What are the typical reasons why I would not pass the security review?

In no particular order, here’s a list of the top reasons for not being approved. For more information, see OWASP Top 10.

• Injection (SQL, XML, and so on)
• Cross-site scripting
• Broken authentication and session management
• Insecure direct object references
• Cross-site request forgery
• Security misconfiguration
• Insecure cryptographic storage
• Failure to restrict URL access
• Insufficient transport layer protection
• Unvalidated redirects and forwards