Three OWASP risks that matter more than the rest. What they mean, what to ask your team, and where the compliance gaps hide.