{
  "version": 1,
  "name": "Software Security content API",
  "documentation": "https://softwaresecurity.com/api/",
  "schema": "https://softwaresecurity.com/api/v1/schema.json",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "updated": "2026-10-11",
  "count": 213,
  "fixCards": "https://softwaresecurity.com/api/v1/fix-cards.json",
  "articles": [
    {
      "key": "sql-injection-python",
      "title": "Fix SQL injection in Python sqlite3",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/sql-injection-python-sqlite3/",
      "api": "https://softwaresecurity.com/api/v1/articles/sql-injection-python.json",
      "markdown": "https://softwaresecurity.com/downloads/sql-injection-python.md",
      "summary": "Bind query values separately from SQL syntax, then prove the fix preserves legitimate behavior and blocks an injection probe.",
      "domain": "appsec",
      "type": "Recipe",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-89",
        "A05:2025",
        "V1.2.4",
        "CAPEC-66",
        "WSTG-INPV-05"
      ],
      "tags": [
        "injection",
        "python"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "object-authorization",
      "title": "Enforce authorization for every object action",
      "url": "https://softwaresecurity.com/domains/appsec/authorization/object-level-authorization/",
      "api": "https://softwaresecurity.com/api/v1/articles/object-authorization.json",
      "markdown": "https://softwaresecurity.com/downloads/object-authorization.md",
      "summary": "Authorize the authenticated subject, requested operation, and specific resource together; a valid login or unpredictable identifier is insufficient.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-639",
        "CWE-862",
        "CWE-863",
        "A01:2025",
        "API1:2023",
        "V8.2.2",
        "V8.3.1",
        "V8.4.1",
        "WSTG-ATHZ-04"
      ],
      "tags": [
        "access-control",
        "api-security",
        "security-testing"
      ],
      "stages": [
        "build",
        "test"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "secure-uploads",
      "title": "Design a safer file-upload pipeline",
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/secure-file-uploads/",
      "api": "https://softwaresecurity.com/api/v1/articles/secure-uploads.json",
      "markdown": "https://softwaresecurity.com/downloads/secure-uploads.md",
      "summary": "Treat upload receipt, content processing, storage, and later delivery as separate security decisions.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-434",
        "CWE-770",
        "A06:2025",
        "API4:2023",
        "V5.2.1",
        "V5.2.2",
        "V5.2.6",
        "V5.3.2",
        "V5.4.1",
        "WSTG-BUSL-08",
        "WSTG-BUSL-09"
      ],
      "tags": [
        "input-validation",
        "file-handling"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "webhook-verification",
      "title": "Verify webhook deliveries before acting",
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/verify-webhook-deliveries/",
      "api": "https://softwaresecurity.com/api/v1/articles/webhook-verification.json",
      "markdown": "https://softwaresecurity.com/downloads/webhook-verification.md",
      "summary": "Verify the provider’s signature over the correct bytes, then apply replay, authorization, and idempotency controls before a business action.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-347",
        "CWE-294",
        "CWE-306",
        "CWE-208",
        "A08:2025",
        "A07:2025",
        "API10:2023"
      ],
      "tags": [
        "api-security"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "multitenant-threat-model",
      "title": "Review tenant boundaries before implementation",
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/multitenant-design-review/",
      "api": "https://softwaresecurity.com/api/v1/articles/multitenant-threat-model.json",
      "markdown": "https://softwaresecurity.com/downloads/multitenant-threat-model.md",
      "summary": "Trace tenant identity through requests, data stores, caches, jobs, and administration, then turn plausible isolation failures into tests.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-639",
        "CWE-863",
        "A06:2025",
        "A01:2025",
        "API1:2023",
        "V8.4.1"
      ],
      "tags": [
        "access-control",
        "multi-tenancy",
        "threat-modeling"
      ],
      "stages": [
        "design"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "dependency-response",
      "title": "Respond to an exploited or malicious dependency",
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/dependency-vulnerability-response/",
      "api": "https://softwaresecurity.com/api/v1/articles/dependency-response.json",
      "markdown": "https://softwaresecurity.com/downloads/dependency-response.md",
      "summary": "When a dependency vulnerability is being exploited, or a package version is malicious, triage gives way to incident response: find every running copy, contain it, patch and redeploy, hunt for exploitation, rotate secrets and close on deployed evidence.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-1395",
        "CWE-1104",
        "CWE-506",
        "A03:2025",
        "V15.1.1",
        "V15.1.2",
        "V15.2.1"
      ],
      "tags": [
        "dependencies",
        "incident-response",
        "vulnerability-management"
      ],
      "stages": [
        "respond"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "minimal-appsec-program",
      "title": "Start a minimal AppSec program with owners, triggers and metrics",
      "url": "https://softwaresecurity.com/frameworks/appsec-program/",
      "api": "https://softwaresecurity.com/api/v1/articles/minimal-appsec-program.json",
      "markdown": "https://softwaresecurity.com/downloads/minimal-appsec-program.md",
      "summary": "Begin with ownership, a few risk-triggered activities, and evidence that findings are resolved; expand from demonstrated needs.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "appsec-program",
        "secure-sdlc"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "ci-build-integrity",
      "title": "Protect the path from pull request to release",
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/build-integrity/",
      "api": "https://softwaresecurity.com/api/v1/articles/ci-build-integrity.json",
      "markdown": "https://softwaresecurity.com/downloads/ci-build-integrity.md",
      "summary": "Separate untrusted contribution checks from privileged release work and verify the identity of the artifact that is actually deployed.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-829",
        "A03:2025",
        "A08:2025",
        "CAPEC-444"
      ],
      "tags": [
        "ci-cd",
        "build-integrity"
      ],
      "stages": [
        "build",
        "release"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "iac-review",
      "title": "Review infrastructure changes as access changes",
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/iac-security/",
      "api": "https://softwaresecurity.com/api/v1/articles/iac-review.json",
      "markdown": "https://softwaresecurity.com/downloads/iac-review.md",
      "summary": "Inspect the effective permissions, exposure, sensitive state, and recovery implications of a proposed infrastructure change.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-732",
        "CWE-312",
        "A02:2025",
        "V13.2.2",
        "V13.3.1",
        "V13.3.2"
      ],
      "tags": [
        "secrets",
        "cloud",
        "infrastructure-as-code"
      ],
      "stages": [
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "prompt-injection-boundaries",
      "title": "Contain prompt injection at the application boundary",
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/prompt-injection-boundaries/",
      "api": "https://softwaresecurity.com/api/v1/articles/prompt-injection-boundaries.json",
      "markdown": "https://softwaresecurity.com/downloads/prompt-injection-boundaries.md",
      "summary": "Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-1427",
        "CWE-863",
        "LLM01:2026",
        "LLM03:2026",
        "LLM08:2026",
        "LLM10:2026",
        "ASI01:2026",
        "ASI02:2026",
        "V8.3.1"
      ],
      "tags": [
        "llm-security",
        "prompt-injection",
        "ai-agents"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "secret-handling",
      "title": "Secrets management: storage, rotation and leaked-secret response",
      "url": "https://softwaresecurity.com/domains/identity-crypto/secrets/secrets-lifecycle/",
      "api": "https://softwaresecurity.com/api/v1/articles/secret-handling.json",
      "markdown": "https://softwaresecurity.com/downloads/secret-handling.md",
      "summary": "Follow one application credential from issuance through caching, rotation, revocation and restored backups, prove that its old value stops working, and respond correctly when a secret leaks.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-798",
        "CWE-522",
        "CWE-532",
        "A04:2025",
        "A09:2025",
        "V11.5.1",
        "V13.1.4",
        "V13.3.1",
        "V13.3.2",
        "V13.3.4"
      ],
      "tags": [
        "secrets",
        "incident-response"
      ],
      "stages": [
        "build",
        "operate",
        "respond"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "mobile-native-boundaries",
      "title": "Review trust boundaries in mobile and native clients",
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/mobile-native-trust-boundaries/",
      "api": "https://softwaresecurity.com/api/v1/articles/mobile-native-boundaries.json",
      "markdown": "https://softwaresecurity.com/downloads/mobile-native-boundaries.md",
      "summary": "Protect local data and platform interactions while keeping server-side authorization independent of the client’s behavior.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-602",
        "CWE-639",
        "CWE-939",
        "A06:2025",
        "A01:2025",
        "API1:2023",
        "V8.3.1",
        "V2.2.2"
      ],
      "tags": [
        "mobile",
        "desktop-native",
        "threat-modeling"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "crypto-ecb",
      "title": "ECB mode: why it leaks patterns and what to use instead",
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/ecb-mode-leakage/",
      "api": "https://softwaresecurity.com/api/v1/articles/crypto-ecb.json",
      "markdown": "https://softwaresecurity.com/downloads/crypto-ecb.md",
      "summary": "Derive exactly what ECB reveals and why a longer key cannot fix it, find where ECB enters real code, and replace it with an authenticated mode.",
      "domain": "identity-crypto",
      "type": "Reference",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-327",
        "A04:2025",
        "V11.3.1",
        "V11.3.2",
        "V11.3.3"
      ],
      "tags": [
        "encryption",
        "historical-attacks",
        "java"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "crypto-padding-oracle",
      "title": "Padding oracle attacks",
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/padding-oracle-attacks/",
      "api": "https://softwaresecurity.com/api/v1/articles/crypto-padding-oracle.json",
      "markdown": "https://softwaresecurity.com/downloads/crypto-padding-oracle.md",
      "summary": "Use a byte-level CBC example to see how a tiny validity signal becomes plaintext information, then design verification that checks more than the error message.",
      "domain": "identity-crypto",
      "type": "Reference",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-327",
        "CWE-353",
        "CWE-208",
        "A04:2025",
        "V11.2.5",
        "V11.3.3",
        "V11.3.5"
      ],
      "tags": [
        "encryption"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "crypto-hash-collisions",
      "title": "Hash collisions and digital signatures: MD5, SHA-1 and what to use",
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/hash-collisions-and-signatures/",
      "api": "https://softwaresecurity.com/api/v1/articles/crypto-hash-collisions.json",
      "markdown": "https://softwaresecurity.com/downloads/crypto-hash-collisions.md",
      "summary": "Distinguish collisions from preimages, follow a colliding pair through signing and verification, and retire MD5 and SHA-1 from the verifiers that still accept them.",
      "domain": "identity-crypto",
      "type": "Reference",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-328",
        "CWE-327",
        "CWE-347",
        "A04:2025",
        "V11.4.1",
        "V11.4.3"
      ],
      "tags": [
        "pki",
        "historical-attacks"
      ],
      "stages": [
        "operate"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "crypto-weak-rsa",
      "title": "Weak RSA key generation: shared primes, ROCA and safe keys",
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/weak-rsa-key-generation/",
      "api": "https://softwaresecurity.com/api/v1/articles/crypto-weak-rsa.json",
      "markdown": "https://softwaresecurity.com/downloads/crypto-weak-rsa.md",
      "summary": "Recover a toy RSA factor with a greatest common divisor, distinguish shared primes, structured primes, duplicate keys and key length, and check a fleet of real public keys.",
      "domain": "identity-crypto",
      "type": "Reference",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-331",
        "CWE-326",
        "A04:2025",
        "V11.6.1",
        "V11.2.3",
        "V11.5.1"
      ],
      "tags": [
        "key-management",
        "pki",
        "historical-attacks"
      ],
      "stages": [
        "operate"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "crypto-rc4",
      "title": "RC4 keystream bias",
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/rc4-keystream-bias/",
      "api": "https://softwaresecurity.com/api/v1/articles/crypto-rc4.json",
      "markdown": "https://softwaresecurity.com/downloads/crypto-rc4.md",
      "summary": "Understand why fresh RC4 keys do not remove keystream bias and how repeated secret positions turn a small statistical effect into evidence.",
      "domain": "identity-crypto",
      "type": "Reference",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-327",
        "A04:2025",
        "V11.3.2",
        "V12.1.2"
      ],
      "tags": [
        "encryption",
        "tls",
        "historical-attacks"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "crypto-sweet32-mechanism",
      "title": "64-bit block ciphers and the Sweet32 mechanism",
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/64-bit-block-ciphers-sweet32/",
      "api": "https://softwaresecurity.com/api/v1/articles/crypto-sweet32-mechanism.json",
      "markdown": "https://softwaresecurity.com/downloads/crypto-sweet32-mechanism.md",
      "summary": "Calculate the birthday effect for 64-bit blocks and derive the CBC relation that can turn a collision into a plaintext disclosure.",
      "domain": "identity-crypto",
      "type": "Reference",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-327",
        "CWE-326",
        "A04:2025",
        "V11.3.2",
        "V12.1.2"
      ],
      "tags": [
        "encryption",
        "historical-attacks"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "icdp-case-wep-2001",
      "title": "WEP: RC4 key reuse and weak IVs",
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/wep-rc4-key-reuse/",
      "api": "https://softwaresecurity.com/api/v1/articles/icdp-case-wep-2001.json",
      "markdown": "https://softwaresecurity.com/downloads/icdp-case-wep-2001.md",
      "summary": "Separate WEP’s repeated-keystream failure, weak-IV key recovery, and unkeyed integrity weakness through a concrete two-packet exercise.",
      "domain": "identity-crypto",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-323",
        "CWE-327",
        "CWE-353",
        "A04:2025",
        "V11.3.3",
        "V11.3.4"
      ],
      "tags": [
        "encryption",
        "historical-attacks"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "icdp-case-flame-2012",
      "title": "Flame: MD5 certificate forgery",
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/flame-md5-certificate-forgery/",
      "api": "https://softwaresecurity.com/api/v1/articles/icdp-case-flame-2012.json",
      "markdown": "https://softwaresecurity.com/downloads/icdp-case-flame-2012.md",
      "summary": "Follow how a weak digest and an overpowered certificate trust path enabled forged code-signing authority, without equating the event with RSA key theft.",
      "domain": "identity-crypto",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-328",
        "CWE-295",
        "A04:2025",
        "A08:2025",
        "V11.4.1",
        "V11.4.3"
      ],
      "tags": [
        "pki",
        "historical-attacks",
        "signing"
      ],
      "stages": [
        "release",
        "operate"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "icdp-case-lucky13-poodle",
      "title": "Lucky Thirteen and POODLE: two different oracles",
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/lucky13-poodle/",
      "api": "https://softwaresecurity.com/api/v1/articles/icdp-case-lucky13-poodle.json",
      "markdown": "https://softwaresecurity.com/downloads/icdp-case-lucky13-poodle.md",
      "summary": "Compare two CBC oracles by their signal, protocol rules, and attacker prerequisites instead of treating them as interchangeable padding bugs.",
      "domain": "identity-crypto",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-757",
        "CWE-208",
        "CWE-327",
        "A04:2025",
        "V12.1.1",
        "V12.1.2",
        "V11.2.5"
      ],
      "tags": [
        "encryption",
        "tls",
        "historical-attacks"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "icdp-case-freak-logjam-2015",
      "title": "FREAK and Logjam: export-grade key exchange",
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/freak-logjam-export-grade-keys/",
      "api": "https://softwaresecurity.com/api/v1/articles/icdp-case-freak-logjam-2015.json",
      "markdown": "https://softwaresecurity.com/downloads/icdp-case-freak-logjam-2015.md",
      "summary": "Trace two export-grade downgrade paths and separate RSA factorization from finite-field Diffie–Hellman discrete logarithms.",
      "domain": "identity-crypto",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-757",
        "CWE-326",
        "A04:2025",
        "V11.6.2",
        "V12.1.1",
        "V12.1.2"
      ],
      "tags": [
        "pki",
        "tls",
        "historical-attacks"
      ],
      "stages": [
        "operate"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "icdp-case-drown-2016",
      "title": "DROWN: one RSA key across incompatible protocols",
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/drown/",
      "api": "https://softwaresecurity.com/api/v1/articles/icdp-case-drown-2016.json",
      "markdown": "https://softwaresecurity.com/downloads/icdp-case-drown-2016.md",
      "summary": "Map an RSA key across services to see how an SSLv2 oracle could compromise TLS traffic on a different endpoint.",
      "domain": "identity-crypto",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-327",
        "A04:2025",
        "V11.3.1",
        "V12.1.1",
        "V12.1.2"
      ],
      "tags": [
        "encryption",
        "key-management",
        "pki",
        "tls",
        "historical-attacks"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "icdp-case-sweet32-2016",
      "title": "Sweet32: the cost of a small block size",
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/sweet32/",
      "api": "https://softwaresecurity.com/api/v1/articles/icdp-case-sweet32-2016.json",
      "markdown": "https://softwaresecurity.com/downloads/icdp-case-sweet32-2016.md",
      "summary": "Read the 2016 Sweet32 demonstrations as evidence about traffic volume, repeated secrets, and session lifetime rather than treating a block-size threshold as an instant exploit.",
      "domain": "identity-crypto",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-327",
        "CWE-326",
        "A04:2025",
        "V12.1.2"
      ],
      "tags": [
        "encryption",
        "tls",
        "historical-attacks"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "icdp-case-roca-2017",
      "title": "ROCA: structured RSA key generation",
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/roca-infineon-weak-keys/",
      "api": "https://softwaresecurity.com/api/v1/articles/icdp-case-roca-2017.json",
      "markdown": "https://softwaresecurity.com/downloads/icdp-case-roca-2017.md",
      "summary": "Understand why mathematically structured RSA primes were factorable despite normal key lengths, then plan replacement around generation provenance.",
      "domain": "identity-crypto",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-1240",
        "CWE-326",
        "A04:2025",
        "V11.6.1"
      ],
      "tags": [
        "key-management",
        "pki",
        "embedded"
      ],
      "stages": [
        "operate"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "xss-output-encoding",
      "title": "Prevent XSS at the output boundary",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/xss-output-encoding/",
      "api": "https://softwaresecurity.com/api/v1/articles/xss-output-encoding.json",
      "markdown": "https://softwaresecurity.com/downloads/xss-output-encoding.md",
      "summary": "Choose text rendering, context-aware encoding, or deliberate HTML sanitization according to how the browser will interpret the value.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-79",
        "CWE-116",
        "A05:2025",
        "V1.2.1",
        "V1.2.2",
        "V1.3.1",
        "V3.2.2",
        "CAPEC-63",
        "CAPEC-588",
        "CAPEC-591",
        "CAPEC-592",
        "WSTG-INPV-01",
        "WSTG-INPV-02"
      ],
      "tags": [
        "xss",
        "browser-security"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "ssrf-egress-boundaries",
      "title": "Constrain server-side fetches to their intended destinations",
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/ssrf-egress-boundaries/",
      "api": "https://softwaresecurity.com/api/v1/articles/ssrf-egress-boundaries.json",
      "markdown": "https://softwaresecurity.com/downloads/ssrf-egress-boundaries.md",
      "summary": "Prevent untrusted URLs from turning a preview, import, or webhook feature into access to internal services.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-918",
        "A01:2025",
        "API7:2023",
        "V1.3.6",
        "V13.2.4",
        "V15.3.2",
        "CAPEC-664",
        "WSTG-INPV-19"
      ],
      "tags": [
        "ssrf",
        "input-validation",
        "cloud"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "authentication-session-lifecycle",
      "title": "Session management: cookies, timeouts, rotation and revocation",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/session-lifecycle/",
      "api": "https://softwaresecurity.com/api/v1/articles/authentication-session-lifecycle.json",
      "markdown": "https://softwaresecurity.com/downloads/authentication-session-lifecycle.md",
      "summary": "Model authentication as transitions in server authority, set session cookies and timeouts to current NIST and OWASP values, and verify fixation prevention, expiry, reauthentication, revocation and stolen-cookie defenses.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-384",
        "CWE-613",
        "CWE-614",
        "CWE-1004",
        "CWE-1275",
        "A07:2025",
        "API2:2023",
        "V7.2.3",
        "V7.2.4",
        "V7.3.1",
        "V7.3.2",
        "V7.4.1",
        "V7.4.2",
        "V7.5.1",
        "V3.3.1",
        "V3.3.3",
        "CAPEC-60",
        "CAPEC-61",
        "CAPEC-593"
      ],
      "tags": [
        "authentication"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "password-storage",
      "title": "Password storage: hashing parameters and rehash on login",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/password-storage/",
      "api": "https://softwaresecurity.com/api/v1/articles/password-storage.json",
      "markdown": "https://softwaresecurity.com/downloads/password-storage.md",
      "summary": "Choose Argon2id, scrypt, PBKDF2 or bcrypt with current minimum parameters, store a versioned hash, and upgrade old hashes after a successful login without overwriting a reset.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-916",
        "CWE-759",
        "CWE-760",
        "CWE-257",
        "CWE-521",
        "A04:2025",
        "A07:2025",
        "API2:2023",
        "V6.2.1",
        "V6.2.8",
        "V6.2.9",
        "V6.2.12",
        "V11.4.2",
        "CAPEC-16",
        "CAPEC-49",
        "CAPEC-55"
      ],
      "tags": [
        "authentication",
        "password-storage"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "api-resource-limits",
      "title": "Bound API work, not just request counts",
      "url": "https://softwaresecurity.com/domains/runtime/api-security/resource-consumption-limits/",
      "api": "https://softwaresecurity.com/api/v1/articles/api-resource-limits.json",
      "markdown": "https://softwaresecurity.com/downloads/api-resource-limits.md",
      "summary": "Protect availability and operating cost with limits on input, per-request work, concurrency, queues, and downstream spending.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-770",
        "CWE-400",
        "A06:2025",
        "API4:2023",
        "V15.1.3",
        "V15.2.2"
      ],
      "tags": [
        "denial-of-service",
        "api-security"
      ],
      "stages": [
        "build",
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "security-logging",
      "title": "Create security logs someone can investigate",
      "url": "https://softwaresecurity.com/domains/runtime/detection/security-event-logging/",
      "api": "https://softwaresecurity.com/api/v1/articles/security-logging.json",
      "markdown": "https://softwaresecurity.com/downloads/security-logging.md",
      "summary": "Record meaningful decisions with consistent structure, protect the resulting evidence, and prove that important events reach an operational owner.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-117",
        "CWE-532",
        "CWE-778",
        "A09:2025",
        "V16.2.1",
        "V16.2.5",
        "V16.3.2",
        "V16.4.1",
        "V16.4.3"
      ],
      "tags": [
        "injection",
        "error-handling",
        "logging-detection",
        "incident-response"
      ],
      "stages": [
        "operate",
        "respond"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "secure-error-handling",
      "title": "Handle failures without leaking internals or weakening controls",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/secure-error-handling/",
      "api": "https://softwaresecurity.com/api/v1/articles/secure-error-handling.json",
      "markdown": "https://softwaresecurity.com/downloads/secure-error-handling.md",
      "summary": "Give callers a useful, bounded response while preserving protected diagnostic evidence and safe application state.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-209",
        "CWE-636",
        "CWE-460",
        "CWE-489",
        "A10:2025",
        "API8:2023",
        "V16.5.1",
        "V16.5.3",
        "V13.4.2",
        "WSTG-ERRH-01",
        "WSTG-ERRH-02"
      ],
      "tags": [
        "error-handling"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "information-disclosure-misconfiguration",
      "title": "Ship without debug modes, verbose errors or exposed files",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/information-disclosure-misconfiguration/",
      "api": "https://softwaresecurity.com/api/v1/articles/information-disclosure-misconfiguration.json",
      "markdown": "https://softwaresecurity.com/downloads/information-disclosure-misconfiguration.md",
      "summary": "Turn off debug output, publish an allowlisted build and probe each deployment for exposed files and endpoints.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-200",
        "CWE-209",
        "CWE-215",
        "CWE-489",
        "CWE-548",
        "CWE-527",
        "CWE-538",
        "A02:2025",
        "V13.4",
        "V16.5.1",
        "WSTG-CONF-02",
        "WSTG-CONF-04",
        "WSTG-CONF-05",
        "WSTG-ERRH-01"
      ],
      "tags": [
        "error-handling",
        "secure-defaults"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "coordinated-disclosure",
      "title": "Run coordinated vulnerability disclosure from report to advisory",
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/coordinated-disclosure/",
      "api": "https://softwaresecurity.com/api/v1/articles/coordinated-disclosure.json",
      "markdown": "https://softwaresecurity.com/downloads/coordinated-disclosure.md",
      "summary": "Make private reporting discoverable, verify reports, coordinate a tested remedy, and give affected users enough information to act.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "vulnerability-management",
        "vulnerability-disclosure"
      ],
      "stages": [
        "respond"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "csrf-origin-defense",
      "title": "Protect cookie-authenticated actions against CSRF",
      "url": "https://softwaresecurity.com/domains/appsec/browser-security/csrf-origin-defense/",
      "api": "https://softwaresecurity.com/api/v1/articles/csrf-origin-defense.json",
      "markdown": "https://softwaresecurity.com/downloads/csrf-origin-defense.md",
      "summary": "Make the server distinguish an intended action from a request another site caused the browser to send.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-352",
        "CWE-1275",
        "A01:2025",
        "V3.3.2",
        "V3.3.3",
        "V3.5.1",
        "V3.5.2",
        "V3.5.3",
        "CAPEC-62",
        "WSTG-SESS-05"
      ],
      "tags": [
        "browser-security",
        "csrf"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "cors-csp-browser-boundaries",
      "title": "Configure CORS and CSP around the browser capabilities you need",
      "url": "https://softwaresecurity.com/domains/appsec/browser-security/cors-csp-browser-boundaries/",
      "api": "https://softwaresecurity.com/api/v1/articles/cors-csp-browser-boundaries.json",
      "markdown": "https://softwaresecurity.com/downloads/cors-csp-browser-boundaries.md",
      "summary": "Control who can read API responses and which resources a page may execute without confusing either control with authorization.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-942",
        "CWE-346",
        "CWE-1021",
        "A02:2025",
        "API8:2023",
        "V3.4.2",
        "V3.4.3",
        "V3.4.6",
        "V3.4.7",
        "V3.5.2",
        "WSTG-CLNT-07"
      ],
      "tags": [
        "xss",
        "browser-security"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "rich-text-dom-security",
      "title": "Render rich text without granting it application privileges",
      "url": "https://softwaresecurity.com/domains/appsec/browser-security/rich-text-dom-security/",
      "api": "https://softwaresecurity.com/api/v1/articles/rich-text-dom-security.json",
      "markdown": "https://softwaresecurity.com/downloads/rich-text-dom-security.md",
      "summary": "Choose text rendering or a restricted HTML policy, then test the final DOM after every transformation.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-79",
        "CWE-346",
        "A05:2025",
        "V1.3.1",
        "V1.3.5",
        "V3.2.2",
        "V3.2.3",
        "V3.5.5",
        "CAPEC-588",
        "CAPEC-592"
      ],
      "tags": [
        "xss",
        "browser-security"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "function-property-authorization",
      "title": "Authorize functions and fields as well as objects",
      "url": "https://softwaresecurity.com/domains/appsec/authorization/function-property-authorization/",
      "api": "https://softwaresecurity.com/api/v1/articles/function-property-authorization.json",
      "markdown": "https://softwaresecurity.com/downloads/function-property-authorization.md",
      "summary": "Prevent mass assignment, sensitive-field exposure and administrative actions that a valid object lookup alone cannot protect.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-915",
        "CWE-213",
        "CWE-862",
        "CWE-863",
        "A01:2025",
        "A08:2025",
        "API3:2023",
        "API5:2023",
        "V8.2.1",
        "V8.2.3",
        "V15.3.1",
        "V15.3.3"
      ],
      "tags": [
        "access-control",
        "api-security"
      ],
      "stages": [
        "build",
        "test"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "transaction-races",
      "title": "Preserve business invariants under concurrent requests",
      "url": "https://softwaresecurity.com/domains/appsec/business-logic/transaction-races/",
      "api": "https://softwaresecurity.com/api/v1/articles/transaction-races.json",
      "markdown": "https://softwaresecurity.com/downloads/transaction-races.md",
      "summary": "Make a balance, reservation or approval rule hold when requests overlap, retry and fail halfway through.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-362",
        "CWE-367",
        "CWE-837",
        "A06:2025",
        "V2.3.3",
        "V2.3.4",
        "V15.4.2",
        "CAPEC-26",
        "CAPEC-29"
      ],
      "tags": [
        "business-logic"
      ],
      "stages": [
        "design",
        "test"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "injection-parser-boundaries",
      "title": "Keep untrusted values out of executable syntax",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/injection-parser-boundaries/",
      "api": "https://softwaresecurity.com/api/v1/articles/injection-parser-boundaries.json",
      "markdown": "https://softwaresecurity.com/downloads/injection-parser-boundaries.md",
      "summary": "Choose a safe interface for each interpreter and bound the work performed by parsers and converters.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-78",
        "CWE-88",
        "CWE-94",
        "CWE-611",
        "CWE-502",
        "CWE-943",
        "CWE-90",
        "CWE-1336",
        "CWE-917",
        "A05:2025",
        "A08:2025",
        "A02:2025",
        "V1.2.4",
        "V1.2.5",
        "V1.2.6",
        "V1.3.2",
        "V1.3.7",
        "V1.5.1",
        "V1.5.2",
        "CAPEC-88",
        "CAPEC-201",
        "CAPEC-586",
        "CAPEC-676",
        "CAPEC-136",
        "CAPEC-242"
      ],
      "tags": [
        "injection",
        "input-validation",
        "deserialization"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "os-command-injection",
      "title": "Run external programs without command or argument injection",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/os-command-injection/",
      "api": "https://softwaresecurity.com/api/v1/articles/os-command-injection.json",
      "markdown": "https://softwaresecurity.com/downloads/os-command-injection.md",
      "summary": "Run programs from an argument list with no shell, end options before user values, and keep untrusted arguments away from Windows batch files.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-78",
        "CWE-77",
        "CWE-88",
        "A05:2025",
        "V1.2.5",
        "V1.2.8",
        "V2.2.1",
        "CAPEC-88",
        "CAPEC-6",
        "CAPEC-248",
        "WSTG-INPV-12"
      ],
      "tags": [
        "injection",
        "input-validation"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "code-template-injection",
      "title": "Keep untrusted input out of eval, expression languages and templates",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/code-template-injection/",
      "api": "https://softwaresecurity.com/api/v1/articles/code-template-injection.json",
      "markdown": "https://softwaresecurity.com/downloads/code-template-injection.md",
      "summary": "Keep code and templates constant, pass input as data, and treat in-process sandboxes as one layer, not a boundary.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-94",
        "CWE-95",
        "CWE-1336",
        "CWE-917",
        "A05:2025",
        "V1.3.2",
        "V1.3.7",
        "CAPEC-242",
        "WSTG-INPV-11",
        "WSTG-INPV-18"
      ],
      "tags": [
        "injection"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "archive-path-safety",
      "title": "Extract archives without escaping the destination",
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/archive-path-safety/",
      "api": "https://softwaresecurity.com/api/v1/articles/archive-path-safety.json",
      "markdown": "https://softwaresecurity.com/downloads/archive-path-safety.md",
      "summary": "Prevent traversal, link tricks, overwrites and decompression exhaustion while preserving legitimate file extraction.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-22",
        "CWE-23",
        "CWE-36",
        "CWE-59",
        "CWE-409",
        "A01:2025",
        "API4:2023",
        "V5.2.3",
        "V5.2.5",
        "V5.3.3",
        "CAPEC-126",
        "CAPEC-139",
        "CAPEC-597"
      ],
      "tags": [
        "file-handling"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "untrusted-document-conversion",
      "title": "Convert untrusted office documents and PDFs in an isolated parser",
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/untrusted-document-conversion/",
      "api": "https://softwaresecurity.com/api/v1/articles/untrusted-document-conversion.json",
      "markdown": "https://softwaresecurity.com/downloads/untrusted-document-conversion.md",
      "summary": "DOCX, XLSX and ODF files are ZIP archives of XML, and PDFs can carry scripts; the converters that read them are large C and C++ programs with a long CVE history. Check the package before any parser reads it, convert each document in a container with no network, no writable root and hard limits, kill it at a deadline, and re-render to pixels when people will open the result.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-611",
        "CWE-409",
        "CWE-918",
        "CWE-22",
        "CWE-400",
        "A02:2025",
        "A01:2025",
        "V5.2.2",
        "V5.2.3",
        "V1.5.1",
        "V15.2.5"
      ],
      "tags": [
        "input-validation",
        "file-handling",
        "denial-of-service",
        "memory-safety"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "webrtc-security",
      "title": "Secure WebRTC signaling, TURN relays and media servers",
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/webrtc-security/",
      "api": "https://softwaresecurity.com/api/v1/articles/webrtc-security.json",
      "markdown": "https://softwaresecurity.com/downloads/webrtc-security.md",
      "summary": "WebRTC encrypts media, but signaling decides whose keys you trust and TURN relays wherever it is allowed. Authorize every signaling message, mint short-lived TURN credentials, deny internal addresses and harden media servers.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-441",
        "CWE-770",
        "CWE-295",
        "CWE-359",
        "V17",
        "V17.1.1",
        "V17.1.2",
        "V17.2.1",
        "V17.2.2",
        "V17.2.3",
        "V17.2.4",
        "V17.2.5",
        "V17.2.6",
        "V17.2.7",
        "V17.2.8",
        "V17.3.1",
        "V17.3.2"
      ],
      "tags": [
        "denial-of-service",
        "tls",
        "privacy",
        "api-security"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "security-code-review",
      "title": "Review a code change through its trust boundaries",
      "url": "https://softwaresecurity.com/domains/appsec/code-review/security-code-review/",
      "api": "https://softwaresecurity.com/api/v1/articles/security-code-review.json",
      "markdown": "https://softwaresecurity.com/downloads/security-code-review.md",
      "summary": "Turn a pull request into a small set of security claims that can be checked against the surrounding system and tests.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-862",
        "CWE-639",
        "A01:2025",
        "API1:2023",
        "V8.2.2",
        "V8.3.1"
      ],
      "tags": [
        "access-control",
        "ai-assisted-development",
        "code-review",
        "secure-sdlc"
      ],
      "stages": [
        "test"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "sast-dast-workflow",
      "title": "Combine static and dynamic tests around a verified finding",
      "url": "https://softwaresecurity.com/domains/appsec/testing/sast-dast-workflow/",
      "api": "https://softwaresecurity.com/api/v1/articles/sast-dast-workflow.json",
      "markdown": "https://softwaresecurity.com/downloads/sast-dast-workflow.md",
      "summary": "Use analysis tools to find evidence, then retain an application regression that demonstrates the failure and the fix.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "A05:2025"
      ],
      "tags": [
        "security-testing",
        "vulnerability-management"
      ],
      "stages": [
        "test",
        "respond"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "parser-fuzzing",
      "title": "Fuzz a parser and turn crashes into lasting regressions",
      "url": "https://softwaresecurity.com/domains/appsec/testing/parser-fuzzing/",
      "api": "https://softwaresecurity.com/api/v1/articles/parser-fuzzing.json",
      "markdown": "https://softwaresecurity.com/downloads/parser-fuzzing.md",
      "summary": "Build a narrow harness, observe memory and resource failures, minimize the input, and test the repaired parser.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-130",
        "CWE-125",
        "CWE-1284",
        "V1.4.1",
        "V1.4.2",
        "CAPEC-28"
      ],
      "tags": [
        "input-validation",
        "memory-safety",
        "security-testing",
        "c-cpp-rust"
      ],
      "stages": [
        "test"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "framework-security-patterns",
      "title": "Preserve framework security controls across the request lifecycle",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/framework-security-patterns/",
      "api": "https://softwaresecurity.com/api/v1/articles/framework-security-patterns.json",
      "markdown": "https://softwaresecurity.com/downloads/framework-security-patterns.md",
      "summary": "Trace middleware, persistence and rendering so custom code does not bypass the protections supplied by the framework.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-1188",
        "CWE-288",
        "CWE-489",
        "CWE-352",
        "A02:2025",
        "A01:2025",
        "V13.4.2",
        "V3.3.1",
        "V3.4.1",
        "V3.4.3",
        "V15.3.4"
      ],
      "tags": [
        "secure-defaults",
        "java",
        "python"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "android-ios-security",
      "title": "Review mobile storage, links and platform permissions",
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/android-ios-security/",
      "api": "https://softwaresecurity.com/api/v1/articles/android-ios-security.json",
      "markdown": "https://softwaresecurity.com/downloads/android-ios-security.md",
      "summary": "Keep local artifacts and platform entry points from exposing authority that belongs on the server.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-926",
        "CWE-939",
        "CWE-922",
        "CWE-532",
        "CWE-295"
      ],
      "tags": [
        "mobile",
        "threat-modeling"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "electron-native-security",
      "title": "Constrain desktop IPC and privileged helpers",
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/electron-native-security/",
      "api": "https://softwaresecurity.com/api/v1/articles/electron-native-security.json",
      "markdown": "https://softwaresecurity.com/downloads/electron-native-security.md",
      "summary": "Keep renderer content, local callers and plugins from turning a narrow feature into unrestricted operating-system access.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-749",
        "CWE-346",
        "CWE-940",
        "A01:2025"
      ],
      "tags": [
        "desktop-native"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "embedded-update-security",
      "title": "Design firmware updates that can recover safely",
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/embedded-update-security/",
      "api": "https://softwaresecurity.com/api/v1/articles/embedded-update-security.json",
      "markdown": "https://softwaresecurity.com/downloads/embedded-update-security.md",
      "summary": "Connect trusted boot, update authorization, rollback policy and end-of-life behavior to the device’s actual failure modes.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-494",
        "CWE-347",
        "CWE-1277",
        "CWE-1329",
        "A08:2025",
        "A03:2025"
      ],
      "tags": [
        "signing",
        "embedded"
      ],
      "stages": [
        "build",
        "release"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "kubernetes-workload-security",
      "title": "Run Kubernetes workloads with only the privileges they need",
      "url": "https://softwaresecurity.com/domains/runtime/containers/kubernetes-workload-security/",
      "api": "https://softwaresecurity.com/api/v1/articles/kubernetes-workload-security.json",
      "markdown": "https://softwaresecurity.com/downloads/kubernetes-workload-security.md",
      "summary": "Review pod settings, service accounts and effective permissions together before treating a namespace as an isolation boundary.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-250",
        "A02:2025"
      ],
      "tags": [
        "access-control",
        "workload-identity",
        "kubernetes"
      ],
      "stages": [
        "build",
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "container-network-admission",
      "title": "Prove network and admission policies enforce the intended boundary",
      "url": "https://softwaresecurity.com/domains/runtime/containers/container-network-admission/",
      "api": "https://softwaresecurity.com/api/v1/articles/container-network-admission.json",
      "markdown": "https://softwaresecurity.com/downloads/container-network-admission.md",
      "summary": "Verify allowed traffic and rejected deployments in the cluster instead of treating policy files as evidence of isolation.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "A02:2025",
        "A08:2025"
      ],
      "tags": [
        "access-control",
        "kubernetes"
      ],
      "stages": [
        "build",
        "operate"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "cloud-iam-trust",
      "title": "Review cloud permissions and role trust together",
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/cloud-iam-trust/",
      "api": "https://softwaresecurity.com/api/v1/articles/cloud-iam-trust.json",
      "markdown": "https://softwaresecurity.com/downloads/cloud-iam-trust.md",
      "summary": "Distinguish who can obtain a cloud identity from what that identity can do, then test the effective access path.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-863",
        "CWE-284",
        "A02:2025",
        "A01:2025"
      ],
      "tags": [
        "access-control",
        "workload-identity",
        "ci-cd",
        "cloud",
        "infrastructure-as-code"
      ],
      "stages": [
        "release",
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "iac-policy-drift",
      "title": "Test infrastructure policy and detect security-relevant drift",
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/iac-policy-drift/",
      "api": "https://softwaresecurity.com/api/v1/articles/iac-policy-drift.json",
      "markdown": "https://softwaresecurity.com/downloads/iac-policy-drift.md",
      "summary": "Connect source configuration, the proposed plan and deployed resources so a safe review does not become stale after deployment.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "A02:2025"
      ],
      "tags": [
        "infrastructure-as-code"
      ],
      "stages": [
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "subdomain-takeover",
      "title": "Prevent subdomain takeover from dangling DNS records",
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/subdomain-takeover/",
      "api": "https://softwaresecurity.com/api/v1/articles/subdomain-takeover.json",
      "markdown": "https://softwaresecurity.com/downloads/subdomain-takeover.md",
      "summary": "A DNS record that outlives its cloud resource lets whoever claims the name serve content on your domain. Bind records to resources in IaC, remove the record first, verify domains and scan for dangling records.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "A02:2025",
        "V3.3.3",
        "V3.4.2",
        "V10.4.1",
        "WSTG-CONF-10"
      ],
      "tags": [
        "tls",
        "cloud",
        "infrastructure-as-code"
      ],
      "stages": [
        "operate"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "api-gateway-inventory",
      "title": "Maintain an API inventory and prevent gateway bypass",
      "url": "https://softwaresecurity.com/domains/runtime/api-security/api-gateway-inventory/",
      "api": "https://softwaresecurity.com/api/v1/articles/api-gateway-inventory.json",
      "markdown": "https://softwaresecurity.com/downloads/api-gateway-inventory.md",
      "summary": "Connect documented routes, deployed listeners and backend trust so retired or direct paths do not bypass the intended controls.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-290",
        "CWE-348",
        "CWE-306",
        "A01:2025",
        "A07:2025",
        "API9:2023",
        "API2:2023",
        "API8:2023",
        "V4.1.3"
      ],
      "tags": [
        "http-intermediaries",
        "api-security"
      ],
      "stages": [
        "build",
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "protocol-api-security",
      "title": "Apply security limits to GraphQL, WebSocket and gRPC operations",
      "url": "https://softwaresecurity.com/domains/runtime/api-security/protocol-api-security/",
      "api": "https://softwaresecurity.com/api/v1/articles/protocol-api-security.json",
      "markdown": "https://softwaresecurity.com/downloads/protocol-api-security.md",
      "summary": "Carry authorization and resource budgets past the initial HTTP request into resolvers, messages and long-lived streams.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-770",
        "CWE-1385",
        "CWE-307",
        "API4:2023",
        "API2:2023",
        "V4.3.1",
        "V4.3.2",
        "V4.4.1",
        "V4.4.2"
      ],
      "tags": [
        "browser-security",
        "csrf",
        "denial-of-service",
        "api-security"
      ],
      "stages": [
        "build",
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "bounded-background-work",
      "title": "Bound background jobs and make retries safe",
      "url": "https://softwaresecurity.com/domains/runtime/availability/bounded-background-work/",
      "api": "https://softwaresecurity.com/api/v1/articles/bounded-background-work.json",
      "markdown": "https://softwaresecurity.com/downloads/bounded-background-work.md",
      "summary": "Keep queues, workers and paid dependencies within a defined budget when clients retry, cancel or disappear.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-770",
        "A10:2025",
        "API4:2023",
        "API10:2023",
        "V15.2.2",
        "V16.5.2"
      ],
      "tags": [
        "business-logic",
        "denial-of-service"
      ],
      "stages": [
        "design",
        "build",
        "test",
        "operate"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "workload-mtls-serverless",
      "title": "Authenticate workloads and authorize their service actions",
      "url": "https://softwaresecurity.com/domains/runtime/service-security/workload-mtls-serverless/",
      "api": "https://softwaresecurity.com/api/v1/articles/workload-mtls-serverless.json",
      "markdown": "https://softwaresecurity.com/downloads/workload-mtls-serverless.md",
      "summary": "Use service identities, mutual TLS and function permissions without mistaking an encrypted connection for complete authorization.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-863",
        "A01:2025",
        "A07:2025",
        "API5:2023",
        "API2:2023",
        "V12.3.3",
        "V12.3.5",
        "V8.2.1"
      ],
      "tags": [
        "access-control",
        "workload-identity",
        "tls",
        "cloud",
        "kubernetes"
      ],
      "stages": [
        "operate"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "runtime-detection-response",
      "title": "Turn runtime events into a tested investigation and containment path",
      "url": "https://softwaresecurity.com/domains/runtime/detection/runtime-detection-response/",
      "api": "https://softwaresecurity.com/api/v1/articles/runtime-detection-response.json",
      "markdown": "https://softwaresecurity.com/downloads/runtime-detection-response.md",
      "summary": "Collect evidence that answers a concrete security question and rehearse the response without destroying the facts needed to investigate.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-778",
        "A09:2025",
        "V16"
      ],
      "tags": [
        "cloud",
        "kubernetes",
        "logging-detection",
        "incident-response"
      ],
      "stages": [
        "operate",
        "respond"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "edge-waf-bot-defense",
      "title": "Operate edge rules without hiding application defects",
      "url": "https://softwaresecurity.com/domains/runtime/edge-defense/edge-waf-bot-defense/",
      "api": "https://softwaresecurity.com/api/v1/articles/edge-waf-bot-defense.json",
      "markdown": "https://softwaresecurity.com/downloads/edge-waf-bot-defense.md",
      "summary": "Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "A07:2025",
        "API6:2023",
        "API2:2023",
        "V2.4.1",
        "V6.3.1"
      ],
      "tags": [
        "denial-of-service",
        "account-takeover",
        "authentication",
        "edge-defense"
      ],
      "stages": [
        "operate"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "sbom-generation",
      "title": "Generate an SBOM for the software you actually release",
      "url": "https://softwaresecurity.com/domains/supply-chain/sbom/generate-release-inventory/",
      "api": "https://softwaresecurity.com/api/v1/articles/sbom-generation.json",
      "markdown": "https://softwaresecurity.com/downloads/sbom-generation.md",
      "summary": "Define the inventory boundary, compare build and artifact evidence, and connect the resulting SBOM to an immutable release.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "A03:2025",
        "V15.1.2"
      ],
      "tags": [
        "sbom"
      ],
      "stages": [
        "release"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "sbom-formats-identifiers",
      "title": "Choose SBOM formats and identify components accurately",
      "url": "https://softwaresecurity.com/domains/supply-chain/sbom/formats-and-identifiers/",
      "api": "https://softwaresecurity.com/api/v1/articles/sbom-formats-identifiers.json",
      "markdown": "https://softwaresecurity.com/downloads/sbom-formats-identifiers.md",
      "summary": "Separate schema versions, document references and package identities so inventory conversion and advisory matching preserve meaning.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "A03:2025"
      ],
      "tags": [
        "sbom"
      ],
      "stages": [
        "release"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "sbom-release-diff",
      "title": "Review SBOM changes between releases",
      "url": "https://softwaresecurity.com/domains/supply-chain/sbom/release-diff-and-distribution/",
      "api": "https://softwaresecurity.com/api/v1/articles/sbom-release-diff.json",
      "markdown": "https://softwaresecurity.com/downloads/sbom-release-diff.md",
      "summary": "Turn inventory differences into explainable release decisions without confusing generator changes with software changes.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "A03:2025"
      ],
      "tags": [
        "sbom",
        "signing"
      ],
      "stages": [
        "release"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "dependency-risk-triage",
      "title": "Triage new dependency vulnerability findings",
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/evidence-based-triage/",
      "api": "https://softwaresecurity.com/api/v1/articles/dependency-risk-triage.json",
      "markdown": "https://softwaresecurity.com/downloads/dependency-risk-triage.md",
      "summary": "Turn a weekly batch of Dependabot, OSV-Scanner or npm audit findings into a short list of distinct, shipped, reachable issues, each routed to one outcome: fix, not affected, accept or escalate.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-1395",
        "CWE-1104",
        "A03:2025",
        "V15.1.1",
        "V15.2.1"
      ],
      "tags": [
        "vex",
        "dependencies",
        "vulnerability-management",
        "javascript"
      ],
      "stages": [
        "build",
        "respond"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "artifact-signature-policy",
      "title": "Verify artifact signatures against an explicit trust policy",
      "url": "https://softwaresecurity.com/domains/supply-chain/provenance/artifact-signature-policy/",
      "api": "https://softwaresecurity.com/api/v1/articles/artifact-signature-policy.json",
      "markdown": "https://softwaresecurity.com/downloads/artifact-signature-policy.md",
      "summary": "Require the expected artifact, signer and release context before allowing a signed package or image to proceed.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-347",
        "A03:2025",
        "A08:2025",
        "CAPEC-206"
      ],
      "tags": [
        "build-integrity",
        "signing",
        "kubernetes"
      ],
      "stages": [
        "release"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "slsa-provenance",
      "title": "Read SLSA provenance and verify the claim you need",
      "url": "https://softwaresecurity.com/domains/supply-chain/provenance/read-and-verify-slsa/",
      "api": "https://softwaresecurity.com/api/v1/articles/slsa-provenance.json",
      "markdown": "https://softwaresecurity.com/downloads/slsa-provenance.md",
      "summary": "Connect an artifact to its build evidence while distinguishing provenance, build assurance and source controls.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-494",
        "A03:2025",
        "A08:2025",
        "CAPEC-444"
      ],
      "tags": [
        "build-integrity"
      ],
      "stages": [
        "release"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "ci-untrusted-workflows",
      "title": "Keep untrusted CI work outside the release boundary",
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/untrusted-workflow-boundaries/",
      "api": "https://softwaresecurity.com/api/v1/articles/ci-untrusted-workflows.json",
      "markdown": "https://softwaresecurity.com/downloads/ci-untrusted-workflows.md",
      "summary": "Review workflow authority, persistent state and artifact handoffs before contributor-controlled code reaches privileged jobs.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-78",
        "CWE-94",
        "CWE-829",
        "A03:2025",
        "A05:2025",
        "A08:2025",
        "CAPEC-88",
        "CAPEC-242"
      ],
      "tags": [
        "injection",
        "ci-cd"
      ],
      "stages": [
        "build",
        "release"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "package-attack-response",
      "title": "Investigate a suspected malicious package safely",
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/package-attack-response/",
      "api": "https://softwaresecurity.com/api/v1/articles/package-attack-response.json",
      "markdown": "https://softwaresecurity.com/downloads/package-attack-response.md",
      "summary": "Distinguish package substitution, publisher compromise and dangerous installation behavior while containing exposure and preserving evidence.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-506",
        "CWE-1357",
        "A03:2025",
        "A08:2025",
        "V15.2.4",
        "CAPEC-538"
      ],
      "tags": [
        "dependencies",
        "supply-chain-attacks",
        "incident-response"
      ],
      "stages": [
        "build",
        "respond"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "vex-decisions",
      "title": "Use VEX without losing vulnerability evidence",
      "url": "https://softwaresecurity.com/domains/supply-chain/vex/producer-and-consumer-decisions/",
      "api": "https://softwaresecurity.com/api/v1/articles/vex-decisions.json",
      "markdown": "https://softwaresecurity.com/downloads/vex-decisions.md",
      "summary": "Produce and consume precise vulnerability status statements tied to the product, version, justification and evidence.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "A03:2025"
      ],
      "tags": [
        "sbom",
        "vex",
        "vulnerability-management",
        "vulnerability-disclosure"
      ],
      "stages": [
        "release",
        "respond"
      ],
      "roles": [
        "appsec-engineer"
      ]
    },
    {
      "key": "reproducible-builds",
      "title": "Investigate build differences and improve reproducibility",
      "url": "https://softwaresecurity.com/domains/supply-chain/builds/reproducibility-and-hermeticity/",
      "api": "https://softwaresecurity.com/api/v1/articles/reproducible-builds.json",
      "markdown": "https://softwaresecurity.com/downloads/reproducible-builds.md",
      "summary": "Control inputs and environment, compare artifact bytes, and explain the security properties a repeatable build can demonstrate.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "A03:2025",
        "A08:2025"
      ],
      "tags": [
        "build-integrity"
      ],
      "stages": [
        "release"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "dependency-project-health",
      "title": "Review dependency health without treating a score as a guarantee",
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/project-health-and-intake/",
      "api": "https://softwaresecurity.com/api/v1/articles/dependency-project-health.json",
      "markdown": "https://softwaresecurity.com/downloads/dependency-project-health.md",
      "summary": "Combine security practices, maintenance, licensing and product exposure into a recorded adoption or replacement decision.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-1104",
        "CWE-1357",
        "A03:2025",
        "V15.1.2",
        "V15.1.4"
      ],
      "tags": [
        "dependencies",
        "build-integrity",
        "supplier-risk"
      ],
      "stages": [
        "build",
        "release",
        "govern"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "trusted-publishing-updates",
      "title": "Protect package publication and the update channel",
      "url": "https://softwaresecurity.com/domains/supply-chain/releases/trusted-publishing-and-updates/",
      "api": "https://softwaresecurity.com/api/v1/articles/trusted-publishing-updates.json",
      "markdown": "https://softwaresecurity.com/downloads/trusted-publishing-updates.md",
      "summary": "Constrain release identities, verify what consumers receive, and prepare for publisher or update-key compromise.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-494",
        "A03:2025",
        "A08:2025",
        "CAPEC-657"
      ],
      "tags": [
        "workload-identity",
        "dependencies",
        "signing",
        "javascript",
        "python"
      ],
      "stages": [
        "release"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "security-program-operations",
      "title": "Run an AppSec program: owners, finding states, deadlines and champions",
      "url": "https://softwaresecurity.com/frameworks/program-operations/",
      "api": "https://softwaresecurity.com/api/v1/articles/security-program-operations.json",
      "markdown": "https://softwaresecurity.com/downloads/security-program-operations.md",
      "summary": "Translate a security baseline into service ownership, change triggers, reusable patterns and evidence that work reaches deployment.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "appsec-program",
        "secure-sdlc"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "asvs-verification-evidence",
      "title": "ASVS 5.0 verification records: requirement, test and evidence another engineer can repeat",
      "url": "https://softwaresecurity.com/frameworks/asvs-verification-evidence/",
      "api": "https://softwaresecurity.com/api/v1/articles/asvs-verification-evidence.json",
      "markdown": "https://softwaresecurity.com/downloads/asvs-verification-evidence.md",
      "summary": "Scope edition-qualified requirements, connect them to implementation and tests, and separate a passing check from an unsupported assurance claim.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-78",
        "A05:2025",
        "V1.2.5"
      ],
      "tags": [
        "security-testing",
        "secure-sdlc",
        "compliance"
      ],
      "stages": [
        "test",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "ssdf-product-lifecycle",
      "title": "Apply NIST SSDF (SP 800-218) to one product: practices, evidence and attestation in 2026",
      "url": "https://softwaresecurity.com/frameworks/ssdf-product-lifecycle/",
      "api": "https://softwaresecurity.com/api/v1/articles/ssdf-product-lifecycle.json",
      "markdown": "https://softwaresecurity.com/downloads/ssdf-product-lifecycle.md",
      "summary": "Connect secure-development practices to an actual product’s work, artifacts and responsibilities instead of a questionnaire full of unsupported yes answers.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "build-integrity",
        "secure-sdlc",
        "compliance"
      ],
      "stages": [
        "release",
        "govern"
      ],
      "roles": [
        "security-leader"
      ]
    },
    {
      "key": "samm-assessment",
      "title": "Run an OWASP SAMM assessment with evidence and a practical roadmap",
      "url": "https://softwaresecurity.com/frameworks/samm-assessment/",
      "api": "https://softwaresecurity.com/api/v1/articles/samm-assessment.json",
      "markdown": "https://softwaresecurity.com/downloads/samm-assessment.md",
      "summary": "Use OWASP SAMM to distinguish isolated successes from repeatable practices and choose improvements the organization can sustain.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "appsec-program",
        "compliance"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "risk-exceptions-metrics",
      "title": "Approve, expire and measure security exceptions without hiding risk",
      "url": "https://softwaresecurity.com/frameworks/risk-exceptions-and-metrics/",
      "api": "https://softwaresecurity.com/api/v1/articles/risk-exceptions-metrics.json",
      "markdown": "https://softwaresecurity.com/downloads/risk-exceptions-metrics.md",
      "summary": "Keep temporary acceptance separate from remediation and measure outcomes using definitions that survive changing visibility.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "vulnerability-management",
        "appsec-program"
      ],
      "stages": [
        "respond",
        "govern"
      ],
      "roles": [
        "security-leader"
      ]
    },
    {
      "key": "assurance-mapping",
      "title": "Control mapping between frameworks: state the relationship without overstating equivalence",
      "url": "https://softwaresecurity.com/frameworks/control-mapping-and-evidence/",
      "api": "https://softwaresecurity.com/api/v1/articles/assurance-mapping.json",
      "markdown": "https://softwaresecurity.com/downloads/assurance-mapping.md",
      "summary": "Record exactly how an implementation supports a requirement, which evidence is reusable and which obligations remain unresolved.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "compliance"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "supplier-assurance",
      "title": "Supplier software assurance: check SOC 2 reports, SBOMs and signed updates against your use",
      "url": "https://softwaresecurity.com/frameworks/supplier-software-assurance/",
      "api": "https://softwaresecurity.com/api/v1/articles/supplier-assurance.json",
      "markdown": "https://softwaresecurity.com/downloads/supplier-assurance.md",
      "summary": "Connect supplier claims to product scope, supported versions, release integrity and vulnerability handling before making a procurement decision.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "A03:2025"
      ],
      "tags": [
        "sbom",
        "compliance",
        "supplier-risk"
      ],
      "stages": [
        "release",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre",
        "security-leader"
      ]
    },
    {
      "key": "product-security-obligations",
      "title": "Cyber Resilience Act and payment pages: turn product-security obligations into an engineering evidence plan",
      "url": "https://softwaresecurity.com/frameworks/product-security-obligations/",
      "api": "https://softwaresecurity.com/api/v1/articles/product-security-obligations.json",
      "markdown": "https://softwaresecurity.com/downloads/product-security-obligations.md",
      "summary": "Determine the relevant actor, product, market and requirement before connecting CRA or payment-security expectations to implementation work.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "vulnerability-disclosure",
        "appsec-program",
        "regulation"
      ],
      "stages": [
        "respond",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "assurance-frameworks",
      "title": "ISO 27001, SOC 2, NIST CSF or FedRAMP: choose the framework by the question it answers",
      "url": "https://softwaresecurity.com/frameworks/choosing-assurance-frameworks/",
      "api": "https://softwaresecurity.com/api/v1/articles/assurance-frameworks.json",
      "markdown": "https://softwaresecurity.com/downloads/assurance-frameworks.md",
      "summary": "Distinguish management systems, technical controls, risk outcomes, independent reports and government cloud requirements before reusing evidence.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "compliance",
        "regulation"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "security-leader"
      ]
    },
    {
      "key": "privacy-regulatory-scope",
      "title": "GDPR, CCPA, HIPAA or the FTC rule: scope privacy and health-data obligations before choosing controls",
      "url": "https://softwaresecurity.com/frameworks/privacy-and-health-data-scope/",
      "api": "https://softwaresecurity.com/api/v1/articles/privacy-regulatory-scope.json",
      "markdown": "https://softwaresecurity.com/downloads/privacy-regulatory-scope.md",
      "summary": "Map data, actors and processing purposes to the relevant GDPR, California or HIPAA requirements and preserve uncertainty about applicability.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "V14"
      ],
      "tags": [
        "privacy",
        "regulation"
      ],
      "stages": [
        "design",
        "govern"
      ],
      "roles": [
        "security-leader"
      ]
    },
    {
      "key": "oauth-oidc-login",
      "title": "OAuth 2.0 and OpenID Connect login: authorization code with PKCE",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/oauth-oidc-login/",
      "api": "https://softwaresecurity.com/api/v1/articles/oauth-oidc-login.json",
      "markdown": "https://softwaresecurity.com/downloads/oauth-oidc-login.md",
      "summary": "Implement OAuth 2.0 and OpenID Connect login with the authorization code flow and PKCE, keep each transaction bound to its browser, and block redirect, mix-up, code-injection and token-theft attacks.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-352",
        "CWE-601",
        "CWE-346",
        "CWE-294",
        "A07:2025",
        "API2:2023",
        "V10.1.1",
        "V10.2.1",
        "V10.2.2",
        "V10.4.1",
        "V10.4.5",
        "V10.5.1",
        "V10.5.2",
        "V10.5.4"
      ],
      "tags": [
        "authentication",
        "oauth-oidc"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "jwt-validation-rollover",
      "title": "JWT validation: algorithms, keys, claims and key rollover",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/jwt-validation-rollover/",
      "api": "https://softwaresecurity.com/api/v1/articles/jwt-validation-rollover.json",
      "markdown": "https://softwaresecurity.com/downloads/jwt-validation-rollover.md",
      "summary": "Validate a JWT against a fixed algorithm, trusted keys and the expected issuer, audience and type, reject the known header attacks, and rotate signing keys without accepting arbitrary keys or breaking valid tokens.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-347",
        "CWE-290",
        "CWE-918",
        "A07:2025",
        "A04:2025",
        "API2:2023",
        "V9.1.1",
        "V9.1.2",
        "V9.1.3",
        "V9.2.1",
        "V9.2.2",
        "V9.2.3",
        "CAPEC-475"
      ],
      "tags": [
        "oauth-oidc",
        "jwt",
        "key-management"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "passkeys-mfa-lifecycle",
      "title": "Passkeys and MFA: WebAuthn enrollment, sign-in and replacement",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/passkeys-mfa-lifecycle/",
      "api": "https://softwaresecurity.com/api/v1/articles/passkeys-mfa-lifecycle.json",
      "markdown": "https://softwaresecurity.com/downloads/passkeys-mfa-lifecycle.md",
      "summary": "Register, verify and replace passkeys with WebAuthn so phishing resistance survives the account’s whole lifecycle, and map passkeys and other MFA methods to the NIST SP 800-63B-4 assurance levels.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-308",
        "CWE-294",
        "CWE-1390",
        "A07:2025",
        "API2:2023",
        "V6.3.3",
        "V6.4.3",
        "V6.5.1",
        "V6.6.1",
        "V6.6.4",
        "V6.7.2"
      ],
      "tags": [
        "mfa-passkeys"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "account-recovery-linking",
      "title": "Account recovery: password resets, help-desk resets and account linking",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/account-recovery-linking/",
      "api": "https://softwaresecurity.com/api/v1/articles/account-recovery-linking.json",
      "markdown": "https://softwaresecurity.com/downloads/account-recovery-linking.md",
      "summary": "Treat password resets, support-desk recovery and account linking as new grants of authority: single-use high-entropy proofs, atomic consumption, session revocation, and stable identity rather than email matching.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-640",
        "CWE-362",
        "CWE-204",
        "A07:2025",
        "API2:2023",
        "V6.3.7",
        "V6.3.8",
        "V6.4.3",
        "V6.4.4",
        "V7.4.3",
        "V11.5.1",
        "CAPEC-50"
      ],
      "tags": [
        "account-takeover",
        "authentication"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "aead-record-design",
      "title": "AEAD records: AES-GCM nonces, associated data and key limits",
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/authenticated-record-design/",
      "api": "https://softwaresecurity.com/api/v1/articles/aead-record-design.json",
      "markdown": "https://softwaresecurity.com/downloads/aead-record-design.md",
      "summary": "Build an encrypted record whose tag binds ciphertext to the intended tenant, record, purpose and format, keep nonces unique within each key’s usage limit, and verify the design with actual AES-GCM.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-323",
        "CWE-327",
        "CWE-353",
        "A04:2025",
        "V11.2.1",
        "V11.3.2",
        "V11.3.3",
        "V11.3.4"
      ],
      "tags": [
        "encryption"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "envelope-encryption-rotation",
      "title": "Envelope encryption and key rotation: data keys, KMS keys and backups",
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/envelope-encryption-rotation/",
      "api": "https://softwaresecurity.com/api/v1/articles/envelope-encryption-rotation.json",
      "markdown": "https://softwaresecurity.com/downloads/envelope-encryption-rotation.md",
      "summary": "Encrypt each record with its own data key, wrap that key in a KMS or HSM key, and keep wrapping-key rotation, data re-encryption, key deletion and restored backups as separate, tested operations.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-324",
        "CWE-323",
        "CWE-321",
        "A04:2025",
        "V11.1.1",
        "V11.1.2",
        "V11.3.3",
        "V11.3.4",
        "V13.3.1",
        "V13.3.3"
      ],
      "tags": [
        "encryption",
        "key-management",
        "privacy",
        "cloud"
      ],
      "stages": [
        "design",
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "tls-pki-operations",
      "title": "Operate TLS and certificates: configuration, renewal and verification",
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/tls-pki-operations/",
      "api": "https://softwaresecurity.com/api/v1/articles/tls-pki-operations.json",
      "markdown": "https://softwaresecurity.com/downloads/tls-pki-operations.md",
      "summary": "Configure a modern TLS profile with hybrid post-quantum key exchange, automate renewal for certificate lifetimes that fall to 47 days, and verify every termination point with a fresh handshake.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-295",
        "CWE-297",
        "CWE-298",
        "CWE-319",
        "A04:2025",
        "A07:2025",
        "API8:2023",
        "V12.1.1",
        "V12.1.2",
        "V12.2.2",
        "V12.3.2",
        "V12.3.4",
        "V3.4.1",
        "CAPEC-94"
      ],
      "tags": [
        "browser-security",
        "pki",
        "tls",
        "post-quantum"
      ],
      "stages": [
        "design",
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "workload-identity-models",
      "title": "Workload identity federation: short-lived, scoped identities for services and CI",
      "url": "https://softwaresecurity.com/domains/identity-crypto/identity/workload-identity-models/",
      "api": "https://softwaresecurity.com/api/v1/articles/workload-identity-models.json",
      "markdown": "https://softwaresecurity.com/downloads/workload-identity-models.md",
      "summary": "Trace how a running workload obtains a short-lived identity, write cloud trust policies that match immutable claims instead of names or wildcards, and keep the resulting credential limited by audience and authorization.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-863",
        "CWE-290",
        "A07:2025",
        "A01:2025",
        "API2:2023",
        "V13.2.1",
        "V13.2.2",
        "V13.3.1"
      ],
      "tags": [
        "workload-identity",
        "ci-cd"
      ],
      "stages": [
        "design",
        "build",
        "release"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "authorization-models",
      "title": "Authorization models: RBAC, ABAC, ReBAC and policy as code you can test",
      "url": "https://softwaresecurity.com/domains/identity-crypto/identity/authorization-models/",
      "api": "https://softwaresecurity.com/api/v1/articles/authorization-models.json",
      "markdown": "https://softwaresecurity.com/downloads/authorization-models.md",
      "summary": "Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-863",
        "CWE-862",
        "CWE-639",
        "CWE-284",
        "A01:2025",
        "API1:2023",
        "API3:2023",
        "API5:2023",
        "V8.2.1",
        "V8.2.2",
        "V8.2.3",
        "V8.3.1",
        "V8.3.3",
        "V8.4.1"
      ],
      "tags": [
        "access-control",
        "infrastructure-as-code",
        "api-security"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "data-minimization-retention",
      "title": "Data minimization and retention: collect less and prove that deletion works",
      "url": "https://softwaresecurity.com/domains/identity-crypto/privacy/data-minimization-retention/",
      "api": "https://softwaresecurity.com/api/v1/articles/data-minimization-retention.json",
      "markdown": "https://softwaresecurity.com/downloads/data-minimization-retention.md",
      "summary": "Design collection and deletion around a data-flow graph that includes logs, derived tables, exports and restored backups, and use per-person keys so deletion can reach copies you cannot edit.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-359",
        "CWE-532",
        "V14.1.2",
        "V14.2.6",
        "V14.2.7",
        "V11.7.2"
      ],
      "tags": [
        "encryption",
        "privacy"
      ],
      "stages": [
        "design",
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "tokenization-privacy-engineering",
      "title": "Tokenization, pseudonymization and privacy transformations: choose deliberately",
      "url": "https://softwaresecurity.com/domains/identity-crypto/privacy/tokenization-privacy-engineering/",
      "api": "https://softwaresecurity.com/api/v1/articles/tokenization-privacy-engineering.json",
      "markdown": "https://softwaresecurity.com/downloads/tokenization-privacy-engineering.md",
      "summary": "Choose between vault tokens, keyed pseudonyms, format-preserving encryption, aggregation and differential privacy by the joins, reversibility and leakage each allows, and test re-identification on the data you release.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-359",
        "CWE-328",
        "V14.1.1",
        "V14.2.4",
        "V14.2.6"
      ],
      "tags": [
        "encryption",
        "privacy"
      ],
      "stages": [
        "design",
        "govern"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "crypto-inventory-pqc",
      "title": "Post-quantum migration: cryptographic inventory, hybrid TLS and deadlines",
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/crypto-inventory-pqc/",
      "api": "https://softwaresecurity.com/api/v1/articles/crypto-inventory-pqc.json",
      "markdown": "https://softwaresecurity.com/downloads/crypto-inventory-pqc.md",
      "summary": "Inventory public-key cryptography by operation, owner and lifetime, turn on hybrid ML-KEM key exchange where it is already available, and plan signature and archive migration against the NIST, NSA, NCSC and EU dates.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-327",
        "CWE-326",
        "A04:2025",
        "V11.1.2",
        "V11.1.3",
        "V11.1.4",
        "V11.2.2",
        "V11.2.3"
      ],
      "tags": [
        "key-management",
        "tls",
        "post-quantum"
      ],
      "stages": [
        "design",
        "operate"
      ],
      "roles": [
        "appsec-engineer"
      ]
    },
    {
      "key": "rag-tenant-isolation",
      "title": "Keep retrieval inside the user’s data boundary",
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/rag-tenant-isolation/",
      "api": "https://softwaresecurity.com/api/v1/articles/rag-tenant-isolation.json",
      "markdown": "https://softwaresecurity.com/downloads/rag-tenant-isolation.md",
      "summary": "Carry document permissions through ingestion, retrieval, caching and citations so a model never receives another tenant’s records.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-863",
        "A01:2025",
        "LLM09:2026",
        "LLM02:2026",
        "V8.2.2",
        "V8.4.1",
        "V14.2.2"
      ],
      "tags": [
        "access-control",
        "multi-tenancy",
        "llm-security"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "agent-tool-authorization",
      "title": "Authorize agent tools outside the model",
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/tool-authorization/",
      "api": "https://softwaresecurity.com/api/v1/articles/agent-tool-authorization.json",
      "markdown": "https://softwaresecurity.com/downloads/agent-tool-authorization.md",
      "summary": "Bind each proposed action to the user, resource and approved arguments before allowing a tool to cause a side effect.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-863",
        "CWE-367",
        "LLM03:2026",
        "LLM01:2026",
        "ASI02:2026",
        "ASI03:2026",
        "ASI09:2026",
        "V8",
        "V8.3.1",
        "V8.3.2",
        "V15.4.2"
      ],
      "tags": [
        "access-control",
        "llm-security",
        "ai-agents"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "untrusted-model-output",
      "title": "Keep generated output out of executable contexts",
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/untrusted-model-output/",
      "api": "https://softwaresecurity.com/api/v1/articles/untrusted-model-output.json",
      "markdown": "https://softwaresecurity.com/downloads/untrusted-model-output.md",
      "summary": "Choose safe rendering and narrow operations so model text cannot become browser code, database syntax or an unrestricted command.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-79",
        "CWE-89",
        "CWE-78",
        "A05:2025",
        "LLM10:2026",
        "ASI05:2026",
        "V1",
        "V3",
        "V1.2.4",
        "V1.2.5",
        "V1.3.1",
        "V3.2.2"
      ],
      "tags": [
        "xss",
        "llm-security"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "ai-security-evaluation",
      "title": "Build evaluations around prohibited outcomes",
      "url": "https://softwaresecurity.com/domains/ai-emerging/assurance/ai-security-evaluation/",
      "api": "https://softwaresecurity.com/api/v1/articles/ai-security-evaluation.json",
      "markdown": "https://softwaresecurity.com/downloads/ai-security-evaluation.md",
      "summary": "Test the application’s actual security boundaries, preserve legitimate tasks and distinguish deterministic enforcement from variable model behavior.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "llm-security",
        "ai-evaluation",
        "security-testing"
      ],
      "stages": [
        "design",
        "test",
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "ai-red-teaming",
      "title": "Red-team LLM applications and agents by their effects",
      "url": "https://softwaresecurity.com/domains/ai-emerging/assurance/ai-red-teaming/",
      "api": "https://softwaresecurity.com/api/v1/articles/ai-red-teaming.json",
      "markdown": "https://softwaresecurity.com/downloads/ai-red-teaming.md",
      "summary": "A red-teaming method for LLM features and agents: scope the whole system, map attacks to OWASP and MITRE ATLAS identifiers, score trials from observed effects, report rates with confidence intervals and retest on every model or provider change.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-1427",
        "LLM01:2026",
        "LLM02:2026",
        "LLM03:2026",
        "LLM06:2026",
        "LLM08:2026",
        "LLM10:2026",
        "ASI01:2026",
        "ASI02:2026",
        "ASI03:2026",
        "ASI06:2026"
      ],
      "tags": [
        "denial-of-service",
        "llm-security",
        "prompt-injection",
        "ai-agents",
        "ai-evaluation",
        "security-testing"
      ],
      "stages": [
        "design",
        "test",
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "ai-cost-memory-operations",
      "title": "Bound agent spending, memory and recovery",
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/cost-memory-operations/",
      "api": "https://softwaresecurity.com/api/v1/articles/ai-cost-memory-operations.json",
      "markdown": "https://softwaresecurity.com/downloads/ai-cost-memory-operations.md",
      "summary": "Enforce budgets and stop conditions outside the model, and make retained context and side effects recoverable.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-770",
        "API4:2023",
        "LLM06:2026",
        "LLM01:2026",
        "ASI06:2026",
        "V15.4.2"
      ],
      "tags": [
        "denial-of-service",
        "llm-security",
        "ai-agents"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "model-artifact-security",
      "title": "Treat model releases as executable supply-chain inputs",
      "url": "https://softwaresecurity.com/domains/ai-emerging/ml-security/model-artifact-security/",
      "api": "https://softwaresecurity.com/api/v1/articles/model-artifact-security.json",
      "markdown": "https://softwaresecurity.com/downloads/model-artifact-security.md",
      "summary": "Verify provenance, constrain loading and preserve the relationship between model weights, configuration and runtime dependencies.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-502",
        "CWE-494",
        "CWE-829",
        "A03:2025",
        "A08:2025",
        "LLM04:2026",
        "V1.5.2",
        "V15.2.4",
        "V15.2.5"
      ],
      "tags": [
        "deserialization",
        "supply-chain-attacks",
        "signing",
        "ml-security"
      ],
      "stages": [
        "build",
        "release"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "training-data-poisoning",
      "title": "Protect training and retrieval data from targeted poisoning",
      "url": "https://softwaresecurity.com/domains/ai-emerging/ml-security/training-data-poisoning/",
      "api": "https://softwaresecurity.com/api/v1/articles/training-data-poisoning.json",
      "markdown": "https://softwaresecurity.com/downloads/training-data-poisoning.md",
      "summary": "Track who can influence datasets, keep evaluation independent and investigate targeted behavior changes without relying on aggregate accuracy.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "LLM05:2026"
      ],
      "tags": [
        "supply-chain-attacks",
        "ml-security",
        "ai-evaluation"
      ],
      "stages": [
        "build",
        "test",
        "release",
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "model-privacy-attacks",
      "title": "Assess extraction, membership and inference risks",
      "url": "https://softwaresecurity.com/domains/ai-emerging/ml-security/model-privacy-attacks/",
      "api": "https://softwaresecurity.com/api/v1/articles/model-privacy-attacks.json",
      "markdown": "https://softwaresecurity.com/downloads/model-privacy-attacks.md",
      "summary": "Define what an adversary can observe and measure privacy leakage without confusing a model’s output with proof about its training data.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-359",
        "LLM02:2026"
      ],
      "tags": [
        "privacy",
        "ml-security"
      ],
      "stages": [
        "design",
        "build",
        "release"
      ],
      "roles": [
        "appsec-engineer"
      ]
    },
    {
      "key": "mcp-multiagent-security",
      "title": "Constrain MCP and multi-agent trust boundaries",
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/mcp-multiagent-security/",
      "api": "https://softwaresecurity.com/api/v1/articles/mcp-multiagent-security.json",
      "markdown": "https://softwaresecurity.com/downloads/mcp-multiagent-security.md",
      "summary": "Validate each connection and delegated action without treating a token for another service, a tool description, another agent or a state handle as authority.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-441",
        "CWE-918",
        "CWE-639",
        "CWE-863",
        "LLM01:2026",
        "LLM03:2026",
        "ASI03:2026",
        "ASI07:2026",
        "ASI01:2026",
        "ASI02:2026",
        "ASI04:2026",
        "V10.2.2",
        "V10.3.1",
        "V10.3.3",
        "V10.4.1",
        "V8.2.2"
      ],
      "tags": [
        "oauth-oidc",
        "prompt-injection",
        "ai-agents"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "agent-failure-containment",
      "title": "Contain cascading failures and rogue agents",
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/agent-failure-containment/",
      "api": "https://softwaresecurity.com/api/v1/articles/agent-failure-containment.json",
      "markdown": "https://softwaresecurity.com/downloads/agent-failure-containment.md",
      "summary": "Stop a looping, compromised or drifting agent from spreading harm: kill switches, budget and rate limits, circuit breakers, behavior monitoring, blast-radius limits, quarantine, rollback and incident response, all enforced outside the agent.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-770",
        "LLM06:2026",
        "ASI08:2026",
        "ASI10:2026",
        "V2.4.1",
        "V8.3.2",
        "V16.4.3",
        "V16.5.2"
      ],
      "tags": [
        "incident-response",
        "ai-agents"
      ],
      "stages": [
        "design",
        "build",
        "respond"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "ai-governance-regulation",
      "title": "Turn NIST AI RMF, ISO/IEC 42001 and EU AI Act duties into engineering evidence",
      "url": "https://softwaresecurity.com/domains/ai-emerging/governance/ai-governance-regulation/",
      "api": "https://softwaresecurity.com/api/v1/articles/ai-governance-regulation.json",
      "markdown": "https://softwaresecurity.com/downloads/ai-governance-regulation.md",
      "summary": "What the NIST AI RMF and its Generative AI Profile, ISO/IEC 42001 and the EU AI Act, as amended in 2026, ask of teams that build AI features, turned into engineering practices and one set of evidence. Not legal advice.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "ai-evaluation",
        "compliance",
        "regulation"
      ],
      "stages": [
        "test",
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre",
        "security-leader"
      ]
    },
    {
      "key": "smart-contract-invariants",
      "title": "Test smart contracts through state invariants",
      "url": "https://softwaresecurity.com/domains/appsec/smart-contracts/security-invariants/",
      "api": "https://softwaresecurity.com/api/v1/articles/smart-contract-invariants.json",
      "markdown": "https://softwaresecurity.com/downloads/smart-contract-invariants.md",
      "summary": "Define the properties funds and privileges must preserve, then exercise callbacks, transaction sequences and exceptional conditions locally.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-1265",
        "CWE-841"
      ],
      "tags": [
        "business-logic",
        "security-testing"
      ],
      "stages": [
        "design",
        "build",
        "test"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "http-request-desynchronization",
      "title": "Keep HTTP request boundaries consistent across intermediaries",
      "url": "https://softwaresecurity.com/domains/runtime/edge-defense/http-request-desynchronization/",
      "api": "https://softwaresecurity.com/api/v1/articles/http-request-desynchronization.json",
      "markdown": "https://softwaresecurity.com/downloads/http-request-desynchronization.md",
      "summary": "Trace framing disagreements, reject ambiguous requests and verify what reaches the origin with a real loopback proxy project.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-444",
        "A06:2025",
        "API8:2023",
        "V4.2.1",
        "V4.2.2",
        "V4.2.3",
        "CAPEC-33"
      ],
      "tags": [
        "http-intermediaries"
      ],
      "stages": [
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "cache-poisoning-deception",
      "title": "Prevent shared-cache poisoning and private-response deception",
      "url": "https://softwaresecurity.com/domains/runtime/edge-defense/cache-poisoning-deception/",
      "api": "https://softwaresecurity.com/api/v1/articles/cache-poisoning-deception.json",
      "markdown": "https://softwaresecurity.com/downloads/cache-poisoning-deception.md",
      "summary": "Define lookup and storage policy, trace cache/origin interpretation differences and verify both public reuse and private isolation.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-524",
        "A01:2025",
        "A02:2025",
        "API8:2023",
        "V14.2.2",
        "V14.2.5",
        "CAPEC-141"
      ],
      "tags": [
        "access-control",
        "multi-tenancy",
        "http-intermediaries"
      ],
      "stages": [
        "design",
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "bounded-json-xml-parsing",
      "title": "Parse bounded JSON and XML into an explicit application schema",
      "url": "https://softwaresecurity.com/domains/appsec/input-handling/bounded-json-xml-parsing/",
      "api": "https://softwaresecurity.com/api/v1/articles/bounded-json-xml-parsing.json",
      "markdown": "https://softwaresecurity.com/downloads/bounded-json-xml-parsing.md",
      "summary": "Separate parser capabilities from schema rules, reject ambiguous and coercible inputs, and implement the boundary in a complete Python project.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-20",
        "CWE-502",
        "CWE-611",
        "CWE-776",
        "CWE-770",
        "A05:2025",
        "A08:2025",
        "A02:2025",
        "API4:2023",
        "V1.5.1",
        "V1.5.2",
        "V1.5.3",
        "V2.2.1"
      ],
      "tags": [
        "input-validation",
        "deserialization",
        "denial-of-service"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "saml-verification-boundaries",
      "title": "SAML single sign-on: verify signed assertions without losing the identity boundary",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/saml-verification-boundaries/",
      "api": "https://softwaresecurity.com/api/v1/articles/saml-verification-boundaries.json",
      "markdown": "https://softwaresecurity.com/downloads/saml-verification-boundaries.md",
      "summary": "Bind a validated SAML assertion to its trusted issuer, the exact signed element, your service, the browser request and a replay record before creating a local session, and keep your SAML library ahead of its advisories.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-347",
        "CWE-290",
        "CWE-294",
        "CWE-611",
        "A07:2025",
        "A04:2025",
        "API2:2023",
        "V6.8.1",
        "V6.8.2",
        "V6.8.3"
      ],
      "tags": [
        "authentication",
        "enterprise-sso"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "scim-provisioning-deprovisioning",
      "title": "SCIM deprovisioning: make account disablement remove every usable authority",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/scim-provisioning-deprovisioning/",
      "api": "https://softwaresecurity.com/api/v1/articles/scim-provisioning-deprovisioning.json",
      "markdown": "https://softwaresecurity.com/downloads/scim-provisioning-deprovisioning.md",
      "summary": "Connect SCIM resource updates to current sessions, tokens, group-derived permissions and background jobs, with explicit tenant mapping, CAEP revocation events and a measurable revocation contract.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-613",
        "CWE-863",
        "A01:2025",
        "A07:2025",
        "V7.4.2",
        "V8.3.2",
        "V8.4.1"
      ],
      "tags": [
        "enterprise-sso"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "prototype-pollution-boundaries",
      "title": "Keep untrusted object keys out of prototype and authority paths",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/prototype-pollution-boundaries/",
      "api": "https://softwaresecurity.com/api/v1/articles/prototype-pollution-boundaries.json",
      "markdown": "https://softwaresecurity.com/downloads/prototype-pollution-boundaries.md",
      "summary": "Trace an actual nested-merge mutation, replace it with a narrow schema, and make authorization independent of inherited properties.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-1321",
        "CWE-915",
        "A08:2025",
        "A05:2025",
        "API3:2023",
        "V15.3.6",
        "V15.3.3"
      ],
      "tags": [
        "access-control",
        "input-validation",
        "javascript"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "android-secure-coding",
      "title": "Harden an Android app's storage, network and entry points",
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/android-secure-coding/",
      "api": "https://softwaresecurity.com/api/v1/articles/android-secure-coding.json",
      "markdown": "https://softwaresecurity.com/downloads/android-secure-coding.md",
      "summary": "Encrypt local secrets with Android Keystore keys now that Jetpack Security is deprecated, set transport policy in Network Security Configuration, close exported components and mutable PendingIntents, confine WebViews, verify App Links and judge Play Integrity verdicts on the server, mapped to OWASP MASVS 2.1.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-312",
        "CWE-319",
        "CWE-295",
        "CWE-926",
        "CWE-927",
        "CWE-749",
        "CWE-939",
        "CWE-532",
        "A01:2025",
        "A02:2025",
        "A04:2025",
        "A07:2025",
        "A08:2025",
        "MASVS-STORAGE-1",
        "MASVS-STORAGE-2",
        "MASVS-CRYPTO-1",
        "MASVS-CRYPTO-2",
        "MASVS-AUTH-2",
        "MASVS-AUTH-3",
        "MASVS-NETWORK-1",
        "MASVS-NETWORK-2",
        "MASVS-PLATFORM-1",
        "MASVS-PLATFORM-2",
        "MASVS-PLATFORM-3",
        "MASVS-CODE-1",
        "MASVS-CODE-4",
        "MASVS-RESILIENCE-1",
        "MASVS-RESILIENCE-2"
      ],
      "tags": [
        "key-management",
        "mobile",
        "java"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "business-logic-flaws",
      "title": "Prevent business-logic flaws with server-side invariants",
      "url": "https://softwaresecurity.com/domains/appsec/business-logic/business-logic-flaws/",
      "api": "https://softwaresecurity.com/api/v1/articles/business-logic-flaws.json",
      "markdown": "https://softwaresecurity.com/downloads/business-logic-flaws.md",
      "summary": "Recompute prices on the server, run workflows as state machines, build reset links from configuration, limit valuable flows, and turn each business rule into an invariant that the database and the tests both check.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-472",
        "CWE-602",
        "CWE-1284",
        "CWE-839",
        "CWE-837",
        "CWE-841",
        "CWE-640",
        "CWE-799",
        "A06:2025",
        "A07:2025",
        "API6:2023",
        "V2.2",
        "V2.3",
        "V2.4",
        "V6.4",
        "CAPEC-162",
        "CAPEC-74",
        "CAPEC-50",
        "CAPEC-212"
      ],
      "tags": [
        "business-logic",
        "denial-of-service",
        "account-takeover",
        "authentication",
        "edge-defense",
        "security-testing"
      ],
      "stages": [
        "design",
        "test"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "case-study-log4shell",
      "title": "Case study: Log4Shell (CVE-2021-44228)",
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/case-study-log4shell/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-log4shell.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-log4shell.md",
      "summary": "How a JNDI lookup in Apache Log4j became internet-wide remote code execution, why transitive and shaded dependencies made it so hard to patch, which mitigations held, and what it teaches about dependency inventory and SBOMs.",
      "domain": "appsec",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-917",
        "CWE-502",
        "CWE-400",
        "CWE-674",
        "CWE-1104",
        "A05:2025",
        "A03:2025",
        "A08:2025",
        "V1",
        "V15",
        "CAPEC-137",
        "CAPEC-242"
      ],
      "tags": [
        "injection",
        "sbom",
        "dependencies",
        "vulnerability-management",
        "java"
      ],
      "stages": [
        "release",
        "respond"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "crlf-header-log-injection",
      "title": "Prevent CRLF header injection, log forging and CSV formula injection",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/crlf-header-log-injection/",
      "api": "https://softwaresecurity.com/api/v1/articles/crlf-header-log-injection.json",
      "markdown": "https://softwaresecurity.com/downloads/crlf-header-log-injection.md",
      "summary": "Carriage return and line feed separate HTTP header fields, log records and CSV rows, and a leading = turns a spreadsheet cell into a formula. Let the framework write headers, log structured JSON, and neutralize formula triggers in exports.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-93",
        "CWE-113",
        "CWE-117",
        "CWE-1236",
        "A05:2025",
        "A09:2025",
        "V1.2",
        "V4.2",
        "V16.4",
        "CAPEC-34",
        "CAPEC-105",
        "CAPEC-93",
        "CAPEC-81"
      ],
      "tags": [
        "injection",
        "logging-detection"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "devsecops-pipeline",
      "title": "Place each security control in the pipeline and decide what it blocks",
      "url": "https://softwaresecurity.com/domains/appsec/testing/devsecops-pipeline/",
      "api": "https://softwaresecurity.com/api/v1/articles/devsecops-pipeline.json",
      "markdown": "https://softwaresecurity.com/downloads/devsecops-pipeline.md",
      "summary": "Put secrets scanning, SAST, SCA, IaC and image scanning, DAST, fuzzing, attestation and admission control where each sees the right input, block only on findings a developer can act on, and deploy only images the pipeline has attested.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-798",
        "CWE-1395",
        "CWE-1104",
        "CWE-494",
        "A02:2025",
        "A03:2025",
        "A08:2025",
        "V13.3",
        "V15.1",
        "V15.2"
      ],
      "tags": [
        "dependencies",
        "ci-cd",
        "kubernetes",
        "security-testing"
      ],
      "stages": [
        "test",
        "release"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "appsec-tool-categories-and-evaluation",
      "title": "Choose and evaluate application security testing tools",
      "url": "https://softwaresecurity.com/domains/appsec/testing/appsec-tool-categories-and-evaluation/",
      "api": "https://softwaresecurity.com/api/v1/articles/appsec-tool-categories-and-evaluation.json",
      "markdown": "https://softwaresecurity.com/downloads/appsec-tool-categories-and-evaluation.md",
      "summary": "What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "A03:2025",
        "A05:2025",
        "V15.1",
        "V15.2"
      ],
      "tags": [
        "secrets",
        "dependencies",
        "infrastructure-as-code",
        "kubernetes",
        "api-security",
        "security-testing",
        "vulnerability-management",
        "appsec-program"
      ],
      "stages": [
        "test",
        "respond",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre",
        "security-leader"
      ]
    },
    {
      "key": "dom-xss-postmessage",
      "title": "Prevent DOM XSS, postMessage abuse and client-side injection",
      "url": "https://softwaresecurity.com/domains/appsec/browser-security/dom-xss-postmessage/",
      "api": "https://softwaresecurity.com/api/v1/articles/dom-xss-postmessage.json",
      "markdown": "https://softwaresecurity.com/downloads/dom-xss-postmessage.md",
      "summary": "Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-79",
        "CWE-95",
        "CWE-1336",
        "CWE-346",
        "A05:2025",
        "V1.2",
        "V1.3",
        "V3.2",
        "V3.5",
        "CAPEC-588",
        "CAPEC-63"
      ],
      "tags": [
        "injection",
        "xss",
        "browser-security",
        "secure-defaults",
        "javascript"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "ios-secure-coding",
      "title": "Harden an iOS app's storage, network and entry points",
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/ios-secure-coding/",
      "api": "https://softwaresecurity.com/api/v1/articles/ios-secure-coding.json",
      "markdown": "https://softwaresecurity.com/downloads/ios-secure-coding.md",
      "summary": "Store secrets in the Keychain with the narrowest accessibility class, set file protection explicitly, keep App Transport Security on, prefer universal links, constrain WKWebView bridges, keep step-up keys in the Secure Enclave, verify App Attest on the server and ship an accurate privacy manifest, mapped to OWASP MASVS 2.1.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-312",
        "CWE-319",
        "CWE-295",
        "CWE-939",
        "CWE-940",
        "CWE-749",
        "CWE-532",
        "CWE-602",
        "A01:2025",
        "A02:2025",
        "A04:2025",
        "A06:2025",
        "A07:2025",
        "MASVS-STORAGE-1",
        "MASVS-STORAGE-2",
        "MASVS-CRYPTO-1",
        "MASVS-CRYPTO-2",
        "MASVS-AUTH-2",
        "MASVS-AUTH-3",
        "MASVS-NETWORK-1",
        "MASVS-NETWORK-2",
        "MASVS-PLATFORM-1",
        "MASVS-PLATFORM-2",
        "MASVS-PLATFORM-3",
        "MASVS-CODE-4",
        "MASVS-RESILIENCE-1",
        "MASVS-RESILIENCE-2",
        "MASVS-PRIVACY-1",
        "MASVS-PRIVACY-3"
      ],
      "tags": [
        "key-management",
        "mobile"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "memory-safety-c-cpp",
      "title": "Find, fix and contain memory-safety bugs in C and C++",
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/memory-safety-c-cpp/",
      "api": "https://softwaresecurity.com/api/v1/articles/memory-safety-c-cpp.json",
      "markdown": "https://softwaresecurity.com/downloads/memory-safety-c-cpp.md",
      "summary": "Recognize out-of-bounds access, use after free, NULL dereference and integer overflow in C and C++, fix them with checked lengths and single ownership, harden release builds, catch the rest with sanitizers and fuzzing, and plan new code in a memory-safe language.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-787",
        "CWE-125",
        "CWE-416",
        "CWE-120",
        "CWE-121",
        "CWE-122",
        "CWE-476",
        "CWE-190",
        "A10:2025",
        "V1.4",
        "CAPEC-100",
        "CAPEC-540",
        "CAPEC-92"
      ],
      "tags": [
        "memory-safety",
        "security-testing",
        "c-cpp-rust"
      ],
      "stages": [
        "build",
        "test"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "nosql-ldap-xpath-injection",
      "title": "Prevent NoSQL, LDAP, XPath and expression-language injection",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/nosql-ldap-xpath-injection/",
      "api": "https://softwaresecurity.com/api/v1/articles/nosql-ldap-xpath-injection.json",
      "markdown": "https://softwaresecurity.com/downloads/nosql-ldap-xpath-injection.md",
      "summary": "SQL is not the only query language that receives user input. Stop MongoDB operator injection with type checks and $eq, escape LDAP filter values, pass XPath values as variables, and never evaluate SpEL or OGNL built from request data.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-943",
        "CWE-90",
        "CWE-643",
        "CWE-917",
        "CWE-1287",
        "A05:2025",
        "V1.2",
        "V1.3",
        "V15.3",
        "CAPEC-676",
        "CAPEC-136",
        "CAPEC-83"
      ],
      "tags": [
        "injection",
        "input-validation",
        "java"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "open-redirect",
      "title": "Redirect users only to destinations you control",
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/open-redirect/",
      "api": "https://softwaresecurity.com/api/v1/articles/open-redirect.json",
      "markdown": "https://softwaresecurity.com/downloads/open-redirect.md",
      "summary": "Check every redirect target taken from a request, so attackers cannot borrow your domain for phishing, carry OAuth tokens off-site or steer a server-side fetcher through your redirects.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-601",
        "A01:2025",
        "V3",
        "V10",
        "WSTG-CLNT-04"
      ],
      "tags": [
        "ssrf",
        "input-validation",
        "account-takeover",
        "oauth-oidc"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "redos-input-validation",
      "title": "Validate input safely and prevent regex denial of service",
      "url": "https://softwaresecurity.com/domains/appsec/input-handling/redos-input-validation/",
      "api": "https://softwaresecurity.com/api/v1/articles/redos-input-validation.json",
      "markdown": "https://softwaresecurity.com/downloads/redos-input-validation.md",
      "summary": "Find and fix exponential and quadratic regex backtracking with measured examples, choose linear-time engines or timeouts, and build allowlist validation that decodes once and rejects type confusion and parameter pollution.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-1333",
        "CWE-20",
        "CWE-1287",
        "CWE-777",
        "CWE-180",
        "CWE-235",
        "A05:2025",
        "API4:2023",
        "V1.1",
        "V1.2",
        "V1.3",
        "V2.2",
        "V15.3",
        "CAPEC-492",
        "CAPEC-460",
        "CAPEC-267",
        "CAPEC-71"
      ],
      "tags": [
        "input-validation",
        "denial-of-service"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "rust-unsafe-ffi",
      "title": "Audit unsafe Rust, FFI boundaries and crate dependencies",
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/rust-unsafe-ffi/",
      "api": "https://softwaresecurity.com/api/v1/articles/rust-unsafe-ffi.json",
      "markdown": "https://softwaresecurity.com/downloads/rust-unsafe-ffi.md",
      "summary": "Know what the Rust compiler proves and what it leaves to you: review unsafe code for soundness, wrap foreign calls in small safe functions, decide how overflow and panics behave in release builds, gate crates with RustSec, and replace C one boundary at a time.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-758",
        "CWE-416",
        "CWE-762",
        "CWE-190",
        "CWE-617",
        "CWE-1395",
        "CWE-1357",
        "A03:2025",
        "A10:2025",
        "V1.4",
        "V15.1",
        "V15.2",
        "CAPEC-538",
        "CAPEC-100"
      ],
      "tags": [
        "memory-safety",
        "error-handling",
        "dependencies",
        "c-cpp-rust"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "security-headers",
      "title": "Configure HTTP security headers from a tested baseline",
      "url": "https://softwaresecurity.com/domains/appsec/browser-security/security-headers/",
      "api": "https://softwaresecurity.com/api/v1/articles/security-headers.json",
      "markdown": "https://softwaresecurity.com/downloads/security-headers.md",
      "summary": "Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-1021",
        "CWE-319",
        "CWE-614",
        "CWE-1004",
        "A02:2025",
        "A04:2025",
        "A06:2025",
        "API8:2023",
        "V3",
        "CAPEC-103",
        "CAPEC-102",
        "WSTG-CONF-07",
        "WSTG-CLNT-09"
      ],
      "tags": [
        "browser-security",
        "tls",
        "secure-defaults"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "threat-modeling-methods",
      "title": "Choose a threat modeling method and turn its findings into tests",
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/threat-modeling-methods/",
      "api": "https://softwaresecurity.com/api/v1/articles/threat-modeling-methods.json",
      "markdown": "https://softwaresecurity.com/downloads/threat-modeling-methods.md",
      "summary": "Use the four-question frame to scope a design, pick STRIDE, attack trees, LINDDUN or PASTA by the question you need answered, and leave behind threat records and abuse-case tests the team can run.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "A06:2025"
      ],
      "tags": [
        "threat-modeling"
      ],
      "stages": [
        "design"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "vdp-bug-bounty-pentest",
      "title": "Start with a VDP, then add bug bounties and penetration tests",
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/vdp-bug-bounty-pentest/",
      "api": "https://softwaresecurity.com/api/v1/articles/vdp-bug-bounty-pentest.json",
      "markdown": "https://softwaresecurity.com/downloads/vdp-bug-bounty-pentest.md",
      "summary": "Publish a vulnerability disclosure policy and security.txt first, add a bug bounty only when you can triage and fix at the pace rewards bring, and buy penetration tests with a written scope, rules of engagement and a retest.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "security-testing",
        "vulnerability-disclosure"
      ],
      "stages": [
        "test",
        "respond"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "case-study-shai-hulud",
      "title": "Case study: the Shai-Hulud npm worm (2025-2026)",
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/case-study-shai-hulud/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-shai-hulud.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-shai-hulud.md",
      "summary": "How a self-replicating npm worm turned stolen tokens into hundreds of infected packages in 2025, how its 2026 successors hijacked release pipelines and trusted publishing, what npm and GitHub changed in response, and the publishing, install and response practices that stop it.",
      "domain": "supply-chain",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-506",
        "CWE-829",
        "CWE-1357",
        "CWE-522",
        "A03:2025",
        "A08:2025",
        "V15.2",
        "V13.3",
        "CAPEC-538",
        "CAPEC-511"
      ],
      "tags": [
        "secrets",
        "dependencies",
        "supply-chain-attacks",
        "signing",
        "incident-response",
        "javascript"
      ],
      "stages": [
        "build",
        "release",
        "respond"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-tj-actions",
      "title": "Case study: the tj-actions/changed-files compromise (CVE-2025-30066)",
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/case-study-tj-actions/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-tj-actions.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-tj-actions.md",
      "summary": "In March 2025 an attacker moved the version tags of a popular GitHub Action, and of a reviewdog action before it, to code that printed CI secrets into build logs. This case study traces the token chain back to one pull_request_target workflow, sizes the exposure, and shows how it was caught and which controls held.",
      "domain": "supply-chain",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-506",
        "CWE-829",
        "CWE-494",
        "CWE-532",
        "A03:2025",
        "A08:2025",
        "V13.3",
        "CAPEC-538",
        "CAPEC-439"
      ],
      "tags": [
        "secrets",
        "supply-chain-attacks",
        "ci-cd",
        "logging-detection",
        "incident-response"
      ],
      "stages": [
        "build",
        "release",
        "respond"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-xz-utils",
      "title": "Case study: the xz Utils backdoor (CVE-2024-3094)",
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/case-study-xz-utils/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-xz-utils.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-xz-utils.md",
      "summary": "How a multi-year maintainer takeover planted a backdoor in xz Utils release tarballs, how build-time injection hid it from the git repository, why a performance anomaly exposed it, which systems shipped it, and what it teaches about reproducible builds and maintainer health.",
      "domain": "supply-chain",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-506",
        "CWE-912",
        "CWE-1357",
        "CWE-494",
        "A03:2025",
        "A08:2025",
        "V15",
        "CAPEC-444",
        "CAPEC-538"
      ],
      "tags": [
        "dependencies",
        "supply-chain-attacks",
        "build-integrity",
        "supplier-risk",
        "c-cpp-rust"
      ],
      "stages": [
        "build",
        "release",
        "respond",
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-solarwinds",
      "title": "Case study: the SolarWinds Orion build compromise (SUNBURST)",
      "url": "https://softwaresecurity.com/domains/supply-chain/builds/case-study-solarwinds/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-solarwinds.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-solarwinds.md",
      "summary": "How an implant on SolarWinds' build server inserted the SUNBURST backdoor into signed Orion updates in 2020, how it was found, why code signing and review could not catch it, and which build controls would have.",
      "domain": "supply-chain",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-506",
        "CWE-912",
        "A03:2025",
        "A08:2025",
        "CAPEC-444",
        "CAPEC-511",
        "CAPEC-206"
      ],
      "tags": [
        "dependencies",
        "supply-chain-attacks",
        "build-integrity",
        "signing"
      ],
      "stages": [
        "release",
        "respond"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-codecov",
      "title": "Case study: the Codecov Bash Uploader compromise (2021)",
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/case-study-codecov/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-codecov.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-codecov.md",
      "summary": "How a credential leaked through Codecov's Docker image process let an attacker change the Bash Uploader that many CI pipelines downloaded and ran, which sent their environment variables, and the secrets in them, to the attacker for two months in 2021.",
      "domain": "supply-chain",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-494",
        "CWE-506",
        "A03:2025",
        "A08:2025",
        "CAPEC-439"
      ],
      "tags": [
        "secrets",
        "dependencies",
        "supply-chain-attacks",
        "ci-cd",
        "signing"
      ],
      "stages": [
        "build",
        "release",
        "respond"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-3cx",
      "title": "Case study: the 3CX DesktopApp supply-chain attack (CVE-2023-29059)",
      "url": "https://softwaresecurity.com/domains/supply-chain/builds/case-study-3cx/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-3cx.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-3cx.md",
      "summary": "How a trojanized trading application on one employee's personal computer led to 3CX's build servers and to signed, malicious 3CX DesktopApp releases in 2023: the first cascading software supply-chain compromise Mandiant had seen, how EDR caught it, and the controls that would have stopped it.",
      "domain": "supply-chain",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-506",
        "A03:2025",
        "A08:2025",
        "CAPEC-511",
        "CAPEC-444",
        "CAPEC-206"
      ],
      "tags": [
        "supply-chain-attacks",
        "build-integrity",
        "signing",
        "logging-detection"
      ],
      "stages": [
        "release",
        "respond"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "case-study-event-stream",
      "title": "Case study: event-stream and ua-parser-js, two npm package takeovers",
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/case-study-event-stream/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-event-stream.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-event-stream.md",
      "summary": "Two ways attackers took over popular npm packages: event-stream (2018), handed to a stranger who added a targeted, encrypted payload through a new dependency, and ua-parser-js (2021), whose maintainer's account was hijacked to publish versions that installed malware for four hours. Timelines, detection and the controls that stop both.",
      "domain": "supply-chain",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-506",
        "CWE-829",
        "CWE-1357",
        "A03:2025",
        "A08:2025",
        "CAPEC-538"
      ],
      "tags": [
        "account-takeover",
        "dependencies",
        "supply-chain-attacks",
        "supplier-risk",
        "javascript"
      ],
      "stages": [
        "build",
        "respond",
        "govern"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-polyfill-io",
      "title": "Case study: the polyfill.io CDN takeover (2024)",
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/case-study-polyfill-io/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-polyfill-io.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-polyfill-io.md",
      "summary": "How the sale of the polyfill.io domain and project in February 2024 turned a script tag on more than 100,000 websites into a channel for malicious redirects by June, why Subresource Integrity could not have protected it, and the controls that would have.",
      "domain": "supply-chain",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-829",
        "CWE-494",
        "A03:2025",
        "A08:2025"
      ],
      "tags": [
        "browser-security",
        "supply-chain-attacks",
        "supplier-risk"
      ],
      "stages": [
        "build",
        "respond",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-moveit",
      "title": "Case study: MOVEit Transfer mass exploitation (CVE-2023-34362)",
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/case-study-moveit/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-moveit.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-moveit.md",
      "summary": "How one unauthenticated SQL injection in an internet-facing file transfer product let the Cl0p group steal data from thousands of organizations in days in 2023, how defenders found the web shell, and the vendor and customer controls that would have limited it.",
      "domain": "appsec",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-89",
        "A05:2025",
        "CAPEC-66"
      ],
      "tags": [
        "injection",
        "incident-response",
        "vulnerability-management",
        "supplier-risk"
      ],
      "stages": [
        "respond",
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "dependency-confusion",
      "title": "Stop dependency confusion and typosquatting at install time",
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/dependency-confusion/",
      "api": "https://softwaresecurity.com/api/v1/articles/dependency-confusion.json",
      "markdown": "https://softwaresecurity.com/downloads/dependency-confusion.md",
      "summary": "Pin every internal package name to its real source, verify installed bytes against a lockfile, and delay or gate install scripts so a public look-alike cannot replace a private dependency.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-427",
        "CWE-494",
        "CWE-829",
        "CWE-1104",
        "CWE-1357",
        "A03:2025",
        "A08:2025",
        "LLM04:2026",
        "V15.2.4",
        "V15.1.2",
        "CAPEC-471",
        "CAPEC-538"
      ],
      "tags": [
        "dependencies",
        "supply-chain-attacks",
        "ai-assisted-development",
        "javascript",
        "python"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "github-actions-hardening",
      "title": "Harden GitHub Actions against workflow and supply-chain attacks",
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/github-actions-hardening/",
      "api": "https://softwaresecurity.com/api/v1/articles/github-actions-hardening.json",
      "markdown": "https://softwaresecurity.com/downloads/github-actions-hardening.md",
      "summary": "Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-94",
        "CWE-95",
        "CWE-116",
        "CWE-829",
        "CWE-275",
        "CWE-349",
        "A08:2025",
        "A03:2025",
        "A05:2025",
        "V1.2.5",
        "V13.3.1",
        "V13.3.2",
        "CAPEC-88",
        "CAPEC-538"
      ],
      "tags": [
        "injection",
        "workload-identity",
        "secrets",
        "ci-cd"
      ],
      "stages": [
        "build",
        "release"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "source-repository-protection",
      "title": "Protect the source repository: rulesets, reviews and signed commits",
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/source-repository-protection/",
      "api": "https://softwaresecurity.com/api/v1/articles/source-repository-protection.json",
      "markdown": "https://softwaresecurity.com/downloads/source-repository-protection.md",
      "summary": "Configure the controls every repository that ships software needs: protected branches and tags, required review with CODEOWNERS, signed commits, secret push protection and account security, mapped to the SLSA Source track, the OpenSSF OSPS Baseline and Scorecard.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-284",
        "CWE-1357",
        "A03:2025",
        "A08:2025",
        "V15"
      ],
      "tags": [
        "secrets",
        "dependencies",
        "ci-cd",
        "build-integrity",
        "signing",
        "code-review",
        "secure-sdlc",
        "supplier-risk"
      ],
      "stages": [
        "build",
        "test",
        "release",
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "developer-workstation-security",
      "title": "Secure the developer workstation: extensions, package managers, secrets and AI agents",
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/developer-workstation-security/",
      "api": "https://softwaresecurity.com/api/v1/articles/developer-workstation-security.json",
      "markdown": "https://softwaresecurity.com/downloads/developer-workstation-security.md",
      "summary": "Attackers reach the software supply chain through developers' editors, package installs and AI agents. Allow-list extensions, stop install scripts and brand-new versions, keep long-lived secrets off laptops, and lock down repository files that run code when a project opens.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-506",
        "CWE-829",
        "CWE-522",
        "A03:2025",
        "A08:2025"
      ],
      "tags": [
        "dependencies",
        "supply-chain-attacks",
        "kubernetes",
        "ai-agents",
        "secure-defaults"
      ],
      "stages": [
        "design",
        "build",
        "release"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "open-source-license-compliance",
      "title": "Open source license compliance: SPDX expressions, obligations and SBOM checks",
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/open-source-license-compliance/",
      "api": "https://softwaresecurity.com/api/v1/articles/open-source-license-compliance.json",
      "markdown": "https://softwaresecurity.com/downloads/open-source-license-compliance.md",
      "summary": "Know which licenses you ship, read SPDX license expressions correctly, meet the obligations of common licenses for the way you distribute, and enforce a license policy in CI from the SBOM.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "sbom",
        "compliance",
        "supplier-risk"
      ],
      "stages": [
        "build",
        "release",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "cloud-provider-baselines",
      "title": "Apply a security baseline across AWS, Azure and Google Cloud",
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/cloud-provider-baselines/",
      "api": "https://softwaresecurity.com/api/v1/articles/cloud-provider-baselines.json",
      "markdown": "https://softwaresecurity.com/downloads/cloud-provider-baselines.md",
      "summary": "Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-1188",
        "CWE-732",
        "CWE-918",
        "CWE-798",
        "CWE-778",
        "A02:2025",
        "A01:2025",
        "A09:2025",
        "A07:2025",
        "V13.2",
        "V13.3",
        "V16.4",
        "CAPEC-664",
        "CAPEC-560"
      ],
      "tags": [
        "workload-identity",
        "cloud",
        "infrastructure-as-code",
        "logging-detection"
      ],
      "stages": [
        "operate"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "runtime-threat-detection",
      "title": "Detect container and host threats at runtime with eBPF sensors and cloud services",
      "url": "https://softwaresecurity.com/domains/runtime/detection/runtime-threat-detection/",
      "api": "https://softwaresecurity.com/api/v1/articles/runtime-threat-detection.json",
      "markdown": "https://softwaresecurity.com/downloads/runtime-threat-detection.md",
      "summary": "Watch process, file and network activity inside containers with an eBPF sensor or a managed cloud agent, write and test rules for the attacks you expect, tune them with narrow exceptions and contain a compromised pod without destroying evidence.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-778",
        "A09:2025",
        "V16"
      ],
      "tags": [
        "cloud",
        "kubernetes",
        "logging-detection",
        "incident-response"
      ],
      "stages": [
        "operate",
        "respond"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "managed-kubernetes-hardening",
      "title": "Harden managed Kubernetes on EKS, AKS and GKE",
      "url": "https://softwaresecurity.com/domains/runtime/containers/managed-kubernetes-hardening/",
      "api": "https://softwaresecurity.com/api/v1/articles/managed-kubernetes-hardening.json",
      "markdown": "https://softwaresecurity.com/downloads/managed-kubernetes-hardening.md",
      "summary": "Know what your provider secures and what you still own, then lock down API access, cloud identity, nodes, pod privileges and admission with settings that are generally available in Kubernetes 1.37, checked against the CIS and NSA/CISA baselines.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-250",
        "CWE-269",
        "CWE-1188",
        "CWE-284",
        "A02:2025",
        "A01:2025",
        "V13"
      ],
      "tags": [
        "cloud",
        "kubernetes"
      ],
      "stages": [
        "build",
        "operate"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "l7-ddos-resilience",
      "title": "Keep HTTP services up under application-layer DDoS",
      "url": "https://softwaresecurity.com/domains/runtime/availability/l7-ddos-resilience/",
      "api": "https://softwaresecurity.com/api/v1/articles/l7-ddos-resilience.json",
      "markdown": "https://softwaresecurity.com/downloads/l7-ddos-resilience.md",
      "summary": "Bound every phase of an HTTP request, patch for the HTTP/2 attack classes, rate limit at the edge and the origin, and shed load deliberately, with nginx, Envoy and Node.js settings tested against slow clients and bursts.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-400",
        "CWE-770",
        "API4:2023",
        "CAPEC-469",
        "CAPEC-488"
      ],
      "tags": [
        "http-intermediaries",
        "denial-of-service",
        "api-security",
        "edge-defense",
        "javascript"
      ],
      "stages": [
        "build",
        "operate"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "cloud-security-posture",
      "title": "Choose cloud security posture tools and apply zero trust",
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/cloud-security-posture/",
      "api": "https://softwaresecurity.com/api/v1/articles/cloud-security-posture.json",
      "markdown": "https://softwaresecurity.com/downloads/cloud-security-posture.md",
      "summary": "What CSPM, CWPP, CIEM, CNAPP, DSPM and ASPM each find and miss, how they overlap, how to evaluate one on your own accounts, and how zero trust as defined in NIST SP 800-207 uses what they measure.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-1188",
        "CWE-732",
        "CWE-250",
        "A02:2025",
        "A01:2025"
      ],
      "tags": [
        "cloud",
        "security-testing",
        "vulnerability-management",
        "appsec-program",
        "compliance"
      ],
      "stages": [
        "test",
        "operate",
        "respond",
        "govern"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "container-image-hardening",
      "title": "Harden container images from Dockerfile to admission",
      "url": "https://softwaresecurity.com/domains/runtime/containers/container-image-hardening/",
      "api": "https://softwaresecurity.com/api/v1/articles/container-image-hardening.json",
      "markdown": "https://softwaresecurity.com/downloads/container-image-hardening.md",
      "summary": "Build minimal, non-root images pinned by digest, keep secrets out of every layer, then scan, sign and verify the exact digest before it runs with dropped privileges.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-250",
        "CWE-538",
        "CWE-494",
        "CWE-1395",
        "A02:2025",
        "A03:2025",
        "A08:2025",
        "V13",
        "V15"
      ],
      "tags": [
        "secrets",
        "sbom",
        "signing",
        "kubernetes"
      ],
      "stages": [
        "build",
        "release",
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "image-hardening-benchmarks",
      "title": "Harden the images you ship against CIS, STIG and SCAP benchmarks",
      "url": "https://softwaresecurity.com/domains/runtime/containers/image-hardening-benchmarks/",
      "api": "https://softwaresecurity.com/api/v1/articles/image-hardening-benchmarks.json",
      "markdown": "https://softwaresecurity.com/downloads/image-hardening-benchmarks.md",
      "summary": "Hold each image your team ships (container base images, golden VM images, Kubernetes node images) to a published benchmark through a pinned SCAP Security Guide profile, scan every build with OpenSCAP, and fail the build on any failure that a deviation register does not explain with an owner, an approver and an expiry.",
      "domain": "runtime",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-1188",
        "A02:2025"
      ],
      "tags": [
        "kubernetes",
        "secure-defaults",
        "appsec-program",
        "compliance"
      ],
      "stages": [
        "build",
        "operate",
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "osps-baseline-maintainers",
      "title": "Meet the OpenSSF OSPS Baseline as a maintainer: the levels, every Level 1 control on GitHub, and the evidence",
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/osps-baseline-for-maintainers/",
      "api": "https://softwaresecurity.com/api/v1/articles/osps-baseline-maintainers.json",
      "markdown": "https://softwaresecurity.com/downloads/osps-baseline-maintainers.md",
      "summary": "Walk through the eight control families and three maturity levels of OSPS Baseline v2026.08.28, meet each Level 1 requirement on a GitHub repository, and keep evidence a consumer can check.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "dependencies",
        "supply-chain-attacks",
        "ci-cd",
        "secure-sdlc",
        "supplier-risk"
      ],
      "stages": [
        "build",
        "release",
        "govern"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "s2c2f-consumer-adoption",
      "title": "Adopt the OpenSSF S2C2F as a consumer: the eight practices, the four maturity levels and a staged plan with evidence",
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/s2c2f-adoption/",
      "api": "https://softwaresecurity.com/api/v1/articles/s2c2f-consumer-adoption.json",
      "markdown": "https://softwaresecurity.com/downloads/s2c2f-consumer-adoption.md",
      "summary": "Assess how your organization takes in open source against the Secure Supply Chain Consumption Framework's 25 requirements, then reach each maturity level in turn with evidence an assessor can check.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "dependencies",
        "supplier-risk"
      ],
      "stages": [
        "build",
        "govern"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "crypto-quick-reference",
      "title": "Choose cryptographic algorithms and parameters by job",
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/crypto-quick-reference/",
      "api": "https://softwaresecurity.com/api/v1/articles/crypto-quick-reference.json",
      "markdown": "https://softwaresecurity.com/downloads/crypto-quick-reference.md",
      "summary": "A sourced quick reference for October 2026: which algorithm and parameters to use for encryption, hashing, passwords, MACs, signatures, key agreement, key derivation, randomness and TLS, the matching APIs in Node.js, Python, Java, Go and .NET, and where post-quantum migration stands.",
      "domain": "identity-crypto",
      "type": "Reference",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-327",
        "CWE-326",
        "CWE-328",
        "CWE-916",
        "CWE-338",
        "CWE-323",
        "CWE-347",
        "CWE-757",
        "A04:2025",
        "V11.2",
        "V11.3",
        "V11.4",
        "V11.5",
        "V11.6",
        "V12.1",
        "CAPEC-97",
        "CAPEC-20",
        "CAPEC-55",
        "CAPEC-463",
        "CAPEC-620"
      ],
      "tags": [
        "password-storage",
        "encryption",
        "key-management",
        "pki",
        "tls",
        "post-quantum"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "jwt-attacks",
      "title": "Defend JWTs against forgery, confusion and replay",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/jwt-attacks/",
      "api": "https://softwaresecurity.com/api/v1/articles/jwt-attacks.json",
      "markdown": "https://softwaresecurity.com/downloads/jwt-attacks.md",
      "summary": "Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg \"none\", key-confusion, header-injection, weak-secret and replay attacks.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-347",
        "CWE-287",
        "CWE-290",
        "CWE-613",
        "CWE-326",
        "CWE-918",
        "A07:2025",
        "A04:2025",
        "A01:2025",
        "API2:2023",
        "V9",
        "V7",
        "V10",
        "CAPEC-475",
        "CAPEC-196",
        "CAPEC-593"
      ],
      "tags": [
        "jwt",
        "api-security"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "leaked-secret-response",
      "title": "Contain a leaked secret, then investigate and clean up",
      "url": "https://softwaresecurity.com/domains/identity-crypto/secrets/leaked-secret-response/",
      "api": "https://softwaresecurity.com/api/v1/articles/leaked-secret-response.json",
      "markdown": "https://softwaresecurity.com/downloads/leaked-secret-response.md",
      "summary": "Revoke an exposed API key, token or private key at its issuer before anything else, end the sessions it minted, check the provider's logs, then remove every copy and replace it with a credential that expires on its own.",
      "domain": "identity-crypto",
      "type": "Recipe",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-798",
        "CWE-540",
        "CWE-532",
        "CWE-522",
        "CWE-321",
        "A07:2025",
        "A04:2025",
        "A02:2025",
        "V13.3",
        "V13.2",
        "CAPEC-560",
        "CAPEC-37",
        "CAPEC-191"
      ],
      "tags": [
        "workload-identity",
        "secrets",
        "cloud",
        "incident-response"
      ],
      "stages": [
        "build",
        "operate",
        "respond"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "mfa-account-takeover",
      "title": "Stop account takeover with the right MFA and login defenses",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/mfa-account-takeover/",
      "api": "https://softwaresecurity.com/api/v1/articles/mfa-account-takeover.json",
      "markdown": "https://softwaresecurity.com/downloads/mfa-account-takeover.md",
      "summary": "Rank MFA options by the attacks they stop, implement TOTP and push approvals correctly, and close the login, reset and recovery paths that attackers use instead of breaking the second factor.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-307",
        "CWE-308",
        "CWE-294",
        "CWE-204",
        "CWE-208",
        "CWE-521",
        "CWE-640",
        "A07:2025",
        "API2:2023",
        "V6.2",
        "V6.3",
        "V6.4",
        "V6.5",
        "V6.6",
        "V2.4",
        "CAPEC-600",
        "CAPEC-565",
        "CAPEC-49",
        "CAPEC-94",
        "CAPEC-575"
      ],
      "tags": [
        "account-takeover",
        "authentication",
        "mfa-passkeys"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "oauth-oidc-attacks",
      "title": "Defend OAuth and OIDC against redirect and token attacks",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/oauth-oidc-attacks/",
      "api": "https://softwaresecurity.com/api/v1/articles/oauth-oidc-attacks.json",
      "markdown": "https://softwaresecurity.com/downloads/oauth-oidc-attacks.md",
      "summary": "Apply RFC 9700 and RFC 10017: exact redirect matching, PKCE with downgrade protection, state and iss binding, refresh-token rotation, sender-constrained tokens, and a backend-for-frontend so browser tokens cannot be stolen.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-601",
        "CWE-352",
        "CWE-346",
        "CWE-294",
        "CWE-287",
        "A07:2025",
        "A01:2025",
        "API2:2023",
        "V10",
        "V3",
        "V7",
        "CAPEC-62",
        "CAPEC-593"
      ],
      "tags": [
        "authentication",
        "oauth-oidc"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "appsec-engineer"
      ]
    },
    {
      "key": "appsec-metrics-and-slas",
      "title": "Set remediation SLAs and measure AppSec outcomes",
      "url": "https://softwaresecurity.com/frameworks/appsec-metrics-and-slas/",
      "api": "https://softwaresecurity.com/api/v1/articles/appsec-metrics-and-slas.json",
      "markdown": "https://softwaresecurity.com/downloads/appsec-metrics-and-slas.md",
      "summary": "Set vulnerability SLAs by exploitation and exposure, route misses through expiring exceptions, and measure the program with cohort-based, censoring-aware metrics that resist gaming.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "V15"
      ],
      "tags": [
        "vulnerability-management",
        "appsec-program",
        "secure-sdlc"
      ],
      "stages": [
        "respond",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre",
        "security-leader"
      ]
    },
    {
      "key": "cra-reporting-runbook",
      "title": "Build a runbook for CRA vulnerability and incident reporting",
      "url": "https://softwaresecurity.com/frameworks/cra-reporting-runbook/",
      "api": "https://softwaresecurity.com/api/v1/articles/cra-reporting-runbook.json",
      "markdown": "https://softwaresecurity.com/downloads/cra-reporting-runbook.md",
      "summary": "Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform within 24 and 72 hours. Decide what is reportable, start the clock at the right moment, file through the platform and keep an evidence trail.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "A03:2025",
        "A08:2025"
      ],
      "tags": [
        "incident-response",
        "vulnerability-disclosure",
        "appsec-program",
        "regulation"
      ],
      "stages": [
        "respond",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "pci-dss-requirement-6",
      "title": "Map PCI DSS Requirement 6 to engineering practice and evidence",
      "url": "https://softwaresecurity.com/frameworks/pci-dss-requirement-6/",
      "api": "https://softwaresecurity.com/api/v1/articles/pci-dss-requirement-6.json",
      "markdown": "https://softwaresecurity.com/downloads/pci-dss-requirement-6.md",
      "summary": "Turn PCI DSS v4.0.1 Requirement 6 into engineering work: secure development, review, patching, web-attack protection, payment-page script control and change management, with the records an assessor samples and the parts that became mandatory on 31 March 2025.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-829",
        "CWE-494",
        "CWE-1395",
        "A03:2025",
        "A08:2025",
        "V3.6",
        "V15.1",
        "V15.2"
      ],
      "tags": [
        "secure-sdlc",
        "compliance",
        "regulation"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre",
        "security-leader"
      ]
    },
    {
      "key": "security-champions-program",
      "title": "Run a security champions program with protected time and outcome metrics",
      "url": "https://softwaresecurity.com/frameworks/security-champions-program/",
      "api": "https://softwaresecurity.com/api/v1/articles/security-champions-program.json",
      "markdown": "https://softwaresecurity.com/downloads/security-champions-program.md",
      "summary": "Put a trained engineer with protected hours in every in-scope team, write the role into a one-page charter, route sensitive changes and findings through champions and AppSec, and judge the program by coverage and outcomes instead of attendance.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "code-review",
        "appsec-program"
      ],
      "stages": [
        "test",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "vulnerability-prioritization",
      "title": "Prioritize vulnerabilities by exploitation, exposure and impact",
      "url": "https://softwaresecurity.com/frameworks/vulnerability-prioritization/",
      "api": "https://softwaresecurity.com/api/v1/articles/vulnerability-prioritization.json",
      "markdown": "https://softwaresecurity.com/downloads/vulnerability-prioritization.md",
      "summary": "Rank vulnerabilities with CISA KEV, EPSS, CVSS 4.0 vectors and SSVC decision points, adjust for presence, reachability and asset value, and turn the result into due dates. Covers NVD's 2026 enrichment changes and CISA BOD 26-04.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-1395",
        "A03:2025",
        "V15"
      ],
      "tags": [
        "vex",
        "vulnerability-management",
        "appsec-program"
      ],
      "stages": [
        "respond",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "ai-assisted-development",
      "title": "Secure AI-assisted development with coding assistants and agents",
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/ai-assisted-development/",
      "api": "https://softwaresecurity.com/api/v1/articles/ai-assisted-development.json",
      "markdown": "https://softwaresecurity.com/downloads/ai-assisted-development.md",
      "summary": "Treat generated code, suggested packages, repository text and MCP servers as untrusted inputs, and confine coding agents with OS-level isolation and short-lived, narrowly scoped credentials.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-1427",
        "CWE-1357",
        "CWE-829",
        "CWE-250",
        "A03:2025",
        "A08:2025",
        "LLM01:2026",
        "LLM02:2026",
        "LLM03:2026",
        "LLM04:2026",
        "LLM07:2026",
        "LLM10:2026",
        "ASI01:2026",
        "ASI02:2026",
        "ASI03:2026",
        "ASI04:2026",
        "ASI05:2026",
        "ASI09:2026",
        "V15"
      ],
      "tags": [
        "secrets",
        "supply-chain-attacks",
        "llm-security",
        "prompt-injection",
        "ai-agents",
        "ai-assisted-development"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "security-requirements-definition-of-done",
      "title": "Write testable security requirements and a security Definition of Done",
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/security-requirements-definition-of-done/",
      "api": "https://softwaresecurity.com/api/v1/articles/security-requirements-definition-of-done.json",
      "markdown": "https://softwaresecurity.com/downloads/security-requirements-definition-of-done.md",
      "summary": "Derive security requirements from OWASP ASVS 5.0, abuse cases and the threat model, write them as acceptance criteria a test can fail, trace each one to a test or evidence, and close stories against a short security Definition of Done.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "V2",
        "V6",
        "V8",
        "V16"
      ],
      "tags": [
        "threat-modeling",
        "security-testing",
        "secure-sdlc",
        "compliance"
      ],
      "stages": [
        "design",
        "test",
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "abuse-case-library",
      "title": "Abuse case library: tests and controls by feature",
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/abuse-case-library/",
      "api": "https://softwaresecurity.com/api/v1/articles/abuse-case-library.json",
      "markdown": "https://softwaresecurity.com/downloads/abuse-case-library.md",
      "summary": "Recurring abuse cases for sign-up and login, password reset, MFA enrolment, invites, file upload, payments and coupons, webhooks, search, export, admin and AI chat or agents: the attacker goal, preconditions, a concrete test and the control, each linked to CWE and CAPEC.",
      "domain": "appsec",
      "type": "Reference",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-307",
        "CWE-204",
        "CWE-640",
        "CWE-639",
        "CWE-862",
        "CWE-915",
        "CWE-434",
        "CWE-22",
        "CWE-362",
        "CWE-841",
        "CWE-345",
        "CWE-918",
        "CWE-1236",
        "CWE-1427",
        "A01:2025",
        "A06:2025",
        "A07:2025",
        "API1:2023",
        "API5:2023",
        "API6:2023",
        "API7:2023",
        "LLM01:2026",
        "LLM03:2026",
        "CAPEC-600",
        "CAPEC-565",
        "CAPEC-575",
        "CAPEC-50",
        "CAPEC-650",
        "CAPEC-126",
        "CAPEC-26",
        "CAPEC-664",
        "CAPEC-66",
        "CAPEC-87",
        "CAPEC-62"
      ],
      "tags": [
        "business-logic",
        "threat-modeling",
        "security-testing",
        "secure-sdlc"
      ],
      "stages": [
        "design",
        "test"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "threat-pattern-library",
      "title": "Threat pattern library for threat modeling",
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/threat-pattern-library/",
      "api": "https://softwaresecurity.com/api/v1/articles/threat-pattern-library.json",
      "markdown": "https://softwaresecurity.com/downloads/threat-pattern-library.md",
      "summary": "Thirty-two recurring threat patterns grouped by identity, authorization, parsers, concurrency, integrations, data exposure, supply chain, availability and AI agents, each with where it shows up on a data-flow diagram, mitigations, a verification step and STRIDE, CWE and CAPEC links, plus a YAML catalog and a script that lists patterns per diagram element.",
      "domain": "appsec",
      "type": "Reference",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-290",
        "CWE-441",
        "CWE-639",
        "CWE-863",
        "CWE-915",
        "CWE-89",
        "CWE-436",
        "CWE-502",
        "CWE-367",
        "CWE-294",
        "CWE-918",
        "CWE-532",
        "CWE-829",
        "CWE-770",
        "CWE-1427",
        "A01:2025",
        "A06:2025",
        "CAPEC-21",
        "CAPEC-1",
        "CAPEC-66",
        "CAPEC-33",
        "CAPEC-586",
        "CAPEC-29",
        "CAPEC-664",
        "CAPEC-141",
        "CAPEC-538",
        "CAPEC-130"
      ],
      "tags": [
        "threat-modeling"
      ],
      "stages": [
        "design"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "secure-by-design-principles",
      "title": "Apply CISA Secure by Design: principles, pledge goals and evidence",
      "url": "https://softwaresecurity.com/frameworks/secure-by-design/",
      "api": "https://softwaresecurity.com/api/v1/articles/secure-by-design-principles.json",
      "markdown": "https://softwaresecurity.com/downloads/secure-by-design-principles.md",
      "summary": "What CISA's Secure by Design guidance and pledge ask of software manufacturers as of October 2026, and how to turn each of the three principles, the seven pledge goals and the Product Security Bad Practices into engineering actions, metrics and evidence.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-89",
        "CWE-79",
        "CWE-78",
        "CWE-798",
        "CWE-1392"
      ],
      "tags": [
        "memory-safety",
        "secure-defaults",
        "appsec-program"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "choosing-bsimm-samm-ssdf",
      "title": "BSIMM vs SAMM vs SSDF: what each is for and which to use",
      "url": "https://softwaresecurity.com/frameworks/bsimm-samm-ssdf/",
      "api": "https://softwaresecurity.com/api/v1/articles/choosing-bsimm-samm-ssdf.json",
      "markdown": "https://softwaresecurity.com/downloads/choosing-bsimm-samm-ssdf.md",
      "summary": "How BSIMM16, OWASP SAMM 2.2.0 and NIST SSDF 1.1 differ, what each measures and does not, a chooser by situation, and a verified SSDF-to-BSIMM16-and-SAMM crosswalk with a script that reports evidence gaps.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "appsec-program",
        "secure-sdlc"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "developer-security-training-program",
      "title": "Run a developer security training program that changes code",
      "url": "https://softwaresecurity.com/frameworks/developer-security-training/",
      "api": "https://softwaresecurity.com/api/v1/articles/developer-security-training-program.json",
      "markdown": "https://softwaresecurity.com/downloads/developer-security-training-program.md",
      "summary": "Build role-based, hands-on developer security training from this site's learning paths, labs and fix cards, meet PCI DSS 6.2.2, NIST SSDF PO.2.2 and ISO/IEC 27001 A.6.3 with real evidence, and measure the effect with repeat findings instead of completion rates.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "appsec-program",
        "secure-sdlc",
        "compliance"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "psirt-operating-model",
      "title": "Set up a PSIRT: services, intake, triage, SLAs and the CNA role",
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/psirt-operating-model/",
      "api": "https://softwaresecurity.com/api/v1/articles/psirt-operating-model.json",
      "markdown": "https://softwaresecurity.com/downloads/psirt-operating-model.md",
      "summary": "How to structure and run a product security incident response team on the FIRST PSIRT Services Framework: organizational models, intake channels, triage, response targets, a case record and SLA script, becoming a CVE Numbering Authority under the CNA rules 4.2.0, and coordinating with other vendors.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "incident-response",
        "vulnerability-management",
        "vulnerability-disclosure"
      ],
      "stages": [
        "respond"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "security-advisories-csaf-vex",
      "title": "Publish security advisories with CSAF, VEX, CVE records and OSV",
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/security-advisories-csaf-vex/",
      "api": "https://softwaresecurity.com/api/v1/articles/security-advisories-csaf-vex.json",
      "markdown": "https://softwaresecurity.com/downloads/security-advisories-csaf-vex.md",
      "summary": "What a useful security advisory contains and how to publish it in the formats tools read: a validated CSAF 2.0 VEX document, the CSAF provider files, CVE records through a CNA (CVE Record Format 5.2), and OSV records for open-source packages. Covers the status of CSAF 2.1 as of October 2026.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-306",
        "CWE-347"
      ],
      "tags": [
        "vex",
        "dependencies",
        "vulnerability-management",
        "vulnerability-disclosure"
      ],
      "stages": [
        "respond"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "product-incident-response",
      "title": "Respond to product security incidents: plan, tabletop and postmortem",
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/product-incident-response/",
      "api": "https://softwaresecurity.com/api/v1/articles/product-incident-response.json",
      "markdown": "https://softwaresecurity.com/downloads/product-incident-response.md",
      "summary": "An incident response plan for product security incidents (exploited vulnerabilities, compromised releases, leaked signing keys, malicious dependencies shipped to customers), aligned with NIST SP 800-61 Rev. 3, with reporting clocks, a two-scenario tabletop exercise template and a blameless postmortem template.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "incident-response",
        "appsec-program",
        "compliance"
      ],
      "stages": [
        "respond",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre",
        "security-leader"
      ]
    },
    {
      "key": "appsec-careers",
      "title": "Build an application security career: roles, skills, portfolio and certifications",
      "url": "https://softwaresecurity.com/frameworks/appsec-careers/",
      "api": "https://softwaresecurity.com/api/v1/articles/appsec-careers.json",
      "markdown": "https://softwaresecurity.com/downloads/appsec-careers.md",
      "summary": "The main application security role tracks (AppSec engineer, product security engineer, security champion, platform security engineer, security architect), the skills expected at each level, how to build a portfolio a hiring team can verify using this site's labs, projects and fix cards, and what common certifications do and do not show.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "appsec-program"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "soc2-for-engineering-teams",
      "title": "SOC 2 for engineering teams: CC6, CC7 and CC8 controls and the evidence auditors test",
      "url": "https://softwaresecurity.com/frameworks/soc2-for-engineering-teams/",
      "api": "https://softwaresecurity.com/api/v1/articles/soc2-for-engineering-teams.json",
      "markdown": "https://softwaresecurity.com/downloads/soc2-for-engineering-teams.md",
      "summary": "What a SOC 2 report covers, which Trust Services Criteria engineering owns (CC6 logical access, CC7 system operations, CC8 change management), the controls that meet them in a modern pipeline, and how to export a complete change population for a Type 2 period.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "access-control",
        "compliance"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "platform-sre",
        "security-leader"
      ]
    },
    {
      "key": "iso-27001-secure-development",
      "title": "ISO 27001 secure development: Annex A 8.25 to 8.33 as engineering practice and evidence",
      "url": "https://softwaresecurity.com/frameworks/iso-27001-secure-development/",
      "api": "https://softwaresecurity.com/api/v1/articles/iso-27001-secure-development.json",
      "markdown": "https://softwaresecurity.com/downloads/iso-27001-secure-development.md",
      "summary": "How ISO/IEC 27001:2022 treats secure development, what the Annex A development controls (8.4, 8.8, 8.9 and 8.25 to 8.33) look like as engineering practice, and how to keep the Statement of Applicability and its evidence honest with checks in code.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "secure-sdlc",
        "compliance"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "platform-sre",
        "security-leader"
      ]
    },
    {
      "key": "nist-csf-2-for-product-teams",
      "title": "NIST CSF 2.0 for product teams: the outcomes you own and the evidence for them",
      "url": "https://softwaresecurity.com/frameworks/nist-csf-2-for-product-teams/",
      "api": "https://softwaresecurity.com/api/v1/articles/nist-csf-2-for-product-teams.json",
      "markdown": "https://softwaresecurity.com/downloads/nist-csf-2-for-product-teams.md",
      "summary": "Find the CSF 2.0 outcomes a product team actually owns, including GOVERN and supply-chain risk management (GV.SC), write a current and target profile for one product, and check it against NIST's own catalog in CI.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "supply-chain-attacks",
        "compliance"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "gdpr-privacy-by-design-engineering",
      "title": "GDPR privacy by design for engineers: Articles 25, 32 and 35 in code",
      "url": "https://softwaresecurity.com/frameworks/gdpr-privacy-by-design-engineering/",
      "api": "https://softwaresecurity.com/api/v1/articles/gdpr-privacy-by-design-engineering.json",
      "markdown": "https://softwaresecurity.com/downloads/gdpr-privacy-by-design-engineering.md",
      "summary": "Turn GDPR data protection by design and by default, security of processing and DPIA triggers into engineering work: a personal-data inventory checked in CI, defaults that collect and share less, a DPIA screen at design time, and access and erasure requests that reach every store.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "V14"
      ],
      "tags": [
        "privacy",
        "regulation"
      ],
      "stages": [
        "design",
        "govern"
      ],
      "roles": [
        "platform-sre",
        "security-leader"
      ]
    },
    {
      "key": "nis2-dora-for-software-suppliers",
      "title": "NIS2 and DORA for software suppliers: what reaches you and the evidence to keep",
      "url": "https://softwaresecurity.com/frameworks/nis2-dora-for-software-suppliers/",
      "api": "https://softwaresecurity.com/api/v1/articles/nis2-dora-for-software-suppliers.json",
      "markdown": "https://softwaresecurity.com/downloads/nis2-dora-for-software-suppliers.md",
      "summary": "Work out whether NIS2 applies to your software company directly or only through customers, what Article 21 risk-management measures and DORA's ICT third-party rules ask of suppliers, and how to keep one assurance pack and register data sheet for both.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "supply-chain-attacks",
        "regulation",
        "supplier-risk"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "security-leader"
      ]
    },
    {
      "key": "uk-software-security-code-of-practice",
      "title": "UK Software Security Code of Practice: the 14 principles as engineering practice",
      "url": "https://softwaresecurity.com/frameworks/uk-software-security-code-of-practice/",
      "api": "https://softwaresecurity.com/api/v1/articles/uk-software-security-code-of-practice.json",
      "markdown": "https://softwaresecurity.com/downloads/uk-software-security-code-of-practice.md",
      "summary": "What the UK government's voluntary Software Security Code of Practice (May 2025) asks of software vendors, each of its 14 principles mapped to engineering practice, NIST SSDF and the EU Cyber Resilience Act, and a CI check for the support-period principles.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [],
      "tags": [
        "secure-defaults",
        "vulnerability-disclosure",
        "appsec-program",
        "regulation"
      ],
      "stages": [
        "respond",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "regulated-product-security-lifecycle",
      "title": "Regulated product security lifecycles: IEC 62443-4-1, FDA 524B, ISO/SAE 21434 and UN R155/R156",
      "url": "https://softwaresecurity.com/frameworks/regulated-product-security-lifecycle/",
      "api": "https://softwaresecurity.com/api/v1/articles/regulated-product-security-lifecycle.json",
      "markdown": "https://softwaresecurity.com/downloads/regulated-product-security-lifecycle.md",
      "summary": "What the secure development lifecycles for industrial, medical and automotive products require, the practices they share (threat modeling, SBOM, vulnerability handling and updates), and how to build that evidence once and package it for each instrument.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "embedded",
        "secure-sdlc",
        "compliance",
        "regulation"
      ],
      "stages": [
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "compliance-evidence-reuse",
      "title": "Compliance evidence reuse: one evidence set for SSDF, PCI DSS, ISO 27001, SOC 2 and the CRA",
      "url": "https://softwaresecurity.com/frameworks/compliance-evidence-reuse/",
      "api": "https://softwaresecurity.com/api/v1/articles/compliance-evidence-reuse.json",
      "markdown": "https://softwaresecurity.com/downloads/compliance-evidence-reuse.md",
      "summary": "Keep one set of release-bound engineering evidence (SBOM, provenance, review records, scan results, ASVS results and vulnerability handling) and map it to several frameworks: a worked crosswalk, an evidence index checked in CI with a CSV export, and an OSCAL component definition.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "sbom",
        "build-integrity",
        "compliance"
      ],
      "stages": [
        "release",
        "govern"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre",
        "security-leader"
      ]
    },
    {
      "key": "federal-software-attestation",
      "title": "Answer a US federal secure software attestation request in 2026: the CISA form, its SSDF mapping and the evidence behind each statement",
      "url": "https://softwaresecurity.com/frameworks/secure-software-attestation-form/",
      "api": "https://softwaresecurity.com/api/v1/articles/federal-software-attestation.json",
      "markdown": "https://softwaresecurity.com/downloads/federal-software-attestation.md",
      "summary": "Know what is and isn't required after OMB M-26-05, then answer an agency's request statement by statement, with the SSDF tasks the form maps and release evidence for each claim.",
      "domain": "governance",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "build-integrity",
        "secure-sdlc",
        "compliance",
        "supplier-risk"
      ],
      "stages": [
        "release",
        "govern"
      ],
      "roles": [
        "security-leader"
      ]
    },
    {
      "key": "secrets-in-kubernetes-and-runtime",
      "title": "Secrets at runtime: Vault, Kubernetes Secrets, CSI driver, External Secrets and SOPS",
      "url": "https://softwaresecurity.com/domains/identity-crypto/secrets/secrets-in-kubernetes-and-runtime/",
      "api": "https://softwaresecurity.com/api/v1/articles/secrets-in-kubernetes-and-runtime.json",
      "markdown": "https://softwaresecurity.com/downloads/secrets-in-kubernetes-and-runtime.md",
      "summary": "How a running workload should get its credentials: encrypt Kubernetes Secrets with a KMS v2 provider and lock down RBAC, mount from an external store with the Secrets Store CSI Driver, sync with External Secrets Operator, issue dynamic credentials with Vault and its Agent Injector, keep Git copies encrypted with SOPS, and make rotation reach the process.",
      "domain": "identity-crypto",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-798",
        "CWE-522",
        "CWE-312",
        "CWE-732",
        "A02:2025",
        "A04:2025",
        "V13.3.1",
        "V13.3.2",
        "V13.3.4",
        "V13.2.1",
        "CAPEC-37",
        "CAPEC-560"
      ],
      "tags": [
        "secrets",
        "kubernetes",
        "ai-agents"
      ],
      "stages": [
        "design",
        "build",
        "operate"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-lastpass-2022",
      "title": "Case study: the LastPass breach (2022)",
      "url": "https://softwaresecurity.com/domains/identity-crypto/secrets/case-study-lastpass-2022/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-lastpass-2022.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-lastpass-2022.md",
      "summary": "How an attacker went from a compromised developer laptop to a DevOps engineer's home computer, the keys to LastPass's cloud backups and a copy of customer vaults; why each vault's safety then rested on its master password and PBKDF2 iteration count; and what it teaches about backup keys, privileged endpoints, KDF upgrades and unencrypted metadata.",
      "domain": "identity-crypto",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-522",
        "CWE-916",
        "CWE-311",
        "CWE-1104",
        "A04:2025",
        "A07:2025",
        "A02:2025",
        "V13.3.1",
        "V13.3.2",
        "V11.4.2",
        "V14.2.4",
        "CAPEC-568",
        "CAPEC-55"
      ],
      "tags": [
        "access-control",
        "password-storage",
        "secrets",
        "encryption",
        "incident-response"
      ],
      "stages": [
        "design",
        "build",
        "operate",
        "respond"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-okta-har-2023",
      "title": "Case study: the Okta support-system breach and session tokens in HAR files (2023)",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/case-study-okta-har-2023/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-okta-har-2023.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-okta-har-2023.md",
      "summary": "How a service account password saved to a personal browser profile let an attacker download customers' HAR files from Okta's support system, replay the session tokens inside them against five customers, and stay unseen for two weeks; and why HAR files are credentials, admin sessions need binding, and every exposed credential must be rotated.",
      "domain": "identity-crypto",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-522",
        "CWE-532",
        "CWE-294",
        "CWE-613",
        "CWE-778",
        "A07:2025",
        "A09:2025",
        "A02:2025",
        "V7.4.1",
        "V7.4.2",
        "V7.5.1",
        "V16.2.1",
        "CAPEC-593",
        "CAPEC-60",
        "CAPEC-560"
      ],
      "tags": [
        "account-takeover",
        "authentication",
        "workload-identity",
        "incident-response"
      ],
      "stages": [
        "build",
        "respond"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-certificate-expiry",
      "title": "Case study: certificate expiry outages at Ericsson (2018) and Microsoft Teams (2020), and Equifax's blind spot",
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/case-study-certificate-expiry/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-certificate-expiry.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-certificate-expiry.md",
      "summary": "How an expired certificate inside Ericsson's core-network software cut mobile data for millions in about 11 countries, how an expired authentication certificate took Microsoft Teams offline, how an expired inspection certificate left Equifax blind for 19 months, through its 2017 breach, and the inventory, automation and testing that prevent each.",
      "domain": "identity-crypto",
      "type": "Case study",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-298",
        "CWE-324",
        "CWE-295",
        "CWE-778",
        "A02:2025",
        "A04:2025",
        "A09:2025",
        "V12.1.1",
        "V12.2.2",
        "V13.3.4"
      ],
      "tags": [
        "pki",
        "tls",
        "logging-detection",
        "incident-response"
      ],
      "stages": [
        "operate",
        "respond"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "file-inclusion",
      "title": "Prevent file inclusion: LFI, RFI, dynamic imports and template names",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/file-inclusion/",
      "api": "https://softwaresecurity.com/api/v1/articles/file-inclusion.json",
      "markdown": "https://softwaresecurity.com/downloads/file-inclusion.md",
      "summary": "Stop request data from choosing which file, module or template your application loads: local and remote file inclusion in PHP, dynamic require() and import() in Node.js, importlib and template names in Python, Thymeleaf view names in Spring, render in Rails, and the allowlist fix that works in all of them.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-98",
        "CWE-73",
        "CWE-829",
        "CWE-22",
        "CWE-94",
        "A05:2025",
        "A01:2025",
        "V5.3.1",
        "V5.3.2",
        "V1.3.2",
        "V1.3.7",
        "CAPEC-252",
        "CAPEC-193",
        "WSTG-INPV-11",
        "WSTG-ATHZ-01"
      ],
      "tags": [
        "injection",
        "file-handling"
      ],
      "stages": [
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "insecure-temp-files",
      "title": "Create temporary files safely: mkstemp, O_EXCL and private directories",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/insecure-temp-files/",
      "api": "https://softwaresecurity.com/api/v1/articles/insecure-temp-files.json",
      "markdown": "https://softwaresecurity.com/downloads/insecure-temp-files.md",
      "summary": "Stop symlink, hardlink and pre-created-file attacks on the temporary files your code writes in shared directories such as /tmp: create each file atomically with O_EXCL and owner-only permissions through mkstemp or its equivalent in shell, Python, Java, Node.js, Go, .NET and Rust, keep related files in a private directory, and treat the Linux protected_* sysctls and systemd PrivateTmp as a backstop.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-377",
        "CWE-379",
        "CWE-59",
        "CWE-367",
        "A01:2025",
        "V15.4",
        "V15.4.2",
        "V5.3.2",
        "CAPEC-27",
        "CAPEC-29"
      ],
      "tags": [
        "file-handling",
        "business-logic"
      ],
      "stages": [
        "design",
        "build",
        "test"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "third-party-api-consumption",
      "title": "Consume third-party APIs safely (OWASP API10:2023)",
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/third-party-api-consumption/",
      "api": "https://softwaresecurity.com/api/v1/articles/third-party-api-consumption.json",
      "markdown": "https://softwaresecurity.com/downloads/third-party-api-consumption.md",
      "summary": "Treat every upstream and third-party API response as untrusted input: validate it against a schema, set connect and read timeouts, cap the response size, refuse to follow redirects blindly, keep TLS verification on, and scope the credentials you hold for each provider.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-20",
        "CWE-295",
        "CWE-770",
        "CWE-601",
        "CWE-522",
        "A03:2025",
        "A05:2025",
        "API10:2023",
        "API7:2023",
        "V1.3.6",
        "V13.1.1",
        "V5.4.1",
        "CAPEC-141",
        "CAPEC-275"
      ],
      "tags": [
        "ssrf",
        "input-validation",
        "denial-of-service",
        "tls",
        "api-security",
        "threat-modeling"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "secure-design-patterns",
      "title": "Secure design patterns: a catalogue for insecure-design (A06)",
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/secure-design-patterns/",
      "api": "https://softwaresecurity.com/api/v1/articles/secure-design-patterns.json",
      "markdown": "https://softwaresecurity.com/downloads/secure-design-patterns.md",
      "summary": "A catalogue of reusable secure-design patterns, grouped by concern, each with when to use it, a short example and the failure it prevents: choke-point authorization, capability tokens, parse-don't-validate, safe-by-default APIs, tenant scoping, fail-closed, idempotency, and more.",
      "domain": "appsec",
      "type": "Reference",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-657",
        "CWE-862",
        "CWE-863",
        "CWE-636",
        "CWE-1188",
        "A06:2025",
        "A01:2025",
        "V1.2",
        "V1.3"
      ],
      "tags": [
        "access-control",
        "multi-tenancy",
        "input-validation",
        "threat-modeling",
        "secure-defaults"
      ],
      "stages": [
        "design"
      ],
      "roles": [
        "appsec-engineer"
      ]
    },
    {
      "key": "threat-model-mobile-banking",
      "title": "Worked threat model: a mobile banking app",
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/mobile-banking-threat-model/",
      "api": "https://softwaresecurity.com/api/v1/articles/threat-model-mobile-banking.json",
      "markdown": "https://softwaresecurity.com/downloads/threat-model-mobile-banking.md",
      "summary": "A complete worked threat model for a mobile banking-style app: the data-flow diagram and its elements, STRIDE threats on the client, the transport and the backend, and the mitigations mapped to OWASP MASVS v2 controls and current Android and iOS platform APIs.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-922",
        "CWE-295",
        "CWE-319",
        "CWE-308",
        "CWE-926",
        "CWE-862",
        "API1:2023",
        "API2:2023",
        "API6:2023",
        "MASVS-STORAGE-1",
        "MASVS-CRYPTO-1",
        "MASVS-AUTH-2",
        "MASVS-AUTH-3",
        "MASVS-NETWORK-1",
        "MASVS-NETWORK-2",
        "MASVS-PLATFORM-1",
        "MASVS-PLATFORM-3",
        "MASVS-RESILIENCE-1"
      ],
      "tags": [
        "tls",
        "mobile",
        "threat-modeling"
      ],
      "stages": [
        "design"
      ],
      "roles": [
        "appsec-engineer"
      ]
    },
    {
      "key": "threat-model-llm-agent",
      "title": "Worked threat model: an LLM agent with tools",
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/llm-agent-threat-model/",
      "api": "https://softwaresecurity.com/api/v1/articles/threat-model-llm-agent.json",
      "markdown": "https://softwaresecurity.com/downloads/threat-model-llm-agent.md",
      "summary": "A complete worked threat model for an LLM agent with tools: the data-flow diagram, the threats from prompt injection, excessive agency, data exfiltration, confused-deputy and memory poisoning, and the mitigations, mapped to the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications 2026.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-1427",
        "CWE-862",
        "CWE-918",
        "CWE-79",
        "LLM01:2026",
        "LLM02:2026",
        "LLM03:2026",
        "LLM06:2026",
        "LLM09:2026",
        "LLM10:2026",
        "ASI01:2026",
        "ASI02:2026",
        "ASI03:2026",
        "ASI04:2026",
        "ASI06:2026"
      ],
      "tags": [
        "llm-security",
        "prompt-injection",
        "ai-agents",
        "threat-modeling"
      ],
      "stages": [
        "design"
      ],
      "roles": [
        "appsec-engineer"
      ]
    },
    {
      "key": "llm-misinformation",
      "title": "Contain LLM misinformation (OWASP LLM07:2026)",
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/llm-misinformation/",
      "api": "https://softwaresecurity.com/api/v1/articles/llm-misinformation.json",
      "markdown": "https://softwaresecurity.com/downloads/llm-misinformation.md",
      "summary": "Stop plausible but wrong model output from driving decisions and actions: ground answers in sources, verify every citation, separate generation from execution with a claim-check-act pattern, gate consequential actions on a human, and evaluate factuality on your own domain.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-1426",
        "LLM07:2026",
        "LLM10:2026",
        "LLM04:2026",
        "ASI09:2026",
        "ASI06:2026"
      ],
      "tags": [
        "llm-security",
        "ai-evaluation"
      ],
      "stages": [
        "design",
        "build",
        "test",
        "govern"
      ],
      "roles": [
        "appsec-engineer"
      ]
    },
    {
      "key": "calling-llm-apis-safely",
      "title": "Call a hosted LLM API safely",
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/calling-llm-apis-safely/",
      "api": "https://softwaresecurity.com/api/v1/articles/calling-llm-apis-safely.json",
      "markdown": "https://softwaresecurity.com/downloads/calling-llm-apis-safely.md",
      "summary": "A code-first checklist for wiring up an OpenAI or Anthropic API call from a backend: keep keys server-side, redact PII before prompts and logs, choose provider retention settings deliberately, validate structured output and still treat it as untrusted, and set timeouts, retries and per-user cost caps.",
      "domain": "ai-emerging",
      "type": "Recipe",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-798",
        "CWE-522",
        "CWE-532",
        "CWE-359",
        "CWE-770",
        "A07:2025",
        "A09:2025",
        "LLM02:2026",
        "LLM06:2026",
        "LLM10:2026",
        "V13.1.1",
        "V1.3.6"
      ],
      "tags": [
        "denial-of-service",
        "secrets",
        "privacy",
        "llm-security"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "smart-contract-defi-attacks",
      "title": "DeFi attack patterns: oracles, flash loans, proxies and signatures",
      "url": "https://softwaresecurity.com/domains/appsec/smart-contracts/defi-attack-patterns/",
      "api": "https://softwaresecurity.com/api/v1/articles/smart-contract-defi-attacks.json",
      "markdown": "https://softwaresecurity.com/downloads/smart-contract-defi-attacks.md",
      "summary": "The four smart-contract attack classes beyond reentrancy: price-oracle manipulation, flash-loan amplification, upgradeable-proxy storage collisions and uninitialized implementations, and signature replay, each with vulnerable and fixed Solidity, Foundry tests and verified incidents.",
      "domain": "appsec",
      "type": "Guide",
      "updated": "2026-10-10",
      "identifiers": [
        "CWE-347",
        "CWE-294",
        "CWE-665",
        "CWE-682"
      ],
      "tags": [
        "business-logic",
        "security-testing"
      ],
      "stages": [
        "design",
        "build",
        "test"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "agent-code-sandboxing",
      "title": "Sandbox model-generated code and computer-use agents",
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/agent-code-sandboxing/",
      "api": "https://softwaresecurity.com/api/v1/articles/agent-code-sandboxing.json",
      "markdown": "https://softwaresecurity.com/downloads/agent-code-sandboxing.md",
      "summary": "Run the code an agent writes, and agents that drive a browser or desktop, inside a boundary built for hostile code: a disposable runtime with no secrets and no default network, hard resource limits, and a person in front of every side effect.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-653",
        "CWE-94",
        "CWE-250",
        "CWE-770",
        "LLM10:2026",
        "LLM03:2026",
        "ASI05:2026",
        "ASI01:2026",
        "ASI09:2026",
        "V15.2.5",
        "V15.2.2",
        "V13.2.4"
      ],
      "tags": [
        "kubernetes",
        "ai-agents"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "hidden-context-exposure",
      "title": "Keep secrets and controls out of hidden context (OWASP LLM08:2026)",
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/hidden-context-exposure/",
      "api": "https://softwaresecurity.com/api/v1/articles/hidden-context-exposure.json",
      "markdown": "https://softwaresecurity.com/downloads/hidden-context-exposure.md",
      "summary": "OWASP LLM08:2026 Hidden Context Exposure, which replaced System Prompt Leakage: why system prompts, tool schemas and retrieved policy text get extracted, what must never be in them, and how to enforce rules where a leak changes nothing.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-497",
        "CWE-656",
        "CWE-798",
        "LLM08:2026",
        "LLM02:2026",
        "LLM01:2026",
        "V13.3.1",
        "V8.3.1"
      ],
      "tags": [
        "access-control",
        "secrets",
        "llm-security",
        "prompt-injection",
        "ai-agents"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "agent-memory-poisoning",
      "title": "Defend agent memory and context against poisoning (OWASP ASI06)",
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/agent-memory-poisoning/",
      "api": "https://softwaresecurity.com/api/v1/articles/agent-memory-poisoning.json",
      "markdown": "https://softwaresecurity.com/downloads/agent-memory-poisoning.md",
      "summary": "OWASP ASI06 Memory & Context Poisoning: how an instruction or false fact saved once in agent memory, conversation summaries or a retrieval store steers later sessions, users and agents, and the write, scope, provenance, expiry and recovery controls that contain it.",
      "domain": "ai-emerging",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-501",
        "CWE-349",
        "CWE-1427",
        "LLM01:2026",
        "LLM09:2026",
        "LLM05:2026",
        "ASI06:2026",
        "ASI01:2026",
        "ASI08:2026",
        "V8.2.2",
        "V14.2.7"
      ],
      "tags": [
        "llm-security",
        "prompt-injection",
        "ai-agents",
        "ml-security"
      ],
      "stages": [
        "design",
        "build"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "case-study-air-canada-chatbot",
      "title": "Case study: Moffatt v. Air Canada, a chatbot that misstated the refund policy (2022-2024)",
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/case-study-air-canada-chatbot/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-air-canada-chatbot.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-air-canada-chatbot.md",
      "summary": "How an airline's website chatbot told a grieving customer they could claim a bereavement fare after travel, what the British Columbia Civil Resolution Tribunal decided in February 2024, and the grounding, testing and correction practices that keep an automated answer consistent with the policy it describes.",
      "domain": "ai-emerging",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "LLM07:2026",
        "ASI09:2026"
      ],
      "tags": [
        "incident-response",
        "llm-security"
      ],
      "stages": [
        "design",
        "build",
        "respond"
      ],
      "roles": [
        "developer"
      ]
    },
    {
      "key": "case-study-nx-s1ngularity",
      "title": "Case study: the Nx s1ngularity compromise and its AI-assisted payload (2025)",
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/case-study-nx-s1ngularity/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-nx-s1ngularity.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-nx-s1ngularity.md",
      "summary": "How a pull-request-title injection in a GitHub Actions workflow on an outdated branch gave an attacker the Nx npm token in August 2025, how the malicious versions tried to turn developers' own AI command-line tools into file-search agents, and the workflow, publishing and agent controls that stop the same chain.",
      "domain": "ai-emerging",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-78",
        "CWE-506",
        "CWE-829",
        "A03:2025",
        "A08:2025",
        "LLM03:2026",
        "ASI04:2026",
        "ASI05:2026"
      ],
      "tags": [
        "secrets",
        "dependencies",
        "supply-chain-attacks",
        "ci-cd",
        "signing",
        "ai-agents",
        "ai-assisted-development"
      ],
      "stages": [
        "design",
        "build",
        "release",
        "respond"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-amazon-q-extension",
      "title": "Case study: the Amazon Q Developer extension compromise (2025)",
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/case-study-amazon-q-extension/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-amazon-q-extension.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-amazon-q-extension.md",
      "summary": "How an over-scoped GitHub token, extracted from an AWS CodeBuild pull request build, let a threat actor commit code to the Amazon Q Developer extension for VS Code that shipped in version 1.84.0 in July 2025, why the injected code aimed at the Q Developer CLI failed, and the CI and AI-agent controls the incident argues for.",
      "domain": "ai-emerging",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-506",
        "CWE-522",
        "A08:2025",
        "A03:2025",
        "LLM03:2026",
        "ASI04:2026",
        "ASI05:2026"
      ],
      "tags": [
        "secrets",
        "supply-chain-attacks",
        "ci-cd",
        "ai-agents",
        "ai-assisted-development",
        "code-review"
      ],
      "stages": [
        "design",
        "build",
        "test",
        "release",
        "respond"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-storm-0558",
      "title": "Case study: Storm-0558 and the forged Microsoft tokens (2023)",
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/case-study-storm-0558/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-storm-0558.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-storm-0558.md",
      "summary": "How a stolen 2016 consumer signing key and a token validation gap let Storm-0558 read enterprise Exchange Online mail in 2023, and what the review board found about rotation, logging and culture.",
      "domain": "identity-crypto",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-347",
        "CWE-324",
        "CWE-778",
        "A07:2025",
        "A04:2025",
        "A09:2025",
        "V9.1.3",
        "V11.1.1",
        "V13.3.4",
        "V16.3.2",
        "CAPEC-196"
      ],
      "tags": [
        "jwt",
        "key-management",
        "logging-detection",
        "incident-response",
        "appsec-program"
      ],
      "stages": [
        "build",
        "respond",
        "govern"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-ingress-nginx",
      "title": "Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025)",
      "url": "https://softwaresecurity.com/domains/runtime/containers/case-study-ingress-nginx/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-ingress-nginx.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-ingress-nginx.md",
      "summary": "How an admission webhook open to the whole Pod network made ingress-nginx's configuration-injection bugs a 9.8 cluster-takeover risk in 2025, and what its 2026 retirement means.",
      "domain": "runtime",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-653",
        "CWE-306",
        "CWE-94",
        "A02:2025",
        "A05:2025"
      ],
      "tags": [
        "injection",
        "secrets",
        "kubernetes",
        "vulnerability-management"
      ],
      "stages": [
        "build",
        "operate",
        "respond"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-circleci-2023",
      "title": "Case study: the CircleCI security incident (January 2023)",
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/case-study-circleci-2023/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-circleci-2023.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-circleci-2023.md",
      "summary": "How a session stolen from one engineer's laptop reached CircleCI's production systems and customers' stored secrets in 2023, and what platform operators and CI users should change.",
      "domain": "runtime",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-294",
        "CWE-522",
        "CWE-798",
        "A07:2025",
        "A04:2025",
        "V13.2.1",
        "V13.3.1"
      ],
      "tags": [
        "account-takeover",
        "authentication",
        "oauth-oidc",
        "secrets",
        "ci-cd",
        "cloud",
        "incident-response"
      ],
      "stages": [
        "release",
        "operate",
        "respond"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "case-study-microsoft-sas-token",
      "title": "Case study: Microsoft AI researchers' over-permissive SAS token (2023)",
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/case-study-microsoft-sas-token/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-microsoft-sas-token.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-microsoft-sas-token.md",
      "summary": "How an over-permissive Azure Storage SAS token in a public repository for AI models exposed internal Microsoft data in 2023, and how to scope, scan for and revoke signed URLs.",
      "domain": "runtime",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-732",
        "CWE-798",
        "A02:2025",
        "A01:2025",
        "V13.3.2",
        "V13.3.4"
      ],
      "tags": [
        "access-control",
        "secrets",
        "cloud",
        "incident-response",
        "ml-security"
      ],
      "stages": [
        "operate",
        "respond"
      ],
      "roles": [
        "platform-sre"
      ]
    },
    {
      "key": "case-study-first-american",
      "title": "Case study: First American's EaglePro document exposure (2019)",
      "url": "https://softwaresecurity.com/domains/appsec/authorization/case-study-first-american/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-first-american.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-first-american.md",
      "summary": "How sequential IDs in unauthenticated links exposed First American's title documents in 2019, after its own penetration test found the flaw and a clerical error let it go unfixed.",
      "domain": "appsec",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-639",
        "CWE-306",
        "A01:2025",
        "V8.2.2",
        "V8.3.1"
      ],
      "tags": [
        "access-control",
        "api-security",
        "incident-response",
        "security-testing",
        "vulnerability-management",
        "appsec-program"
      ],
      "stages": [
        "build",
        "test",
        "respond",
        "govern"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "security-leader"
      ]
    },
    {
      "key": "case-study-citrix-bleed",
      "title": "Case study: Citrix Bleed (CVE-2023-4966)",
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/case-study-citrix-bleed/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-citrix-bleed.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-citrix-bleed.md",
      "summary": "How a NetScaler memory over-read leaked session cookies that bypassed passwords and MFA in 2023, why patching did not end hijacked sessions, and how the pattern returned in 2025.",
      "domain": "appsec",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-119",
        "CWE-613",
        "A07:2025",
        "V7.4.5",
        "CAPEC-593"
      ],
      "tags": [
        "memory-safety",
        "account-takeover",
        "authentication",
        "vulnerability-management"
      ],
      "stages": [
        "respond"
      ],
      "roles": [
        "developer",
        "appsec-engineer"
      ]
    },
    {
      "key": "case-study-spring4shell",
      "title": "Case study: Spring4Shell (CVE-2022-22965)",
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/case-study-spring4shell/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-spring4shell.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-spring4shell.md",
      "summary": "How Spring's data binding let request parameters reach the class loader on JDK 9 and later in 2022, why the denylist workaround leaked, and what it teaches about framework-level mass assignment.",
      "domain": "appsec",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-94",
        "CWE-915",
        "A05:2025",
        "A03:2025",
        "CAPEC-242"
      ],
      "tags": [
        "access-control",
        "dependencies",
        "vulnerability-management",
        "java"
      ],
      "stages": [
        "build",
        "respond"
      ],
      "roles": [
        "developer",
        "appsec-engineer",
        "platform-sre"
      ]
    },
    {
      "key": "case-study-crowdstrike-channel-file-291",
      "title": "Case study: CrowdStrike Channel File 291 (July 2024)",
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/case-study-crowdstrike-channel-file-291/",
      "api": "https://softwaresecurity.com/api/v1/articles/case-study-crowdstrike-channel-file-291.json",
      "markdown": "https://softwaresecurity.com/downloads/case-study-crowdstrike-channel-file-291.md",
      "summary": "How a CrowdStrike content update crashed Windows hosts in July 2024: a field-count mismatch hidden by wildcard tests, a missing bounds check, and no staged rollout.",
      "domain": "appsec",
      "type": "Case study",
      "updated": "2026-10-11",
      "identifiers": [
        "CWE-125",
        "CWE-129",
        "A10:2025"
      ],
      "tags": [
        "memory-safety",
        "signing",
        "incident-response",
        "desktop-native"
      ],
      "stages": [
        "build",
        "release",
        "respond"
      ],
      "roles": [
        "developer",
        "platform-sre"
      ]
    },
    {
      "key": "staged-rollout-rollback",
      "title": "Staged rollout and rollback for security-critical updates",
      "url": "https://softwaresecurity.com/domains/supply-chain/releases/staged-rollout-rollback/",
      "api": "https://softwaresecurity.com/api/v1/articles/staged-rollout-rollback.json",
      "markdown": "https://softwaresecurity.com/downloads/staged-rollout-rollback.md",
      "summary": "Ship security fixes, detection content and configuration quickly without taking the fleet down: rollout rings and canaries, content validation, kill switches and rollback that works on a broken host.",
      "domain": "supply-chain",
      "type": "Guide",
      "updated": "2026-10-11",
      "identifiers": [],
      "tags": [
        "signing",
        "embedded",
        "secure-sdlc"
      ],
      "stages": [
        "release"
      ],
      "roles": [
        "appsec-engineer",
        "platform-sre"
      ]
    }
  ]
}