Endpoints

Content API files
File	Contents
`/api/v1/index.json`	All 213 guides: key, title, URLs, summary, topic, type, update date, identifiers, tags, stages and roles.
`/api/v1/articles/<key>.json`	One guide in full, for example `/api/v1/articles/xss-output-encoding.json`.
`/api/v1/fix-cards.json`	All 188 fix cards: weakness, CWE and OWASP IDs, stack, tested versions, verified date, scanner rules and URLs; and all 390 scanner rule IDs, each with the page to link from a finding.
`/api/v1/fix-cards/<key>.json`	One fix card in full: answer, steps, pitfalls, the vulnerable, fixed and wrong code and the tests, each scanner rule with what it found, and the test commands, for example `/api/v1/fix-cards/ssrf-go-nethttp.json`.
`/api/v1/schema.json`	The JSON Schema (draft 2020-12) of every document.

Find a guide in the index by key, identifier or tag, then fetch its article document:

Shell

curl -s https://softwaresecurity.com/api/v1/index.json | jq '.articles[] | select(.identifiers | index("CWE-79")) | .api'
curl -s https://softwaresecurity.com/api/v1/articles/xss-output-encoding.json | jq '{title, answer, url}'

Article document

Article document fields
Field	Meaning
`key`	Stable identifier of the guide; the file name of its article document.
`title, summary`	The guide’s title and one-sentence summary.
`url`	The canonical page. Cite this URL.
`markdown`	The guide as Markdown with YAML front matter.
`answer`	The short answer, as plain text.
`keyPoints, verify`	The key points and the steps that verify the guidance, as plain text.
`identifiers`	CWE, OWASP Top 10, API, LLM and Agentic Top 10, ASVS, CAPEC and MASVS identifiers, by list.
`published, updated`	ISO dates (YYYY-MM-DD) of publication and of the last update.
`domain, type`	The topic ({key, name}) and the kind of guide: Guide, Recipe, Reference or Case study.
`tags, stages, roles`	Controlled tags, lifecycle stages and roles, as on the /tags/ pages.
`sections`	Each section’s id, title, URL and prose as plain text (paragraphs, "- " bullets and table rows), with its code listing when it has one.
`sources`	The standards and documentation the guide cites: title and URL, and, when known, the edition cited.
`incident`	Case studies only: the date (YYYY, YYYY-MM or YYYY-MM-DD) and end date, organizations, category, impact, CVE IDs with their NVD links, how it was found and a timeline.
`license, attribution`	The license (CC BY 4.0) and a ready-made attribution line.

An article document, shortened to one key point, section and source:

JSON

{
  "version": 1,
  "key": "xss-output-encoding",
  "title": "Prevent XSS at the output boundary",
  "url": "https://softwaresecurity.com/domains/appsec/secure-coding/xss-output-encoding/",
  "markdown": "https://softwaresecurity.com/downloads/xss-output-encoding.md",
  "summary": "Choose text rendering, context-aware encoding, or deliberate HTML sanitization according to how the browser will interpret the value.",
  "answer": "Render untrusted data for the exact place it lands. Use text APIs such as textContent or escaped template interpolation for text; parse URLs and allowlist scheme and host before using them as links; keep untrusted strings out of inline scripts, event handlers and styles; and pass rich HTML through a maintained sanitizer. Review every framework escape hatch, such as dangerouslySetInnerHTML, v-html, |safe or Html.Raw. CSP and Trusted Types enforce these rules; they do not replace them.",
  "keyPoints": [
    "Text is the default: textContent or framework interpolation shows markup-shaped input as characters."
  ],
  "verify": [
    "Render a name containing an image tag with an onerror attribute; assert the exact string is visible and no image element exists."
  ],
  "identifiers": {
    "cwe": [
      "CWE-79",
      "CWE-116"
    ],
    "owaspTop10_2025": [
      "A05:2025"
    ],
    "asvs5": [
      "V1.2.1",
      "V1.2.2",
      "V1.3.1",
      "V3.2.2"
    ],
    "capec": [
      "CAPEC-63",
      "CAPEC-588",
      "CAPEC-591",
      "CAPEC-592"
    ],
    "wstg": [
      "WSTG-INPV-01",
      "WSTG-INPV-02"
    ]
  },
  "published": "2026-10-07",
  "updated": "2026-10-10",
  "domain": {
    "key": "appsec",
    "name": "Application security"
  },
  "type": "Guide",
  "appliesTo": "HTML, attribute, URL and script output boundaries. An HTML encoder is not a universal sanitizer.",
  "tags": [
    {
      "key": "xss",
      "label": "Cross-site scripting (XSS)"
    },
    {
      "key": "browser-security",
      "label": "Browser security"
    }
  ],
  "stages": [
    "build"
  ],
  "roles": [
    "developer"
  ],
  "sections": [
    {
      "id": "context",
      "title": "Follow the string into the parser that receives it",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/xss-output-encoding/#context",
      "text": "Cross-site scripting occurs when an application turns untrusted data into browser-executable content in its own origin. The same characters have different meanings in text, HTML attributes, URLs, JavaScript and CSS. A universal replace-a…"
    }
  ],
  "sources": [
    {
      "title": "OWASP Cross Site Scripting Prevention",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"
    }
  ],
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "Prevent XSS at the output boundary, Software Security, https://softwaresecurity.com/domains/appsec/secure-coding/xss-output-encoding/, CC BY 4.0"
}

Fix cards and scanner rules

/api/v1/fix-cards.json maps CWE, stack, tested versions and scanner rules to the cards. Each of its rules has a helpUri: the card's scanner table when one card records the rule, else the rule's row on /fix/rules/. A SARIF producer can use it as the rule's helpUri, for example jq '.rules[] | select(.id == "G704") | .helpUri'.

Versions and stability

This is version 1. Within it, fields are only added, never renamed or removed, and keys and URLs of guides stay stable. A change that would break a client gets a new path, such as /api/v2/, and the old version stays available while clients move. Each article document carries its updated date; the index carries the newest.

License and attribution

The guides are licensed under CC BY 4.0, and code in them under the MIT License. Credit Software Security and link to the guide’s page; each article document has an attribution line you can use. The reuse terms explain the details, including which crawlers may fetch the site.

Other machine-readable files

/llms.txt: an index of every guide and fix card for AI assistants, following the llms.txt convention, with /llms-full.txt (every guide and fix card in one file) and one file per topic under /llms/.
/downloads/<key>.md: each guide as Markdown, with YAML front matter (key, title, URL, topic, type, dates, identifiers, tags and license). Each guide’s page names its file in the page head as a Markdown alternate.
/downloads/coverage.json and /downloads/requirements.json: the guide inventory and the coverage map.
/sitemap.xml, which lists every page with its last update.