What the site covers

Software Security is a practical reference for the people who design, build and secure software. It covers six domains:

  • Application security: Secure design, implementation, testing, and response throughout the software lifecycle.
  • Software supply chain: Know what you ship. Protect dependencies, build systems, artifacts, and their provenance.
  • Runtime, cloud & APIs: Control exposure, contain failures, and defend applications in their operating environment.
  • Identity & cryptography: Understand trust, protect sensitive data, and learn why cryptographic systems fail.
  • Governance & frameworks: Turn security expectations into an accountable, measurable engineering program.
  • AI security: Apply security boundaries to models, agents, retrieved content, and generated output.

It brings together 213 guides, 6 task workflows, 9 learning paths, 38 browser labs, 22 local projects, a glossary of 271 terms, pages for the CWE, OWASP and ASVS identifiers the guides cover, and an SBOM checker.

The coverage map shows which security outcomes the guides, labs and projects cover and where coverage is still growing.

How the guides are built

Each guide is built from primary standards and specifications, such as OWASP projects, NIST publications, IETF RFCs and vendor documentation, and links to them in its sources.

Guides are illustrated with runnable, tested code. The browser labs and local projects include tests that fail on the vulnerable version and pass once the fix is in place.

Terms used on this site

  • Guide: An article. Most are guides; a recipe is a complete fix for one stack, a reference explains a mechanism, and a case study reconstructs a real incident.
  • Fix card: A tested fix for one weakness in one stack: vulnerable code, the fix, a wrong fix and the tests that tell them apart.
  • Workflow: A security job from start to finish, routed to the guides, labs and work products.
  • Learning path: A sequence of guides, browser labs and local projects that ends with a capstone.
  • Browser lab: Vulnerable code to repair in the browser until its tests pass. "Lab" for short; a lab can also be downloaded and run with Node.js.
  • Local project: A project to download and run on your own machine, with a starter that fails its tests and a separate reference solution.
  • Guided practice: The scenario at the end of a guide, worked through step by step, with an answer for each step.
  • Capstone: The case that ends a learning path, with a workbook and a self-assessment rubric.
  • Topic: One of the six domains the guides are grouped in, such as Application security.
  • Tag: A subject from the controlled vocabulary, such as Injection or Secrets management, with a page listing its guides.
  • Lifecycle stage: When the work happens: design, build, test, release, operate, respond or govern.
  • Role: Who a guide is written for: developers, AppSec engineers, platform engineers and SREs, or security leaders.

Guides can also be browsed by tag, lifecycle stage and role, real incidents are collected under case studies, and the content API serves every guide as JSON.

Your data

Exercises and the SBOM checker run in your browser, and your code and files are not sent to a server. Search runs in your browser too, but the index files it downloads can show the host roughly what you searched for. The privacy notice explains this and what is stored on your device.

Reuse

Articles and teaching material are licensed under CC BY 4.0. Code is licensed under the MIT License. The reuse terms explain attribution.

Contact

Email admin@softwaresecurity.com. To report a vulnerability in this website, follow the security reporting instructions.