. This guide handles what OWASP misses.
Each language has a short, memorable list of footguns — usually 3 to 5 — and almost every AI-introduced vulnerability in that language is one of them. Memorize your stack's list, ripgrep for the red-flag tokens, and you'll catch 80% of language-specific issues in under a minute.
Think of it as code smells for security: each language has patterns that scream "vulnerable" the moment they appear in a diff. The rest of this guide is those lists.