{
  "name": "Software Security crosswalk",
  "description": "Every guide, fix card and lab on softwaresecurity.com with the CWE, OWASP Top 10:2025, OWASP API Security Top 10 2023, OWASP ASVS 5.0.0, OWASP LLM and Agentic Top 10 2026, OWASP Kubernetes Top 10 2025, OWASP Top 10 CI/CD Security Risks, OWASP MASVS 2.1.0, NIST SSDF 1.1 and CAPEC identifiers it maps to.",
  "version": "2026-10-09",
  "url": "https://softwaresecurity.com/crosswalk/",
  "license": "The mappings are licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). The identifiers belong to their publishers: CWE and CAPEC are MITRE trademarks.",
  "frameworks": [
    {
      "key": "cwe",
      "name": "CWE",
      "edition": "4.20",
      "url": "https://cwe.mitre.org/"
    },
    {
      "key": "owasp",
      "name": "OWASP Top 10",
      "edition": "2025",
      "url": "https://top10.owasp.org/2025/"
    },
    {
      "key": "api",
      "name": "OWASP API Security Top 10",
      "edition": "2023",
      "url": "https://owasp.org/API-Security/editions/2023/en/0x11-t10/"
    },
    {
      "key": "asvs",
      "name": "OWASP ASVS",
      "edition": "5.0.0",
      "url": "https://github.com/OWASP/ASVS/releases/tag/v5.0.0_release"
    },
    {
      "key": "llm",
      "name": "OWASP Top 10 for LLM Applications",
      "edition": "2026",
      "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/"
    },
    {
      "key": "agentic",
      "name": "OWASP Top 10 for Agentic Applications",
      "edition": "2026",
      "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/"
    },
    {
      "key": "ssdf",
      "name": "NIST SSDF",
      "edition": "1.1",
      "url": "https://csrc.nist.gov/pubs/sp/800/218/final"
    },
    {
      "key": "capec",
      "name": "CAPEC",
      "edition": "",
      "url": "https://capec.mitre.org/"
    },
    {
      "key": "masvs",
      "name": "OWASP MASVS",
      "edition": "2.1.0",
      "url": "https://mas.owasp.org/MASVS/"
    },
    {
      "key": "k8s",
      "name": "OWASP Kubernetes Top 10",
      "edition": "2025",
      "url": "https://kubernetes-top10.owasp.org/"
    },
    {
      "key": "cicd",
      "name": "OWASP Top 10 CI/CD Security Risks",
      "edition": "",
      "url": "https://owasp.org/www-project-top-10-ci-cd-security-risks/"
    }
  ],
  "relations": {
    "primary": "The identifier is the main subject of the item (curated mapping on the identifier page).",
    "related": "The item covers the identifier in a dedicated section or worked example (curated mapping on the identifier page).",
    "cites": "The item lists the identifier in its own metadata.",
    "via-cwe": "Derived: OWASP’s official Top 10:2025 mapping lists one of the CWEs the item maps to (the CWE is given in \"via\").",
    "mentions": "Derived: the guide names the SSDF 1.1 practice or task in its text."
  },
  "rows": [
    {
      "type": "Guide",
      "key": "sql-injection-python",
      "title": "Fix SQL injection in Python sqlite3",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-89",
            "relation": "primary"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "primary"
          },
          {
            "id": "V1.2.4",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-66",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/sql-injection-python-sqlite3/"
    },
    {
      "type": "Guide",
      "key": "object-authorization",
      "title": "Enforce authorization for every object action",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-639",
            "relation": "primary"
          },
          {
            "id": "CWE-862",
            "relation": "primary"
          },
          {
            "id": "CWE-284",
            "relation": "related"
          },
          {
            "id": "CWE-863",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "primary"
          }
        ],
        "api": [
          {
            "id": "API1:2023",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V8",
            "relation": "primary"
          },
          {
            "id": "V8.2.2",
            "relation": "cites"
          },
          {
            "id": "V8.3.1",
            "relation": "cites"
          },
          {
            "id": "V8.4.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/authorization/object-level-authorization/"
    },
    {
      "type": "Guide",
      "key": "secure-uploads",
      "title": "Design a safer file-upload pipeline",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-434",
            "relation": "primary"
          },
          {
            "id": "CWE-770",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "primary"
          }
        ],
        "api": [
          {
            "id": "API4:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V5",
            "relation": "primary"
          },
          {
            "id": "V5.2.1",
            "relation": "cites"
          },
          {
            "id": "V5.2.2",
            "relation": "cites"
          },
          {
            "id": "V5.2.6",
            "relation": "cites"
          },
          {
            "id": "V5.3.2",
            "relation": "cites"
          },
          {
            "id": "V5.4.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/secure-file-uploads/"
    },
    {
      "type": "Guide",
      "key": "webhook-verification",
      "title": "Verify webhook deliveries before acting",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-347",
            "relation": "primary"
          },
          {
            "id": "CWE-306",
            "relation": "related"
          },
          {
            "id": "CWE-208",
            "relation": "cites"
          },
          {
            "id": "CWE-294",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "related"
          },
          {
            "id": "A08:2025",
            "relation": "related"
          },
          {
            "id": "A04:2025",
            "relation": "via-cwe",
            "via": "CWE-347"
          }
        ],
        "api": [
          {
            "id": "API10:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V2",
            "relation": "related"
          },
          {
            "id": "V4",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/verify-webhook-deliveries/"
    },
    {
      "type": "Guide",
      "key": "multitenant-threat-model",
      "title": "Review tenant boundaries before implementation",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-639",
            "relation": "related"
          },
          {
            "id": "CWE-863",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API1:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V8",
            "relation": "related"
          },
          {
            "id": "V8.4.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/multitenant-design-review/"
    },
    {
      "type": "Guide",
      "key": "dependency-response",
      "title": "Respond to an exploited or malicious dependency",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-506",
            "relation": "cites"
          },
          {
            "id": "CWE-1104",
            "relation": "cites"
          },
          {
            "id": "CWE-1395",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "via-cwe",
            "via": "CWE-506"
          }
        ],
        "asvs": [
          {
            "id": "V15",
            "relation": "primary"
          },
          {
            "id": "V15.1.1",
            "relation": "cites"
          },
          {
            "id": "V15.1.2",
            "relation": "cites"
          },
          {
            "id": "V15.2.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/dependency-vulnerability-response/"
    },
    {
      "type": "Guide",
      "key": "minimal-appsec-program",
      "title": "Start a minimal AppSec program with owners, triggers and metrics",
      "domain": "governance",
      "mappings": {},
      "url": "https://softwaresecurity.com/frameworks/appsec-program/"
    },
    {
      "type": "Guide",
      "key": "ci-build-integrity",
      "title": "Protect the path from pull request to release",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-829",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "primary"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-444",
            "relation": "cites"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-1",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-4",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-9",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/build-integrity/"
    },
    {
      "type": "Guide",
      "key": "iac-review",
      "title": "Review infrastructure changes as access changes",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-312",
            "relation": "cites"
          },
          {
            "id": "CWE-732",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-732"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-312"
          }
        ],
        "asvs": [
          {
            "id": "V13",
            "relation": "related"
          },
          {
            "id": "V13.2.2",
            "relation": "cites"
          },
          {
            "id": "V13.3.1",
            "relation": "cites"
          },
          {
            "id": "V13.3.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/iac-security/"
    },
    {
      "type": "Guide",
      "key": "prompt-injection-boundaries",
      "title": "Contain prompt injection at the application boundary",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-863",
            "relation": "cites"
          },
          {
            "id": "CWE-1427",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-863"
          }
        ],
        "asvs": [
          {
            "id": "V8.3.1",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM01:2026",
            "relation": "primary"
          },
          {
            "id": "LLM03:2026",
            "relation": "related"
          },
          {
            "id": "LLM08:2026",
            "relation": "related"
          },
          {
            "id": "LLM10:2026",
            "relation": "related"
          }
        ],
        "agentic": [
          {
            "id": "ASI01:2026",
            "relation": "primary"
          },
          {
            "id": "ASI02:2026",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/prompt-injection-boundaries/"
    },
    {
      "type": "Guide",
      "key": "secret-handling",
      "title": "Secrets management: storage, rotation and leaked-secret response",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-522",
            "relation": "cites"
          },
          {
            "id": "CWE-532",
            "relation": "cites"
          },
          {
            "id": "CWE-798",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "related"
          },
          {
            "id": "A09:2025",
            "relation": "related"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-522"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-798"
          }
        ],
        "asvs": [
          {
            "id": "V13",
            "relation": "primary"
          },
          {
            "id": "V11.5.1",
            "relation": "cites"
          },
          {
            "id": "V13.1.4",
            "relation": "cites"
          },
          {
            "id": "V13.3.1",
            "relation": "cites"
          },
          {
            "id": "V13.3.2",
            "relation": "cites"
          },
          {
            "id": "V13.3.4",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/secrets/secrets-lifecycle/"
    },
    {
      "type": "Guide",
      "key": "mobile-native-boundaries",
      "title": "Review trust boundaries in mobile and native clients",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-639",
            "relation": "related"
          },
          {
            "id": "CWE-602",
            "relation": "cites"
          },
          {
            "id": "CWE-939",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "related"
          },
          {
            "id": "A06:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API1:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V8",
            "relation": "related"
          },
          {
            "id": "V2.2.2",
            "relation": "cites"
          },
          {
            "id": "V8.3.1",
            "relation": "cites"
          }
        ],
        "masvs": [
          {
            "id": "MASVS-AUTH-1",
            "relation": "related"
          },
          {
            "id": "MASVS-PLATFORM-1",
            "relation": "related"
          },
          {
            "id": "MASVS-RESILIENCE-1",
            "relation": "related"
          },
          {
            "id": "MASVS-RESILIENCE-3",
            "relation": "related"
          },
          {
            "id": "MASVS-RESILIENCE-4",
            "relation": "related"
          },
          {
            "id": "MASVS-STORAGE-1",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/mobile-native-trust-boundaries/"
    },
    {
      "type": "Guide",
      "key": "crypto-ecb",
      "title": "ECB mode: why it leaks patterns and what to use instead",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-327",
            "relation": "primary"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "primary"
          },
          {
            "id": "V11.3.1",
            "relation": "cites"
          },
          {
            "id": "V11.3.2",
            "relation": "cites"
          },
          {
            "id": "V11.3.3",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/ecb-mode-leakage/"
    },
    {
      "type": "Guide",
      "key": "crypto-padding-oracle",
      "title": "Padding oracle attacks",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-208",
            "relation": "cites"
          },
          {
            "id": "CWE-327",
            "relation": "cites"
          },
          {
            "id": "CWE-353",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "via-cwe",
            "via": "CWE-353"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "primary"
          },
          {
            "id": "V11.2.5",
            "relation": "cites"
          },
          {
            "id": "V11.3.3",
            "relation": "cites"
          },
          {
            "id": "V11.3.5",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/padding-oracle-attacks/"
    },
    {
      "type": "Guide",
      "key": "crypto-hash-collisions",
      "title": "Hash collisions and digital signatures: MD5, SHA-1 and what to use",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-327",
            "relation": "primary"
          },
          {
            "id": "CWE-328",
            "relation": "cites"
          },
          {
            "id": "CWE-347",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "primary"
          },
          {
            "id": "V11.4.1",
            "relation": "cites"
          },
          {
            "id": "V11.4.3",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/hash-collisions-and-signatures/"
    },
    {
      "type": "Guide",
      "key": "crypto-weak-rsa",
      "title": "Weak RSA key generation: shared primes, ROCA and safe keys",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-326",
            "relation": "cites"
          },
          {
            "id": "CWE-331",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "primary"
          },
          {
            "id": "V11.2.3",
            "relation": "cites"
          },
          {
            "id": "V11.5.1",
            "relation": "cites"
          },
          {
            "id": "V11.6.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/weak-rsa-key-generation/"
    },
    {
      "type": "Guide",
      "key": "crypto-rc4",
      "title": "RC4 keystream bias",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-327",
            "relation": "primary"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "primary"
          },
          {
            "id": "V12",
            "relation": "related"
          },
          {
            "id": "V11.3.2",
            "relation": "cites"
          },
          {
            "id": "V12.1.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/rc4-keystream-bias/"
    },
    {
      "type": "Guide",
      "key": "crypto-sweet32-mechanism",
      "title": "64-bit block ciphers and the Sweet32 mechanism",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-327",
            "relation": "primary"
          },
          {
            "id": "CWE-326",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "primary"
          },
          {
            "id": "V12",
            "relation": "related"
          },
          {
            "id": "V11.3.2",
            "relation": "cites"
          },
          {
            "id": "V12.1.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/64-bit-block-ciphers-sweet32/"
    },
    {
      "type": "Guide",
      "key": "icdp-case-wep-2001",
      "title": "WEP: RC4 key reuse and weak IVs",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-327",
            "relation": "related"
          },
          {
            "id": "CWE-323",
            "relation": "cites"
          },
          {
            "id": "CWE-353",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "via-cwe",
            "via": "CWE-353"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "related"
          },
          {
            "id": "V11.3.3",
            "relation": "cites"
          },
          {
            "id": "V11.3.4",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/wep-rc4-key-reuse/"
    },
    {
      "type": "Guide",
      "key": "icdp-case-flame-2012",
      "title": "Flame: MD5 certificate forgery",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-327",
            "relation": "related"
          },
          {
            "id": "CWE-295",
            "relation": "cites"
          },
          {
            "id": "CWE-328",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "related"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-295"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "related"
          },
          {
            "id": "V11.4.1",
            "relation": "cites"
          },
          {
            "id": "V11.4.3",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/flame-md5-certificate-forgery/"
    },
    {
      "type": "Guide",
      "key": "icdp-case-lucky13-poodle",
      "title": "Lucky Thirteen and POODLE: two different oracles",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-208",
            "relation": "cites"
          },
          {
            "id": "CWE-327",
            "relation": "cites"
          },
          {
            "id": "CWE-757",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "related"
          },
          {
            "id": "V12",
            "relation": "related"
          },
          {
            "id": "V11.2.5",
            "relation": "cites"
          },
          {
            "id": "V12.1.1",
            "relation": "cites"
          },
          {
            "id": "V12.1.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/lucky13-poodle/"
    },
    {
      "type": "Guide",
      "key": "icdp-case-freak-logjam-2015",
      "title": "FREAK and Logjam: export-grade key exchange",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-326",
            "relation": "cites"
          },
          {
            "id": "CWE-757",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "related"
          },
          {
            "id": "V12",
            "relation": "related"
          },
          {
            "id": "V11.6.2",
            "relation": "cites"
          },
          {
            "id": "V12.1.1",
            "relation": "cites"
          },
          {
            "id": "V12.1.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/freak-logjam-export-grade-keys/"
    },
    {
      "type": "Guide",
      "key": "icdp-case-drown-2016",
      "title": "DROWN: one RSA key across incompatible protocols",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-327",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "related"
          },
          {
            "id": "V12",
            "relation": "related"
          },
          {
            "id": "V11.3.1",
            "relation": "cites"
          },
          {
            "id": "V12.1.1",
            "relation": "cites"
          },
          {
            "id": "V12.1.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/drown/"
    },
    {
      "type": "Guide",
      "key": "icdp-case-sweet32-2016",
      "title": "Sweet32: the cost of a small block size",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-327",
            "relation": "related"
          },
          {
            "id": "CWE-326",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "related"
          },
          {
            "id": "V12",
            "relation": "related"
          },
          {
            "id": "V12.1.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/sweet32/"
    },
    {
      "type": "Guide",
      "key": "icdp-case-roca-2017",
      "title": "ROCA: structured RSA key generation",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-326",
            "relation": "cites"
          },
          {
            "id": "CWE-1240",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "related"
          },
          {
            "id": "V11.6.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/roca-infineon-weak-keys/"
    },
    {
      "type": "Guide",
      "key": "xss-output-encoding",
      "title": "Prevent XSS at the output boundary",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-79",
            "relation": "primary"
          },
          {
            "id": "CWE-116",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "primary"
          },
          {
            "id": "V3",
            "relation": "primary"
          },
          {
            "id": "V1.2.1",
            "relation": "cites"
          },
          {
            "id": "V1.2.2",
            "relation": "cites"
          },
          {
            "id": "V1.3.1",
            "relation": "cites"
          },
          {
            "id": "V3.2.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-63",
            "relation": "cites"
          },
          {
            "id": "CAPEC-588",
            "relation": "cites"
          },
          {
            "id": "CAPEC-591",
            "relation": "cites"
          },
          {
            "id": "CAPEC-592",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/xss-output-encoding/"
    },
    {
      "type": "Guide",
      "key": "ssrf-egress-boundaries",
      "title": "Constrain server-side fetches to their intended destinations",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-918",
            "relation": "primary"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "primary"
          }
        ],
        "api": [
          {
            "id": "API7:2023",
            "relation": "primary"
          },
          {
            "id": "API10:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "related"
          },
          {
            "id": "V13",
            "relation": "related"
          },
          {
            "id": "V15",
            "relation": "related"
          },
          {
            "id": "V1.3.6",
            "relation": "cites"
          },
          {
            "id": "V13.2.4",
            "relation": "cites"
          },
          {
            "id": "V15.3.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-664",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/ssrf-egress-boundaries/"
    },
    {
      "type": "Guide",
      "key": "authentication-session-lifecycle",
      "title": "Session management: cookies, timeouts, rotation and revocation",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-384",
            "relation": "related"
          },
          {
            "id": "CWE-614",
            "relation": "related"
          },
          {
            "id": "CWE-1004",
            "relation": "related"
          },
          {
            "id": "CWE-1275",
            "relation": "related"
          },
          {
            "id": "CWE-613",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-1275"
          },
          {
            "id": "A02:2025",
            "relation": "via-cwe",
            "via": "CWE-614"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V7",
            "relation": "primary"
          },
          {
            "id": "V6",
            "relation": "related"
          },
          {
            "id": "V3.3.1",
            "relation": "cites"
          },
          {
            "id": "V3.3.3",
            "relation": "cites"
          },
          {
            "id": "V7.2.3",
            "relation": "cites"
          },
          {
            "id": "V7.2.4",
            "relation": "cites"
          },
          {
            "id": "V7.3.1",
            "relation": "cites"
          },
          {
            "id": "V7.3.2",
            "relation": "cites"
          },
          {
            "id": "V7.4.1",
            "relation": "cites"
          },
          {
            "id": "V7.4.2",
            "relation": "cites"
          },
          {
            "id": "V7.5.1",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-60",
            "relation": "cites"
          },
          {
            "id": "CAPEC-61",
            "relation": "cites"
          },
          {
            "id": "CAPEC-593",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/session-lifecycle/"
    },
    {
      "type": "Guide",
      "key": "password-storage",
      "title": "Password storage: hashing parameters and rehash on login",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-916",
            "relation": "primary"
          },
          {
            "id": "CWE-257",
            "relation": "cites"
          },
          {
            "id": "CWE-521",
            "relation": "cites"
          },
          {
            "id": "CWE-759",
            "relation": "cites"
          },
          {
            "id": "CWE-760",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          },
          {
            "id": "A07:2025",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "primary"
          },
          {
            "id": "V6",
            "relation": "related"
          },
          {
            "id": "V6.2.1",
            "relation": "cites"
          },
          {
            "id": "V6.2.8",
            "relation": "cites"
          },
          {
            "id": "V6.2.9",
            "relation": "cites"
          },
          {
            "id": "V6.2.12",
            "relation": "cites"
          },
          {
            "id": "V11.4.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-16",
            "relation": "cites"
          },
          {
            "id": "CAPEC-49",
            "relation": "cites"
          },
          {
            "id": "CAPEC-55",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/password-storage/"
    },
    {
      "type": "Guide",
      "key": "api-resource-limits",
      "title": "Bound API work, not just request counts",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-400",
            "relation": "primary"
          },
          {
            "id": "CWE-770",
            "relation": "primary"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API4:2023",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V2",
            "relation": "related"
          },
          {
            "id": "V15",
            "relation": "related"
          },
          {
            "id": "V15.1.3",
            "relation": "cites"
          },
          {
            "id": "V15.2.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/api-security/resource-consumption-limits/"
    },
    {
      "type": "Guide",
      "key": "security-logging",
      "title": "Create security logs someone can investigate",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-778",
            "relation": "primary"
          },
          {
            "id": "CWE-117",
            "relation": "related"
          },
          {
            "id": "CWE-532",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A09:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V16",
            "relation": "primary"
          },
          {
            "id": "V16.2.1",
            "relation": "cites"
          },
          {
            "id": "V16.2.5",
            "relation": "cites"
          },
          {
            "id": "V16.3.2",
            "relation": "cites"
          },
          {
            "id": "V16.4.1",
            "relation": "cites"
          },
          {
            "id": "V16.4.3",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/detection/security-event-logging/"
    },
    {
      "type": "Guide",
      "key": "secure-error-handling",
      "title": "Handle failures without leaking internals or weakening controls",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-209",
            "relation": "primary"
          },
          {
            "id": "CWE-200",
            "relation": "related"
          },
          {
            "id": "CWE-460",
            "relation": "cites"
          },
          {
            "id": "CWE-489",
            "relation": "cites"
          },
          {
            "id": "CWE-636",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A10:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-200"
          },
          {
            "id": "A02:2025",
            "relation": "via-cwe",
            "via": "CWE-489"
          }
        ],
        "api": [
          {
            "id": "API8:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V16",
            "relation": "primary"
          },
          {
            "id": "V2",
            "relation": "related"
          },
          {
            "id": "V13.4.2",
            "relation": "cites"
          },
          {
            "id": "V16.5.1",
            "relation": "cites"
          },
          {
            "id": "V16.5.3",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/secure-error-handling/"
    },
    {
      "type": "Guide",
      "key": "information-disclosure-misconfiguration",
      "title": "Ship without debug modes, verbose errors or exposed files",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-200",
            "relation": "primary"
          },
          {
            "id": "CWE-209",
            "relation": "primary"
          },
          {
            "id": "CWE-215",
            "relation": "primary"
          },
          {
            "id": "CWE-548",
            "relation": "primary"
          },
          {
            "id": "CWE-489",
            "relation": "cites"
          },
          {
            "id": "CWE-527",
            "relation": "cites"
          },
          {
            "id": "CWE-538",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-200"
          },
          {
            "id": "A10:2025",
            "relation": "via-cwe",
            "via": "CWE-209"
          }
        ],
        "asvs": [
          {
            "id": "V13",
            "relation": "primary"
          },
          {
            "id": "V13.4",
            "relation": "cites"
          },
          {
            "id": "V16.5.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/information-disclosure-misconfiguration/"
    },
    {
      "type": "Guide",
      "key": "coordinated-disclosure",
      "title": "Run coordinated vulnerability disclosure from report to advisory",
      "domain": "appsec",
      "mappings": {},
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/coordinated-disclosure/"
    },
    {
      "type": "Guide",
      "key": "csrf-origin-defense",
      "title": "Protect cookie-authenticated actions against CSRF",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-352",
            "relation": "primary"
          },
          {
            "id": "CWE-1275",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V3",
            "relation": "primary"
          },
          {
            "id": "V3.3.2",
            "relation": "cites"
          },
          {
            "id": "V3.3.3",
            "relation": "cites"
          },
          {
            "id": "V3.5.1",
            "relation": "cites"
          },
          {
            "id": "V3.5.2",
            "relation": "cites"
          },
          {
            "id": "V3.5.3",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-62",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/browser-security/csrf-origin-defense/"
    },
    {
      "type": "Guide",
      "key": "cors-csp-browser-boundaries",
      "title": "Configure CORS and CSP around the browser capabilities you need",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-942",
            "relation": "primary"
          },
          {
            "id": "CWE-79",
            "relation": "related"
          },
          {
            "id": "CWE-352",
            "relation": "related"
          },
          {
            "id": "CWE-346",
            "relation": "cites"
          },
          {
            "id": "CWE-1021",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "related"
          },
          {
            "id": "A05:2025",
            "relation": "related"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-1021"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-346"
          }
        ],
        "api": [
          {
            "id": "API8:2023",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V3",
            "relation": "primary"
          },
          {
            "id": "V3.4.2",
            "relation": "cites"
          },
          {
            "id": "V3.4.3",
            "relation": "cites"
          },
          {
            "id": "V3.4.6",
            "relation": "cites"
          },
          {
            "id": "V3.4.7",
            "relation": "cites"
          },
          {
            "id": "V3.5.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/browser-security/cors-csp-browser-boundaries/"
    },
    {
      "type": "Guide",
      "key": "rich-text-dom-security",
      "title": "Render rich text without granting it application privileges",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-79",
            "relation": "primary"
          },
          {
            "id": "CWE-346",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "primary"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-346"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "primary"
          },
          {
            "id": "V3",
            "relation": "primary"
          },
          {
            "id": "V1.3.1",
            "relation": "cites"
          },
          {
            "id": "V1.3.5",
            "relation": "cites"
          },
          {
            "id": "V3.2.2",
            "relation": "cites"
          },
          {
            "id": "V3.2.3",
            "relation": "cites"
          },
          {
            "id": "V3.5.5",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-588",
            "relation": "cites"
          },
          {
            "id": "CAPEC-592",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/browser-security/rich-text-dom-security/"
    },
    {
      "type": "Guide",
      "key": "function-property-authorization",
      "title": "Authorize functions and fields as well as objects",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-862",
            "relation": "primary"
          },
          {
            "id": "CWE-915",
            "relation": "primary"
          },
          {
            "id": "CWE-284",
            "relation": "related"
          },
          {
            "id": "CWE-863",
            "relation": "related"
          },
          {
            "id": "CWE-213",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API3:2023",
            "relation": "primary"
          },
          {
            "id": "API5:2023",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V8",
            "relation": "primary"
          },
          {
            "id": "V15",
            "relation": "related"
          },
          {
            "id": "V8.2.1",
            "relation": "cites"
          },
          {
            "id": "V8.2.3",
            "relation": "cites"
          },
          {
            "id": "V15.3.1",
            "relation": "cites"
          },
          {
            "id": "V15.3.3",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/authorization/function-property-authorization/"
    },
    {
      "type": "Guide",
      "key": "transaction-races",
      "title": "Preserve business invariants under concurrent requests",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-362",
            "relation": "primary"
          },
          {
            "id": "CWE-367",
            "relation": "cites"
          },
          {
            "id": "CWE-837",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V2",
            "relation": "primary"
          },
          {
            "id": "V15",
            "relation": "primary"
          },
          {
            "id": "V2.3.3",
            "relation": "cites"
          },
          {
            "id": "V2.3.4",
            "relation": "cites"
          },
          {
            "id": "V15.4.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-26",
            "relation": "cites"
          },
          {
            "id": "CAPEC-29",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/business-logic/transaction-races/"
    },
    {
      "type": "Guide",
      "key": "injection-parser-boundaries",
      "title": "Keep untrusted values out of executable syntax",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-77",
            "relation": "related"
          },
          {
            "id": "CWE-78",
            "relation": "related"
          },
          {
            "id": "CWE-88",
            "relation": "related"
          },
          {
            "id": "CWE-94",
            "relation": "related"
          },
          {
            "id": "CWE-502",
            "relation": "related"
          },
          {
            "id": "CWE-611",
            "relation": "related"
          },
          {
            "id": "CWE-1336",
            "relation": "related"
          },
          {
            "id": "CWE-90",
            "relation": "cites"
          },
          {
            "id": "CWE-917",
            "relation": "cites"
          },
          {
            "id": "CWE-943",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "primary"
          },
          {
            "id": "A02:2025",
            "relation": "related"
          },
          {
            "id": "A08:2025",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "primary"
          },
          {
            "id": "V1.2.4",
            "relation": "cites"
          },
          {
            "id": "V1.2.5",
            "relation": "cites"
          },
          {
            "id": "V1.2.6",
            "relation": "cites"
          },
          {
            "id": "V1.3.2",
            "relation": "cites"
          },
          {
            "id": "V1.3.7",
            "relation": "cites"
          },
          {
            "id": "V1.5.1",
            "relation": "cites"
          },
          {
            "id": "V1.5.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-88",
            "relation": "cites"
          },
          {
            "id": "CAPEC-136",
            "relation": "cites"
          },
          {
            "id": "CAPEC-201",
            "relation": "cites"
          },
          {
            "id": "CAPEC-242",
            "relation": "cites"
          },
          {
            "id": "CAPEC-586",
            "relation": "cites"
          },
          {
            "id": "CAPEC-676",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/injection-parser-boundaries/"
    },
    {
      "type": "Guide",
      "key": "os-command-injection",
      "title": "Run external programs without command or argument injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-77",
            "relation": "primary"
          },
          {
            "id": "CWE-78",
            "relation": "primary"
          },
          {
            "id": "CWE-88",
            "relation": "primary"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "related"
          },
          {
            "id": "V1.2.5",
            "relation": "cites"
          },
          {
            "id": "V1.2.8",
            "relation": "cites"
          },
          {
            "id": "V2.2.1",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-6",
            "relation": "cites"
          },
          {
            "id": "CAPEC-88",
            "relation": "cites"
          },
          {
            "id": "CAPEC-248",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/os-command-injection/"
    },
    {
      "type": "Guide",
      "key": "code-template-injection",
      "title": "Keep untrusted input out of eval, expression languages and templates",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-94",
            "relation": "primary"
          },
          {
            "id": "CWE-95",
            "relation": "primary"
          },
          {
            "id": "CWE-917",
            "relation": "primary"
          },
          {
            "id": "CWE-1336",
            "relation": "primary"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "related"
          },
          {
            "id": "V1.3.2",
            "relation": "cites"
          },
          {
            "id": "V1.3.7",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-242",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/code-template-injection/"
    },
    {
      "type": "Guide",
      "key": "archive-path-safety",
      "title": "Extract archives without escaping the destination",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-22",
            "relation": "primary"
          },
          {
            "id": "CWE-770",
            "relation": "related"
          },
          {
            "id": "CWE-23",
            "relation": "cites"
          },
          {
            "id": "CWE-36",
            "relation": "cites"
          },
          {
            "id": "CWE-59",
            "relation": "cites"
          },
          {
            "id": "CWE-409",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "primary"
          }
        ],
        "api": [
          {
            "id": "API4:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V5",
            "relation": "primary"
          },
          {
            "id": "V5.2.3",
            "relation": "cites"
          },
          {
            "id": "V5.2.5",
            "relation": "cites"
          },
          {
            "id": "V5.3.3",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-126",
            "relation": "cites"
          },
          {
            "id": "CAPEC-139",
            "relation": "cites"
          },
          {
            "id": "CAPEC-597",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/archive-path-safety/"
    },
    {
      "type": "Guide",
      "key": "untrusted-document-conversion",
      "title": "Convert untrusted office documents and PDFs in an isolated parser",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-22",
            "relation": "cites"
          },
          {
            "id": "CWE-400",
            "relation": "cites"
          },
          {
            "id": "CWE-409",
            "relation": "cites"
          },
          {
            "id": "CWE-611",
            "relation": "cites"
          },
          {
            "id": "CWE-918",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A02:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V1.5.1",
            "relation": "cites"
          },
          {
            "id": "V5.2.2",
            "relation": "cites"
          },
          {
            "id": "V5.2.3",
            "relation": "cites"
          },
          {
            "id": "V15.2.5",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/untrusted-document-conversion/"
    },
    {
      "type": "Guide",
      "key": "webrtc-security",
      "title": "Secure WebRTC signaling, TURN relays and media servers",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-770",
            "relation": "related"
          },
          {
            "id": "CWE-295",
            "relation": "cites"
          },
          {
            "id": "CWE-359",
            "relation": "cites"
          },
          {
            "id": "CWE-441",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-441"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-295"
          }
        ],
        "asvs": [
          {
            "id": "V17",
            "relation": "primary"
          },
          {
            "id": "V17.1.1",
            "relation": "cites"
          },
          {
            "id": "V17.1.2",
            "relation": "cites"
          },
          {
            "id": "V17.2.1",
            "relation": "cites"
          },
          {
            "id": "V17.2.2",
            "relation": "cites"
          },
          {
            "id": "V17.2.3",
            "relation": "cites"
          },
          {
            "id": "V17.2.4",
            "relation": "cites"
          },
          {
            "id": "V17.2.5",
            "relation": "cites"
          },
          {
            "id": "V17.2.6",
            "relation": "cites"
          },
          {
            "id": "V17.2.7",
            "relation": "cites"
          },
          {
            "id": "V17.2.8",
            "relation": "cites"
          },
          {
            "id": "V17.3.1",
            "relation": "cites"
          },
          {
            "id": "V17.3.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/webrtc-security/"
    },
    {
      "type": "Guide",
      "key": "security-code-review",
      "title": "Review a code change through its trust boundaries",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-639",
            "relation": "related"
          },
          {
            "id": "CWE-862",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API1:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V8",
            "relation": "related"
          },
          {
            "id": "V8.2.2",
            "relation": "cites"
          },
          {
            "id": "V8.3.1",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PW.7",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/code-review/security-code-review/"
    },
    {
      "type": "Guide",
      "key": "sast-dast-workflow",
      "title": "Combine static and dynamic tests around a verified finding",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-89",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/testing/sast-dast-workflow/"
    },
    {
      "type": "Guide",
      "key": "parser-fuzzing",
      "title": "Fuzz a parser and turn crashes into lasting regressions",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-125",
            "relation": "related"
          },
          {
            "id": "CWE-130",
            "relation": "cites"
          },
          {
            "id": "CWE-1284",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "related"
          },
          {
            "id": "V1.4.1",
            "relation": "cites"
          },
          {
            "id": "V1.4.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-28",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/testing/parser-fuzzing/"
    },
    {
      "type": "Guide",
      "key": "framework-security-patterns",
      "title": "Preserve framework security controls across the request lifecycle",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-352",
            "relation": "related"
          },
          {
            "id": "CWE-288",
            "relation": "cites"
          },
          {
            "id": "CWE-489",
            "relation": "cites"
          },
          {
            "id": "CWE-1188",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "related"
          },
          {
            "id": "A02:2025",
            "relation": "related"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-288"
          }
        ],
        "asvs": [
          {
            "id": "V13",
            "relation": "related"
          },
          {
            "id": "V3.3.1",
            "relation": "cites"
          },
          {
            "id": "V3.4.1",
            "relation": "cites"
          },
          {
            "id": "V3.4.3",
            "relation": "cites"
          },
          {
            "id": "V13.4.2",
            "relation": "cites"
          },
          {
            "id": "V15.3.4",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/framework-security-patterns/"
    },
    {
      "type": "Guide",
      "key": "android-ios-security",
      "title": "Review mobile storage, links and platform permissions",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-295",
            "relation": "cites"
          },
          {
            "id": "CWE-532",
            "relation": "cites"
          },
          {
            "id": "CWE-922",
            "relation": "cites"
          },
          {
            "id": "CWE-926",
            "relation": "cites"
          },
          {
            "id": "CWE-939",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-922"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-295"
          },
          {
            "id": "A08:2025",
            "relation": "via-cwe",
            "via": "CWE-926"
          },
          {
            "id": "A09:2025",
            "relation": "via-cwe",
            "via": "CWE-532"
          }
        ],
        "masvs": [
          {
            "id": "MASVS-NETWORK-1",
            "relation": "related"
          },
          {
            "id": "MASVS-PLATFORM-1",
            "relation": "related"
          },
          {
            "id": "MASVS-PLATFORM-3",
            "relation": "related"
          },
          {
            "id": "MASVS-RESILIENCE-1",
            "relation": "related"
          },
          {
            "id": "MASVS-STORAGE-1",
            "relation": "related"
          },
          {
            "id": "MASVS-STORAGE-2",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/android-ios-security/"
    },
    {
      "type": "Guide",
      "key": "electron-native-security",
      "title": "Constrain desktop IPC and privileged helpers",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-250",
            "relation": "related"
          },
          {
            "id": "CWE-346",
            "relation": "cites"
          },
          {
            "id": "CWE-749",
            "relation": "cites"
          },
          {
            "id": "CWE-940",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-346"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/electron-native-security/"
    },
    {
      "type": "Guide",
      "key": "embedded-update-security",
      "title": "Design firmware updates that can recover safely",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-494",
            "relation": "primary"
          },
          {
            "id": "CWE-347",
            "relation": "cites"
          },
          {
            "id": "CWE-1277",
            "relation": "cites"
          },
          {
            "id": "CWE-1329",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A08:2025",
            "relation": "primary"
          },
          {
            "id": "A03:2025",
            "relation": "related"
          },
          {
            "id": "A04:2025",
            "relation": "via-cwe",
            "via": "CWE-347"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/embedded-update-security/"
    },
    {
      "type": "Guide",
      "key": "kubernetes-workload-security",
      "title": "Run Kubernetes workloads with only the privileges they need",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-250",
            "relation": "primary"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "primary"
          }
        ],
        "k8s": [
          {
            "id": "K01:2025",
            "relation": "primary"
          },
          {
            "id": "K02:2025",
            "relation": "related"
          },
          {
            "id": "K04:2025",
            "relation": "related"
          },
          {
            "id": "K09:2025",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/containers/kubernetes-workload-security/"
    },
    {
      "type": "Guide",
      "key": "container-network-admission",
      "title": "Prove network and admission policies enforce the intended boundary",
      "domain": "runtime",
      "mappings": {
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "related"
          }
        ],
        "k8s": [
          {
            "id": "K04:2025",
            "relation": "primary"
          },
          {
            "id": "K05:2025",
            "relation": "primary"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/containers/container-network-admission/"
    },
    {
      "type": "Guide",
      "key": "cloud-iam-trust",
      "title": "Review cloud permissions and role trust together",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-250",
            "relation": "related"
          },
          {
            "id": "CWE-284",
            "relation": "cites"
          },
          {
            "id": "CWE-863",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/cloud-iam-trust/"
    },
    {
      "type": "Guide",
      "key": "iac-policy-drift",
      "title": "Test infrastructure policy and detect security-relevant drift",
      "domain": "runtime",
      "mappings": {
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "primary"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/iac-policy-drift/"
    },
    {
      "type": "Guide",
      "key": "subdomain-takeover",
      "title": "Prevent subdomain takeover from dangling DNS records",
      "domain": "runtime",
      "mappings": {
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V3",
            "relation": "related"
          },
          {
            "id": "V3.3.3",
            "relation": "cites"
          },
          {
            "id": "V3.4.2",
            "relation": "cites"
          },
          {
            "id": "V10.4.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/subdomain-takeover/"
    },
    {
      "type": "Guide",
      "key": "api-gateway-inventory",
      "title": "Maintain an API inventory and prevent gateway bypass",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-306",
            "relation": "related"
          },
          {
            "id": "CWE-290",
            "relation": "cites"
          },
          {
            "id": "CWE-348",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "related"
          },
          {
            "id": "A07:2025",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API9:2023",
            "relation": "primary"
          },
          {
            "id": "API2:2023",
            "relation": "related"
          },
          {
            "id": "API8:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V4",
            "relation": "related"
          },
          {
            "id": "V14",
            "relation": "related"
          },
          {
            "id": "V4.1.3",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/api-security/api-gateway-inventory/"
    },
    {
      "type": "Guide",
      "key": "protocol-api-security",
      "title": "Apply security limits to GraphQL, WebSocket and gRPC operations",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-400",
            "relation": "related"
          },
          {
            "id": "CWE-770",
            "relation": "related"
          },
          {
            "id": "CWE-307",
            "relation": "cites"
          },
          {
            "id": "CWE-1385",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-307"
          }
        ],
        "api": [
          {
            "id": "API4:2023",
            "relation": "related"
          },
          {
            "id": "API2:2023",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V4",
            "relation": "primary"
          },
          {
            "id": "V4.3.1",
            "relation": "cites"
          },
          {
            "id": "V4.3.2",
            "relation": "cites"
          },
          {
            "id": "V4.4.1",
            "relation": "cites"
          },
          {
            "id": "V4.4.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/api-security/protocol-api-security/"
    },
    {
      "type": "Guide",
      "key": "bounded-background-work",
      "title": "Bound background jobs and make retries safe",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-362",
            "relation": "related"
          },
          {
            "id": "CWE-400",
            "relation": "related"
          },
          {
            "id": "CWE-770",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A10:2025",
            "relation": "related"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-362"
          }
        ],
        "api": [
          {
            "id": "API4:2023",
            "relation": "related"
          },
          {
            "id": "API10:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V15",
            "relation": "related"
          },
          {
            "id": "V15.2.2",
            "relation": "cites"
          },
          {
            "id": "V16.5.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/availability/bounded-background-work/"
    },
    {
      "type": "Guide",
      "key": "workload-mtls-serverless",
      "title": "Authenticate workloads and authorize their service actions",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-295",
            "relation": "related"
          },
          {
            "id": "CWE-863",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "related"
          },
          {
            "id": "A07:2025",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "related"
          },
          {
            "id": "API5:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V12",
            "relation": "primary"
          },
          {
            "id": "V8",
            "relation": "related"
          },
          {
            "id": "V13",
            "relation": "related"
          },
          {
            "id": "V8.2.1",
            "relation": "cites"
          },
          {
            "id": "V12.3.3",
            "relation": "cites"
          },
          {
            "id": "V12.3.5",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/service-security/workload-mtls-serverless/"
    },
    {
      "type": "Guide",
      "key": "runtime-detection-response",
      "title": "Turn runtime events into a tested investigation and containment path",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-778",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A09:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V16",
            "relation": "related"
          }
        ],
        "k8s": [
          {
            "id": "K10:2025",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/detection/runtime-detection-response/"
    },
    {
      "type": "Guide",
      "key": "edge-waf-bot-defense",
      "title": "Operate edge rules without hiding application defects",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-444",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "related"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-444"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "related"
          },
          {
            "id": "API6:2023",
            "relation": "related"
          },
          {
            "id": "API8:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V2",
            "relation": "related"
          },
          {
            "id": "V6",
            "relation": "related"
          },
          {
            "id": "V14",
            "relation": "related"
          },
          {
            "id": "V2.4.1",
            "relation": "cites"
          },
          {
            "id": "V6.3.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/edge-defense/edge-waf-bot-defense/"
    },
    {
      "type": "Guide",
      "key": "sbom-generation",
      "title": "Generate an SBOM for the software you actually release",
      "domain": "supply-chain",
      "mappings": {
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V15",
            "relation": "related"
          },
          {
            "id": "V15.1.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/sbom/generate-release-inventory/"
    },
    {
      "type": "Guide",
      "key": "sbom-formats-identifiers",
      "title": "Choose SBOM formats and identify components accurately",
      "domain": "supply-chain",
      "mappings": {
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/sbom/formats-and-identifiers/"
    },
    {
      "type": "Guide",
      "key": "sbom-release-diff",
      "title": "Review SBOM changes between releases",
      "domain": "supply-chain",
      "mappings": {
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/sbom/release-diff-and-distribution/"
    },
    {
      "type": "Guide",
      "key": "dependency-risk-triage",
      "title": "Triage new dependency vulnerability findings",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-1104",
            "relation": "cites"
          },
          {
            "id": "CWE-1395",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V15",
            "relation": "primary"
          },
          {
            "id": "V15.1.1",
            "relation": "cites"
          },
          {
            "id": "V15.2.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/evidence-based-triage/"
    },
    {
      "type": "Guide",
      "key": "artifact-signature-policy",
      "title": "Verify artifact signatures against an explicit trust policy",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-347",
            "relation": "primary"
          },
          {
            "id": "CWE-494",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "primary"
          },
          {
            "id": "A04:2025",
            "relation": "via-cwe",
            "via": "CWE-347"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-206",
            "relation": "cites"
          }
        ],
        "k8s": [
          {
            "id": "K04:2025",
            "relation": "related"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-9",
            "relation": "primary"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/provenance/artifact-signature-policy/"
    },
    {
      "type": "Guide",
      "key": "slsa-provenance",
      "title": "Read SLSA provenance and verify the claim you need",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-494",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "primary"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-444",
            "relation": "cites"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-9",
            "relation": "primary"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/provenance/read-and-verify-slsa/"
    },
    {
      "type": "Guide",
      "key": "ci-untrusted-workflows",
      "title": "Keep untrusted CI work outside the release boundary",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-829",
            "relation": "primary"
          },
          {
            "id": "CWE-78",
            "relation": "cites"
          },
          {
            "id": "CWE-94",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "related"
          },
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-88",
            "relation": "cites"
          },
          {
            "id": "CAPEC-242",
            "relation": "cites"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-4",
            "relation": "primary"
          },
          {
            "id": "CICD-SEC-5",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/untrusted-workflow-boundaries/"
    },
    {
      "type": "Guide",
      "key": "package-attack-response",
      "title": "Investigate a suspected malicious package safely",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-506",
            "relation": "primary"
          },
          {
            "id": "CWE-1357",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V15.2.4",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-538",
            "relation": "cites"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-3",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/package-attack-response/"
    },
    {
      "type": "Guide",
      "key": "vex-decisions",
      "title": "Use VEX without losing vulnerability evidence",
      "domain": "supply-chain",
      "mappings": {
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/vex/producer-and-consumer-decisions/"
    },
    {
      "type": "Guide",
      "key": "reproducible-builds",
      "title": "Investigate build differences and improve reproducibility",
      "domain": "supply-chain",
      "mappings": {
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/builds/reproducibility-and-hermeticity/"
    },
    {
      "type": "Guide",
      "key": "dependency-project-health",
      "title": "Review dependency health without treating a score as a guarantee",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-1357",
            "relation": "primary"
          },
          {
            "id": "CWE-1104",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V15",
            "relation": "primary"
          },
          {
            "id": "V15.1.2",
            "relation": "cites"
          },
          {
            "id": "V15.1.4",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/project-health-and-intake/"
    },
    {
      "type": "Guide",
      "key": "trusted-publishing-updates",
      "title": "Protect package publication and the update channel",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-494",
            "relation": "primary"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "primary"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-657",
            "relation": "cites"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-6",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-9",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/releases/trusted-publishing-and-updates/"
    },
    {
      "type": "Guide",
      "key": "security-program-operations",
      "title": "Run an AppSec program: owners, finding states, deadlines and champions",
      "domain": "governance",
      "mappings": {},
      "url": "https://softwaresecurity.com/frameworks/program-operations/"
    },
    {
      "type": "Guide",
      "key": "asvs-verification-evidence",
      "title": "ASVS 5.0 verification records: requirement, test and evidence another engineer can repeat",
      "domain": "governance",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-78",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "related"
          },
          {
            "id": "V1.2.5",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/asvs-verification-evidence/"
    },
    {
      "type": "Guide",
      "key": "ssdf-product-lifecycle",
      "title": "Apply NIST SSDF (SP 800-218) to one product: practices, evidence and attestation in 2026",
      "domain": "governance",
      "mappings": {
        "ssdf": [
          {
            "id": "PO.1",
            "relation": "mentions"
          },
          {
            "id": "PO.2",
            "relation": "mentions"
          },
          {
            "id": "PO.3",
            "relation": "mentions"
          },
          {
            "id": "PO.4",
            "relation": "mentions"
          },
          {
            "id": "PO.5",
            "relation": "mentions"
          },
          {
            "id": "PS.1",
            "relation": "mentions"
          },
          {
            "id": "PS.2",
            "relation": "mentions"
          },
          {
            "id": "PS.3",
            "relation": "mentions"
          },
          {
            "id": "PW.1",
            "relation": "mentions"
          },
          {
            "id": "PW.2",
            "relation": "mentions"
          },
          {
            "id": "PW.4",
            "relation": "mentions"
          },
          {
            "id": "PW.5",
            "relation": "mentions"
          },
          {
            "id": "PW.6",
            "relation": "mentions"
          },
          {
            "id": "PW.7",
            "relation": "mentions"
          },
          {
            "id": "PW.8",
            "relation": "mentions"
          },
          {
            "id": "PW.9",
            "relation": "mentions"
          },
          {
            "id": "RV.1",
            "relation": "mentions"
          },
          {
            "id": "RV.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/ssdf-product-lifecycle/"
    },
    {
      "type": "Guide",
      "key": "samm-assessment",
      "title": "Run an OWASP SAMM assessment with evidence and a practical roadmap",
      "domain": "governance",
      "mappings": {},
      "url": "https://softwaresecurity.com/frameworks/samm-assessment/"
    },
    {
      "type": "Guide",
      "key": "risk-exceptions-metrics",
      "title": "Approve, expire and measure security exceptions without hiding risk",
      "domain": "governance",
      "mappings": {},
      "url": "https://softwaresecurity.com/frameworks/risk-exceptions-and-metrics/"
    },
    {
      "type": "Guide",
      "key": "assurance-mapping",
      "title": "Control mapping between frameworks: state the relationship without overstating equivalence",
      "domain": "governance",
      "mappings": {},
      "url": "https://softwaresecurity.com/frameworks/control-mapping-and-evidence/"
    },
    {
      "type": "Guide",
      "key": "supplier-assurance",
      "title": "Supplier software assurance: check SOC 2 reports, SBOMs and signed updates against your use",
      "domain": "governance",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-1357",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/supplier-software-assurance/"
    },
    {
      "type": "Guide",
      "key": "product-security-obligations",
      "title": "Cyber Resilience Act and payment pages: turn product-security obligations into an engineering evidence plan",
      "domain": "governance",
      "mappings": {},
      "url": "https://softwaresecurity.com/frameworks/product-security-obligations/"
    },
    {
      "type": "Guide",
      "key": "assurance-frameworks",
      "title": "ISO 27001, SOC 2, NIST CSF or FedRAMP: choose the framework by the question it answers",
      "domain": "governance",
      "mappings": {},
      "url": "https://softwaresecurity.com/frameworks/choosing-assurance-frameworks/"
    },
    {
      "type": "Guide",
      "key": "privacy-regulatory-scope",
      "title": "GDPR, CCPA, HIPAA or the FTC rule: scope privacy and health-data obligations before choosing controls",
      "domain": "governance",
      "mappings": {
        "asvs": [
          {
            "id": "V14",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/privacy-and-health-data-scope/"
    },
    {
      "type": "Guide",
      "key": "oauth-oidc-login",
      "title": "OAuth 2.0 and OpenID Connect login: authorization code with PKCE",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-294",
            "relation": "cites"
          },
          {
            "id": "CWE-346",
            "relation": "cites"
          },
          {
            "id": "CWE-352",
            "relation": "cites"
          },
          {
            "id": "CWE-601",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-352"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V10",
            "relation": "primary"
          },
          {
            "id": "V6",
            "relation": "related"
          },
          {
            "id": "V9",
            "relation": "related"
          },
          {
            "id": "V10.1.1",
            "relation": "cites"
          },
          {
            "id": "V10.2.1",
            "relation": "cites"
          },
          {
            "id": "V10.2.2",
            "relation": "cites"
          },
          {
            "id": "V10.4.1",
            "relation": "cites"
          },
          {
            "id": "V10.4.5",
            "relation": "cites"
          },
          {
            "id": "V10.5.1",
            "relation": "cites"
          },
          {
            "id": "V10.5.2",
            "relation": "cites"
          },
          {
            "id": "V10.5.4",
            "relation": "cites"
          }
        ],
        "masvs": [
          {
            "id": "MASVS-AUTH-1",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/oauth-oidc-login/"
    },
    {
      "type": "Guide",
      "key": "jwt-validation-rollover",
      "title": "JWT validation: algorithms, keys, claims and key rollover",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-347",
            "relation": "primary"
          },
          {
            "id": "CWE-290",
            "relation": "cites"
          },
          {
            "id": "CWE-918",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "primary"
          },
          {
            "id": "A04:2025",
            "relation": "related"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-918"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V9",
            "relation": "primary"
          },
          {
            "id": "V10",
            "relation": "related"
          },
          {
            "id": "V9.1.1",
            "relation": "cites"
          },
          {
            "id": "V9.1.2",
            "relation": "cites"
          },
          {
            "id": "V9.1.3",
            "relation": "cites"
          },
          {
            "id": "V9.2.1",
            "relation": "cites"
          },
          {
            "id": "V9.2.2",
            "relation": "cites"
          },
          {
            "id": "V9.2.3",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-475",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/jwt-validation-rollover/"
    },
    {
      "type": "Guide",
      "key": "passkeys-mfa-lifecycle",
      "title": "Passkeys and MFA: WebAuthn enrollment, sign-in and replacement",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-294",
            "relation": "cites"
          },
          {
            "id": "CWE-308",
            "relation": "cites"
          },
          {
            "id": "CWE-1390",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "primary"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V6",
            "relation": "primary"
          },
          {
            "id": "V6.3.3",
            "relation": "cites"
          },
          {
            "id": "V6.4.3",
            "relation": "cites"
          },
          {
            "id": "V6.5.1",
            "relation": "cites"
          },
          {
            "id": "V6.6.1",
            "relation": "cites"
          },
          {
            "id": "V6.6.4",
            "relation": "cites"
          },
          {
            "id": "V6.7.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/passkeys-mfa-lifecycle/"
    },
    {
      "type": "Guide",
      "key": "account-recovery-linking",
      "title": "Account recovery: password resets, help-desk resets and account linking",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-362",
            "relation": "related"
          },
          {
            "id": "CWE-204",
            "relation": "cites"
          },
          {
            "id": "CWE-640",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "primary"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-362"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V6",
            "relation": "primary"
          },
          {
            "id": "V7",
            "relation": "related"
          },
          {
            "id": "V6.3.7",
            "relation": "cites"
          },
          {
            "id": "V6.3.8",
            "relation": "cites"
          },
          {
            "id": "V6.4.3",
            "relation": "cites"
          },
          {
            "id": "V6.4.4",
            "relation": "cites"
          },
          {
            "id": "V7.4.3",
            "relation": "cites"
          },
          {
            "id": "V11.5.1",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-50",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/account-recovery-linking/"
    },
    {
      "type": "Guide",
      "key": "aead-record-design",
      "title": "AEAD records: AES-GCM nonces, associated data and key limits",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-323",
            "relation": "cites"
          },
          {
            "id": "CWE-327",
            "relation": "cites"
          },
          {
            "id": "CWE-353",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "via-cwe",
            "via": "CWE-353"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "primary"
          },
          {
            "id": "V11.2.1",
            "relation": "cites"
          },
          {
            "id": "V11.3.2",
            "relation": "cites"
          },
          {
            "id": "V11.3.3",
            "relation": "cites"
          },
          {
            "id": "V11.3.4",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/authenticated-record-design/"
    },
    {
      "type": "Guide",
      "key": "envelope-encryption-rotation",
      "title": "Envelope encryption and key rotation: data keys, KMS keys and backups",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-321",
            "relation": "cites"
          },
          {
            "id": "CWE-323",
            "relation": "cites"
          },
          {
            "id": "CWE-324",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "primary"
          },
          {
            "id": "V13",
            "relation": "related"
          },
          {
            "id": "V11.1.1",
            "relation": "cites"
          },
          {
            "id": "V11.1.2",
            "relation": "cites"
          },
          {
            "id": "V11.3.3",
            "relation": "cites"
          },
          {
            "id": "V11.3.4",
            "relation": "cites"
          },
          {
            "id": "V13.3.1",
            "relation": "cites"
          },
          {
            "id": "V13.3.3",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/envelope-encryption-rotation/"
    },
    {
      "type": "Guide",
      "key": "tls-pki-operations",
      "title": "Operate TLS and certificates: configuration, renewal and verification",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-295",
            "relation": "related"
          },
          {
            "id": "CWE-297",
            "relation": "cites"
          },
          {
            "id": "CWE-298",
            "relation": "cites"
          },
          {
            "id": "CWE-319",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          },
          {
            "id": "A07:2025",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API8:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V12",
            "relation": "primary"
          },
          {
            "id": "V3.4.1",
            "relation": "cites"
          },
          {
            "id": "V12.1.1",
            "relation": "cites"
          },
          {
            "id": "V12.1.2",
            "relation": "cites"
          },
          {
            "id": "V12.2.2",
            "relation": "cites"
          },
          {
            "id": "V12.3.2",
            "relation": "cites"
          },
          {
            "id": "V12.3.4",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-94",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/tls-pki-operations/"
    },
    {
      "type": "Guide",
      "key": "workload-identity-models",
      "title": "Workload identity federation: short-lived, scoped identities for services and CI",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-250",
            "relation": "related"
          },
          {
            "id": "CWE-290",
            "relation": "cites"
          },
          {
            "id": "CWE-863",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "related"
          },
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V13",
            "relation": "primary"
          },
          {
            "id": "V13.2.1",
            "relation": "cites"
          },
          {
            "id": "V13.2.2",
            "relation": "cites"
          },
          {
            "id": "V13.3.1",
            "relation": "cites"
          }
        ],
        "k8s": [
          {
            "id": "K03:2025",
            "relation": "related"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-6",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/identity/workload-identity-models/"
    },
    {
      "type": "Guide",
      "key": "authorization-models",
      "title": "Authorization models: RBAC, ABAC, ReBAC and policy as code you can test",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-284",
            "relation": "primary"
          },
          {
            "id": "CWE-863",
            "relation": "primary"
          },
          {
            "id": "CWE-639",
            "relation": "related"
          },
          {
            "id": "CWE-862",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "primary"
          }
        ],
        "api": [
          {
            "id": "API1:2023",
            "relation": "related"
          },
          {
            "id": "API3:2023",
            "relation": "related"
          },
          {
            "id": "API5:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V8",
            "relation": "primary"
          },
          {
            "id": "V8.2.1",
            "relation": "cites"
          },
          {
            "id": "V8.2.2",
            "relation": "cites"
          },
          {
            "id": "V8.2.3",
            "relation": "cites"
          },
          {
            "id": "V8.3.1",
            "relation": "cites"
          },
          {
            "id": "V8.3.3",
            "relation": "cites"
          },
          {
            "id": "V8.4.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/identity/authorization-models/"
    },
    {
      "type": "Guide",
      "key": "data-minimization-retention",
      "title": "Data minimization and retention: collect less and prove that deletion works",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-359",
            "relation": "cites"
          },
          {
            "id": "CWE-532",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-359"
          },
          {
            "id": "A09:2025",
            "relation": "via-cwe",
            "via": "CWE-532"
          }
        ],
        "asvs": [
          {
            "id": "V14",
            "relation": "primary"
          },
          {
            "id": "V11.7.2",
            "relation": "cites"
          },
          {
            "id": "V14.1.2",
            "relation": "cites"
          },
          {
            "id": "V14.2.6",
            "relation": "cites"
          },
          {
            "id": "V14.2.7",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/privacy/data-minimization-retention/"
    },
    {
      "type": "Guide",
      "key": "tokenization-privacy-engineering",
      "title": "Tokenization, pseudonymization and privacy transformations: choose deliberately",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-328",
            "relation": "cites"
          },
          {
            "id": "CWE-359",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-359"
          },
          {
            "id": "A04:2025",
            "relation": "via-cwe",
            "via": "CWE-328"
          }
        ],
        "asvs": [
          {
            "id": "V14",
            "relation": "related"
          },
          {
            "id": "V14.1.1",
            "relation": "cites"
          },
          {
            "id": "V14.2.4",
            "relation": "cites"
          },
          {
            "id": "V14.2.6",
            "relation": "cites"
          }
        ],
        "masvs": [
          {
            "id": "MASVS-PRIVACY-2",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/privacy/tokenization-privacy-engineering/"
    },
    {
      "type": "Guide",
      "key": "crypto-inventory-pqc",
      "title": "Post-quantum migration: cryptographic inventory, hybrid TLS and deadlines",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-327",
            "relation": "related"
          },
          {
            "id": "CWE-326",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11",
            "relation": "primary"
          },
          {
            "id": "V11.1.2",
            "relation": "cites"
          },
          {
            "id": "V11.1.3",
            "relation": "cites"
          },
          {
            "id": "V11.1.4",
            "relation": "cites"
          },
          {
            "id": "V11.2.2",
            "relation": "cites"
          },
          {
            "id": "V11.2.3",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/crypto-inventory-pqc/"
    },
    {
      "type": "Guide",
      "key": "rag-tenant-isolation",
      "title": "Keep retrieval inside the user’s data boundary",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-863",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V8",
            "relation": "related"
          },
          {
            "id": "V8.2.2",
            "relation": "cites"
          },
          {
            "id": "V8.4.1",
            "relation": "cites"
          },
          {
            "id": "V14.2.2",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM09:2026",
            "relation": "primary"
          },
          {
            "id": "LLM02:2026",
            "relation": "related"
          }
        ],
        "agentic": [
          {
            "id": "ASI06:2026",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/rag-tenant-isolation/"
    },
    {
      "type": "Guide",
      "key": "agent-tool-authorization",
      "title": "Authorize agent tools outside the model",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-367",
            "relation": "cites"
          },
          {
            "id": "CWE-863",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-863"
          }
        ],
        "asvs": [
          {
            "id": "V8",
            "relation": "related"
          },
          {
            "id": "V8.3.1",
            "relation": "cites"
          },
          {
            "id": "V8.3.2",
            "relation": "cites"
          },
          {
            "id": "V15.4.2",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM03:2026",
            "relation": "primary"
          },
          {
            "id": "LLM01:2026",
            "relation": "related"
          }
        ],
        "agentic": [
          {
            "id": "ASI02:2026",
            "relation": "primary"
          },
          {
            "id": "ASI09:2026",
            "relation": "primary"
          },
          {
            "id": "ASI03:2026",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/tool-authorization/"
    },
    {
      "type": "Guide",
      "key": "untrusted-model-output",
      "title": "Keep generated output out of executable contexts",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-79",
            "relation": "related"
          },
          {
            "id": "CWE-78",
            "relation": "cites"
          },
          {
            "id": "CWE-89",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "primary"
          },
          {
            "id": "V3",
            "relation": "related"
          },
          {
            "id": "V1.2.4",
            "relation": "cites"
          },
          {
            "id": "V1.2.5",
            "relation": "cites"
          },
          {
            "id": "V1.3.1",
            "relation": "cites"
          },
          {
            "id": "V3.2.2",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM10:2026",
            "relation": "primary"
          },
          {
            "id": "LLM07:2026",
            "relation": "related"
          }
        ],
        "agentic": [
          {
            "id": "ASI05:2026",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/untrusted-model-output/"
    },
    {
      "type": "Guide",
      "key": "ai-security-evaluation",
      "title": "Build evaluations around prohibited outcomes",
      "domain": "ai-emerging",
      "mappings": {
        "llm": [
          {
            "id": "LLM07:2026",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/assurance/ai-security-evaluation/"
    },
    {
      "type": "Guide",
      "key": "ai-red-teaming",
      "title": "Red-team LLM applications and agents by their effects",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-1427",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM01:2026",
            "relation": "cites"
          },
          {
            "id": "LLM02:2026",
            "relation": "cites"
          },
          {
            "id": "LLM03:2026",
            "relation": "cites"
          },
          {
            "id": "LLM06:2026",
            "relation": "cites"
          },
          {
            "id": "LLM08:2026",
            "relation": "cites"
          },
          {
            "id": "LLM10:2026",
            "relation": "cites"
          }
        ],
        "agentic": [
          {
            "id": "ASI01:2026",
            "relation": "cites"
          },
          {
            "id": "ASI02:2026",
            "relation": "cites"
          },
          {
            "id": "ASI03:2026",
            "relation": "cites"
          },
          {
            "id": "ASI06:2026",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/assurance/ai-red-teaming/"
    },
    {
      "type": "Guide",
      "key": "ai-cost-memory-operations",
      "title": "Bound agent spending, memory and recovery",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-400",
            "relation": "related"
          },
          {
            "id": "CWE-770",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API4:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V15.4.2",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM06:2026",
            "relation": "primary"
          },
          {
            "id": "LLM01:2026",
            "relation": "related"
          }
        ],
        "agentic": [
          {
            "id": "ASI06:2026",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/cost-memory-operations/"
    },
    {
      "type": "Guide",
      "key": "model-artifact-security",
      "title": "Treat model releases as executable supply-chain inputs",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-494",
            "relation": "cites"
          },
          {
            "id": "CWE-502",
            "relation": "cites"
          },
          {
            "id": "CWE-829",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "related"
          },
          {
            "id": "A08:2025",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V1.5.2",
            "relation": "cites"
          },
          {
            "id": "V15.2.4",
            "relation": "cites"
          },
          {
            "id": "V15.2.5",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM04:2026",
            "relation": "primary"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/ml-security/model-artifact-security/"
    },
    {
      "type": "Guide",
      "key": "training-data-poisoning",
      "title": "Protect training and retrieval data from targeted poisoning",
      "domain": "ai-emerging",
      "mappings": {
        "llm": [
          {
            "id": "LLM05:2026",
            "relation": "primary"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/ml-security/training-data-poisoning/"
    },
    {
      "type": "Guide",
      "key": "model-privacy-attacks",
      "title": "Assess extraction, membership and inference risks",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-359",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-359"
          }
        ],
        "llm": [
          {
            "id": "LLM02:2026",
            "relation": "primary"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/ml-security/model-privacy-attacks/"
    },
    {
      "type": "Guide",
      "key": "mcp-multiagent-security",
      "title": "Constrain MCP and multi-agent trust boundaries",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-829",
            "relation": "related"
          },
          {
            "id": "CWE-441",
            "relation": "cites"
          },
          {
            "id": "CWE-639",
            "relation": "cites"
          },
          {
            "id": "CWE-863",
            "relation": "cites"
          },
          {
            "id": "CWE-918",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-441"
          },
          {
            "id": "A08:2025",
            "relation": "via-cwe",
            "via": "CWE-829"
          }
        ],
        "asvs": [
          {
            "id": "V8",
            "relation": "related"
          },
          {
            "id": "V10",
            "relation": "related"
          },
          {
            "id": "V8.2.2",
            "relation": "cites"
          },
          {
            "id": "V10.2.2",
            "relation": "cites"
          },
          {
            "id": "V10.3.1",
            "relation": "cites"
          },
          {
            "id": "V10.3.3",
            "relation": "cites"
          },
          {
            "id": "V10.4.1",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM01:2026",
            "relation": "related"
          },
          {
            "id": "LLM03:2026",
            "relation": "related"
          }
        ],
        "agentic": [
          {
            "id": "ASI03:2026",
            "relation": "primary"
          },
          {
            "id": "ASI04:2026",
            "relation": "primary"
          },
          {
            "id": "ASI07:2026",
            "relation": "primary"
          },
          {
            "id": "ASI01:2026",
            "relation": "related"
          },
          {
            "id": "ASI02:2026",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/mcp-multiagent-security/"
    },
    {
      "type": "Guide",
      "key": "agent-failure-containment",
      "title": "Contain cascading failures and rogue agents",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-770",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V2.4.1",
            "relation": "cites"
          },
          {
            "id": "V8.3.2",
            "relation": "cites"
          },
          {
            "id": "V16.4.3",
            "relation": "cites"
          },
          {
            "id": "V16.5.2",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM06:2026",
            "relation": "cites"
          }
        ],
        "agentic": [
          {
            "id": "ASI08:2026",
            "relation": "primary"
          },
          {
            "id": "ASI10:2026",
            "relation": "primary"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/agent-failure-containment/"
    },
    {
      "type": "Guide",
      "key": "ai-governance-regulation",
      "title": "Turn NIST AI RMF, ISO/IEC 42001 and EU AI Act duties into engineering evidence",
      "domain": "ai-emerging",
      "mappings": {},
      "url": "https://softwaresecurity.com/domains/ai-emerging/governance/ai-governance-regulation/"
    },
    {
      "type": "Guide",
      "key": "smart-contract-invariants",
      "title": "Test smart contracts through state invariants",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-841",
            "relation": "cites"
          },
          {
            "id": "CWE-1265",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-841"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/smart-contracts/security-invariants/"
    },
    {
      "type": "Guide",
      "key": "http-request-desynchronization",
      "title": "Keep HTTP request boundaries consistent across intermediaries",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-444",
            "relation": "primary"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "primary"
          }
        ],
        "api": [
          {
            "id": "API8:2023",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V4",
            "relation": "primary"
          },
          {
            "id": "V4.2.1",
            "relation": "cites"
          },
          {
            "id": "V4.2.2",
            "relation": "cites"
          },
          {
            "id": "V4.2.3",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-33",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/edge-defense/http-request-desynchronization/"
    },
    {
      "type": "Guide",
      "key": "cache-poisoning-deception",
      "title": "Prevent shared-cache poisoning and private-response deception",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-524",
            "relation": "primary"
          },
          {
            "id": "CWE-200",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "related"
          },
          {
            "id": "A02:2025",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API8:2023",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V14",
            "relation": "primary"
          },
          {
            "id": "V14.2.2",
            "relation": "cites"
          },
          {
            "id": "V14.2.5",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-141",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/edge-defense/cache-poisoning-deception/"
    },
    {
      "type": "Guide",
      "key": "bounded-json-xml-parsing",
      "title": "Parse bounded JSON and XML into an explicit application schema",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-20",
            "relation": "primary"
          },
          {
            "id": "CWE-502",
            "relation": "primary"
          },
          {
            "id": "CWE-611",
            "relation": "primary"
          },
          {
            "id": "CWE-400",
            "relation": "related"
          },
          {
            "id": "CWE-770",
            "relation": "related"
          },
          {
            "id": "CWE-776",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "primary"
          },
          {
            "id": "A02:2025",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API4:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "primary"
          },
          {
            "id": "V2",
            "relation": "primary"
          },
          {
            "id": "V15",
            "relation": "related"
          },
          {
            "id": "V1.5.1",
            "relation": "cites"
          },
          {
            "id": "V1.5.2",
            "relation": "cites"
          },
          {
            "id": "V1.5.3",
            "relation": "cites"
          },
          {
            "id": "V2.2.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/input-handling/bounded-json-xml-parsing/"
    },
    {
      "type": "Guide",
      "key": "saml-verification-boundaries",
      "title": "SAML single sign-on: verify signed assertions without losing the identity boundary",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-347",
            "relation": "primary"
          },
          {
            "id": "CWE-290",
            "relation": "cites"
          },
          {
            "id": "CWE-294",
            "relation": "cites"
          },
          {
            "id": "CWE-611",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "primary"
          },
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A02:2025",
            "relation": "via-cwe",
            "via": "CWE-611"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V6",
            "relation": "primary"
          },
          {
            "id": "V6.8.1",
            "relation": "cites"
          },
          {
            "id": "V6.8.2",
            "relation": "cites"
          },
          {
            "id": "V6.8.3",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/saml-verification-boundaries/"
    },
    {
      "type": "Guide",
      "key": "scim-provisioning-deprovisioning",
      "title": "SCIM deprovisioning: make account disablement remove every usable authority",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-613",
            "relation": "cites"
          },
          {
            "id": "CWE-863",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "related"
          },
          {
            "id": "A07:2025",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V7",
            "relation": "related"
          },
          {
            "id": "V8",
            "relation": "related"
          },
          {
            "id": "V7.4.2",
            "relation": "cites"
          },
          {
            "id": "V8.3.2",
            "relation": "cites"
          },
          {
            "id": "V8.4.1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/scim-provisioning-deprovisioning/"
    },
    {
      "type": "Guide",
      "key": "prototype-pollution-boundaries",
      "title": "Keep untrusted object keys out of prototype and authority paths",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-1321",
            "relation": "primary"
          },
          {
            "id": "CWE-20",
            "relation": "related"
          },
          {
            "id": "CWE-915",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "related"
          },
          {
            "id": "A08:2025",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API3:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V15",
            "relation": "primary"
          },
          {
            "id": "V15.3.3",
            "relation": "cites"
          },
          {
            "id": "V15.3.6",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/prototype-pollution-boundaries/"
    },
    {
      "type": "Guide",
      "key": "android-secure-coding",
      "title": "Harden an Android app's storage, network and entry points",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-295",
            "relation": "related"
          },
          {
            "id": "CWE-312",
            "relation": "cites"
          },
          {
            "id": "CWE-319",
            "relation": "cites"
          },
          {
            "id": "CWE-532",
            "relation": "cites"
          },
          {
            "id": "CWE-749",
            "relation": "cites"
          },
          {
            "id": "CWE-926",
            "relation": "cites"
          },
          {
            "id": "CWE-927",
            "relation": "cites"
          },
          {
            "id": "CWE-939",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-312"
          },
          {
            "id": "A09:2025",
            "relation": "via-cwe",
            "via": "CWE-532"
          }
        ],
        "masvs": [
          {
            "id": "MASVS-AUTH-2",
            "relation": "related"
          },
          {
            "id": "MASVS-AUTH-3",
            "relation": "related"
          },
          {
            "id": "MASVS-CODE-1",
            "relation": "related"
          },
          {
            "id": "MASVS-CODE-4",
            "relation": "related"
          },
          {
            "id": "MASVS-CRYPTO-1",
            "relation": "related"
          },
          {
            "id": "MASVS-CRYPTO-2",
            "relation": "related"
          },
          {
            "id": "MASVS-NETWORK-1",
            "relation": "related"
          },
          {
            "id": "MASVS-NETWORK-2",
            "relation": "related"
          },
          {
            "id": "MASVS-PLATFORM-1",
            "relation": "related"
          },
          {
            "id": "MASVS-PLATFORM-2",
            "relation": "related"
          },
          {
            "id": "MASVS-PLATFORM-3",
            "relation": "related"
          },
          {
            "id": "MASVS-RESILIENCE-1",
            "relation": "related"
          },
          {
            "id": "MASVS-RESILIENCE-2",
            "relation": "related"
          },
          {
            "id": "MASVS-STORAGE-1",
            "relation": "related"
          },
          {
            "id": "MASVS-STORAGE-2",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/android-secure-coding/"
    },
    {
      "type": "Guide",
      "key": "business-logic-flaws",
      "title": "Prevent business-logic flaws with server-side invariants",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-472",
            "relation": "cites"
          },
          {
            "id": "CWE-602",
            "relation": "cites"
          },
          {
            "id": "CWE-640",
            "relation": "cites"
          },
          {
            "id": "CWE-799",
            "relation": "cites"
          },
          {
            "id": "CWE-837",
            "relation": "cites"
          },
          {
            "id": "CWE-839",
            "relation": "cites"
          },
          {
            "id": "CWE-841",
            "relation": "cites"
          },
          {
            "id": "CWE-1284",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "primary"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API6:2023",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V2.2",
            "relation": "cites"
          },
          {
            "id": "V2.3",
            "relation": "cites"
          },
          {
            "id": "V2.4",
            "relation": "cites"
          },
          {
            "id": "V6.4",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-50",
            "relation": "cites"
          },
          {
            "id": "CAPEC-74",
            "relation": "cites"
          },
          {
            "id": "CAPEC-162",
            "relation": "cites"
          },
          {
            "id": "CAPEC-212",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/business-logic/business-logic-flaws/"
    },
    {
      "type": "Guide",
      "key": "case-study-log4shell",
      "title": "Case study: Log4Shell (CVE-2021-44228)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-400",
            "relation": "related"
          },
          {
            "id": "CWE-502",
            "relation": "related"
          },
          {
            "id": "CWE-917",
            "relation": "related"
          },
          {
            "id": "CWE-674",
            "relation": "cites"
          },
          {
            "id": "CWE-1104",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "related"
          },
          {
            "id": "A08:2025",
            "relation": "related"
          },
          {
            "id": "A03:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V1",
            "relation": "cites"
          },
          {
            "id": "V15",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PS.3.2",
            "relation": "mentions"
          },
          {
            "id": "PW.1.1",
            "relation": "mentions"
          },
          {
            "id": "PW.5.1",
            "relation": "mentions"
          },
          {
            "id": "PW.9.1",
            "relation": "mentions"
          },
          {
            "id": "RV.1.1",
            "relation": "mentions"
          },
          {
            "id": "RV.1.3",
            "relation": "mentions"
          },
          {
            "id": "RV.2.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3.3",
            "relation": "mentions"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-137",
            "relation": "cites"
          },
          {
            "id": "CAPEC-242",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/case-study-log4shell/"
    },
    {
      "type": "Guide",
      "key": "crlf-header-log-injection",
      "title": "Prevent CRLF header injection, log forging and CSV formula injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-117",
            "relation": "primary"
          },
          {
            "id": "CWE-93",
            "relation": "cites"
          },
          {
            "id": "CWE-113",
            "relation": "cites"
          },
          {
            "id": "CWE-1236",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "primary"
          },
          {
            "id": "A09:2025",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V1.2",
            "relation": "cites"
          },
          {
            "id": "V4.2",
            "relation": "cites"
          },
          {
            "id": "V16.4",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-34",
            "relation": "cites"
          },
          {
            "id": "CAPEC-81",
            "relation": "cites"
          },
          {
            "id": "CAPEC-93",
            "relation": "cites"
          },
          {
            "id": "CAPEC-105",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/crlf-header-log-injection/"
    },
    {
      "type": "Guide",
      "key": "devsecops-pipeline",
      "title": "Place each security control in the pipeline and decide what it blocks",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-494",
            "relation": "related"
          },
          {
            "id": "CWE-798",
            "relation": "cites"
          },
          {
            "id": "CWE-1104",
            "relation": "cites"
          },
          {
            "id": "CWE-1395",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "related"
          },
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-798"
          }
        ],
        "asvs": [
          {
            "id": "V13.3",
            "relation": "cites"
          },
          {
            "id": "V15.1",
            "relation": "cites"
          },
          {
            "id": "V15.2",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PS.2.1",
            "relation": "mentions"
          },
          {
            "id": "PS.3.2",
            "relation": "mentions"
          },
          {
            "id": "PW.4.4",
            "relation": "mentions"
          },
          {
            "id": "PW.7.2",
            "relation": "mentions"
          },
          {
            "id": "PW.8.2",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/testing/devsecops-pipeline/"
    },
    {
      "type": "Guide",
      "key": "appsec-tool-categories-and-evaluation",
      "title": "Choose and evaluate application security testing tools",
      "domain": "appsec",
      "mappings": {
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V15.1",
            "relation": "cites"
          },
          {
            "id": "V15.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/testing/appsec-tool-categories-and-evaluation/"
    },
    {
      "type": "Guide",
      "key": "dom-xss-postmessage",
      "title": "Prevent DOM XSS, postMessage abuse and client-side injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-79",
            "relation": "related"
          },
          {
            "id": "CWE-95",
            "relation": "cites"
          },
          {
            "id": "CWE-346",
            "relation": "cites"
          },
          {
            "id": "CWE-1336",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "primary"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-346"
          }
        ],
        "asvs": [
          {
            "id": "V1.2",
            "relation": "cites"
          },
          {
            "id": "V1.3",
            "relation": "cites"
          },
          {
            "id": "V3.2",
            "relation": "cites"
          },
          {
            "id": "V3.5",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-63",
            "relation": "cites"
          },
          {
            "id": "CAPEC-588",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/browser-security/dom-xss-postmessage/"
    },
    {
      "type": "Guide",
      "key": "ios-secure-coding",
      "title": "Harden an iOS app's storage, network and entry points",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-295",
            "relation": "related"
          },
          {
            "id": "CWE-312",
            "relation": "cites"
          },
          {
            "id": "CWE-319",
            "relation": "cites"
          },
          {
            "id": "CWE-532",
            "relation": "cites"
          },
          {
            "id": "CWE-602",
            "relation": "cites"
          },
          {
            "id": "CWE-749",
            "relation": "cites"
          },
          {
            "id": "CWE-939",
            "relation": "cites"
          },
          {
            "id": "CWE-940",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          },
          {
            "id": "A09:2025",
            "relation": "via-cwe",
            "via": "CWE-532"
          }
        ],
        "masvs": [
          {
            "id": "MASVS-AUTH-2",
            "relation": "related"
          },
          {
            "id": "MASVS-AUTH-3",
            "relation": "related"
          },
          {
            "id": "MASVS-CODE-4",
            "relation": "related"
          },
          {
            "id": "MASVS-CRYPTO-1",
            "relation": "related"
          },
          {
            "id": "MASVS-CRYPTO-2",
            "relation": "related"
          },
          {
            "id": "MASVS-NETWORK-1",
            "relation": "related"
          },
          {
            "id": "MASVS-NETWORK-2",
            "relation": "related"
          },
          {
            "id": "MASVS-PLATFORM-1",
            "relation": "related"
          },
          {
            "id": "MASVS-PLATFORM-2",
            "relation": "related"
          },
          {
            "id": "MASVS-PLATFORM-3",
            "relation": "related"
          },
          {
            "id": "MASVS-PRIVACY-1",
            "relation": "related"
          },
          {
            "id": "MASVS-PRIVACY-3",
            "relation": "related"
          },
          {
            "id": "MASVS-RESILIENCE-1",
            "relation": "related"
          },
          {
            "id": "MASVS-RESILIENCE-2",
            "relation": "related"
          },
          {
            "id": "MASVS-STORAGE-1",
            "relation": "related"
          },
          {
            "id": "MASVS-STORAGE-2",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/ios-secure-coding/"
    },
    {
      "type": "Guide",
      "key": "memory-safety-c-cpp",
      "title": "Find, fix and contain memory-safety bugs in C and C++",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-120",
            "relation": "primary"
          },
          {
            "id": "CWE-121",
            "relation": "primary"
          },
          {
            "id": "CWE-122",
            "relation": "primary"
          },
          {
            "id": "CWE-125",
            "relation": "primary"
          },
          {
            "id": "CWE-416",
            "relation": "primary"
          },
          {
            "id": "CWE-476",
            "relation": "primary"
          },
          {
            "id": "CWE-787",
            "relation": "primary"
          },
          {
            "id": "CWE-190",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A10:2025",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V1.4",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-92",
            "relation": "cites"
          },
          {
            "id": "CAPEC-100",
            "relation": "cites"
          },
          {
            "id": "CAPEC-540",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/memory-safety-c-cpp/"
    },
    {
      "type": "Guide",
      "key": "nosql-ldap-xpath-injection",
      "title": "Prevent NoSQL, LDAP, XPath and expression-language injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-917",
            "relation": "related"
          },
          {
            "id": "CWE-90",
            "relation": "cites"
          },
          {
            "id": "CWE-643",
            "relation": "cites"
          },
          {
            "id": "CWE-943",
            "relation": "cites"
          },
          {
            "id": "CWE-1287",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V1.2",
            "relation": "cites"
          },
          {
            "id": "V1.3",
            "relation": "cites"
          },
          {
            "id": "V15.3",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-83",
            "relation": "cites"
          },
          {
            "id": "CAPEC-136",
            "relation": "cites"
          },
          {
            "id": "CAPEC-676",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/nosql-ldap-xpath-injection/"
    },
    {
      "type": "Guide",
      "key": "open-redirect",
      "title": "Redirect users only to destinations you control",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-601",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V3",
            "relation": "cites"
          },
          {
            "id": "V10",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/open-redirect/"
    },
    {
      "type": "Guide",
      "key": "redos-input-validation",
      "title": "Validate input safely and prevent regex denial of service",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-20",
            "relation": "related"
          },
          {
            "id": "CWE-180",
            "relation": "cites"
          },
          {
            "id": "CWE-235",
            "relation": "cites"
          },
          {
            "id": "CWE-777",
            "relation": "cites"
          },
          {
            "id": "CWE-1287",
            "relation": "cites"
          },
          {
            "id": "CWE-1333",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "related"
          },
          {
            "id": "A10:2025",
            "relation": "via-cwe",
            "via": "CWE-235"
          }
        ],
        "api": [
          {
            "id": "API4:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V1.1",
            "relation": "cites"
          },
          {
            "id": "V1.2",
            "relation": "cites"
          },
          {
            "id": "V1.3",
            "relation": "cites"
          },
          {
            "id": "V2.2",
            "relation": "cites"
          },
          {
            "id": "V15.3",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-71",
            "relation": "cites"
          },
          {
            "id": "CAPEC-267",
            "relation": "cites"
          },
          {
            "id": "CAPEC-460",
            "relation": "cites"
          },
          {
            "id": "CAPEC-492",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/input-handling/redos-input-validation/"
    },
    {
      "type": "Guide",
      "key": "rust-unsafe-ffi",
      "title": "Audit unsafe Rust, FFI boundaries and crate dependencies",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-416",
            "relation": "related"
          },
          {
            "id": "CWE-1357",
            "relation": "related"
          },
          {
            "id": "CWE-190",
            "relation": "cites"
          },
          {
            "id": "CWE-617",
            "relation": "cites"
          },
          {
            "id": "CWE-758",
            "relation": "cites"
          },
          {
            "id": "CWE-762",
            "relation": "cites"
          },
          {
            "id": "CWE-1395",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A10:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V1.4",
            "relation": "cites"
          },
          {
            "id": "V15.1",
            "relation": "cites"
          },
          {
            "id": "V15.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-100",
            "relation": "cites"
          },
          {
            "id": "CAPEC-538",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/rust-unsafe-ffi/"
    },
    {
      "type": "Guide",
      "key": "security-headers",
      "title": "Configure HTTP security headers from a tested baseline",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-614",
            "relation": "related"
          },
          {
            "id": "CWE-1004",
            "relation": "related"
          },
          {
            "id": "CWE-319",
            "relation": "cites"
          },
          {
            "id": "CWE-1021",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "primary"
          },
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API8:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V3",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-102",
            "relation": "cites"
          },
          {
            "id": "CAPEC-103",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/browser-security/security-headers/"
    },
    {
      "type": "Guide",
      "key": "threat-modeling-methods",
      "title": "Choose a threat modeling method and turn its findings into tests",
      "domain": "appsec",
      "mappings": {
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "primary"
          }
        ],
        "ssdf": [
          {
            "id": "PW.1.1",
            "relation": "mentions"
          },
          {
            "id": "PW.1.2",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/threat-modeling-methods/"
    },
    {
      "type": "Guide",
      "key": "vdp-bug-bounty-pentest",
      "title": "Start with a VDP, then add bug bounties and penetration tests",
      "domain": "appsec",
      "mappings": {},
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/vdp-bug-bounty-pentest/"
    },
    {
      "type": "Guide",
      "key": "case-study-shai-hulud",
      "title": "Case study: the Shai-Hulud npm worm (2025-2026)",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-506",
            "relation": "primary"
          },
          {
            "id": "CWE-829",
            "relation": "related"
          },
          {
            "id": "CWE-522",
            "relation": "cites"
          },
          {
            "id": "CWE-1357",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-522"
          }
        ],
        "asvs": [
          {
            "id": "V13.3",
            "relation": "cites"
          },
          {
            "id": "V15.2",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.3.2",
            "relation": "mentions"
          },
          {
            "id": "PO.5.1",
            "relation": "mentions"
          },
          {
            "id": "PO.5.2",
            "relation": "mentions"
          },
          {
            "id": "PS.1.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4.4",
            "relation": "mentions"
          },
          {
            "id": "RV.1.1",
            "relation": "mentions"
          },
          {
            "id": "RV.2.2",
            "relation": "mentions"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-511",
            "relation": "cites"
          },
          {
            "id": "CAPEC-538",
            "relation": "cites"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-3",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/case-study-shai-hulud/"
    },
    {
      "type": "Guide",
      "key": "case-study-tj-actions",
      "title": "Case study: the tj-actions/changed-files compromise (CVE-2025-30066)",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-506",
            "relation": "primary"
          },
          {
            "id": "CWE-494",
            "relation": "related"
          },
          {
            "id": "CWE-532",
            "relation": "related"
          },
          {
            "id": "CWE-829",
            "relation": "related"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          },
          {
            "id": "A09:2025",
            "relation": "via-cwe",
            "via": "CWE-532"
          }
        ],
        "asvs": [
          {
            "id": "V13.3",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.3.2",
            "relation": "mentions"
          },
          {
            "id": "PO.5.1",
            "relation": "mentions"
          },
          {
            "id": "PS.1.1",
            "relation": "mentions"
          },
          {
            "id": "PS.2.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4.4",
            "relation": "mentions"
          },
          {
            "id": "RV.2.2",
            "relation": "mentions"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-439",
            "relation": "cites"
          },
          {
            "id": "CAPEC-538",
            "relation": "cites"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-4",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-6",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-8",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-10",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/case-study-tj-actions/"
    },
    {
      "type": "Guide",
      "key": "case-study-xz-utils",
      "title": "Case study: the xz Utils backdoor (CVE-2024-3094)",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-506",
            "relation": "primary"
          },
          {
            "id": "CWE-494",
            "relation": "related"
          },
          {
            "id": "CWE-1357",
            "relation": "related"
          },
          {
            "id": "CWE-912",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V15",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.3.2",
            "relation": "mentions"
          },
          {
            "id": "PS.1.1",
            "relation": "mentions"
          },
          {
            "id": "PS.2.1",
            "relation": "mentions"
          },
          {
            "id": "PS.3.2",
            "relation": "mentions"
          },
          {
            "id": "PW.4.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4.4",
            "relation": "mentions"
          },
          {
            "id": "PW.7.2",
            "relation": "mentions"
          },
          {
            "id": "RV.1.1",
            "relation": "mentions"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-444",
            "relation": "cites"
          },
          {
            "id": "CAPEC-538",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/case-study-xz-utils/"
    },
    {
      "type": "Guide",
      "key": "case-study-solarwinds",
      "title": "Case study: the SolarWinds Orion build compromise (SUNBURST)",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-506",
            "relation": "cites"
          },
          {
            "id": "CWE-912",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.5",
            "relation": "mentions"
          },
          {
            "id": "PS.2",
            "relation": "mentions"
          },
          {
            "id": "PW.6",
            "relation": "mentions"
          },
          {
            "id": "RV.1",
            "relation": "mentions"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-206",
            "relation": "cites"
          },
          {
            "id": "CAPEC-444",
            "relation": "cites"
          },
          {
            "id": "CAPEC-511",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/builds/case-study-solarwinds/"
    },
    {
      "type": "Guide",
      "key": "case-study-codecov",
      "title": "Case study: the Codecov Bash Uploader compromise (2021)",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-494",
            "relation": "cites"
          },
          {
            "id": "CWE-506",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.3",
            "relation": "mentions"
          },
          {
            "id": "PO.5",
            "relation": "mentions"
          },
          {
            "id": "PS.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4",
            "relation": "mentions"
          },
          {
            "id": "RV.2",
            "relation": "mentions"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-439",
            "relation": "cites"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-5",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-8",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-9",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/case-study-codecov/"
    },
    {
      "type": "Guide",
      "key": "case-study-3cx",
      "title": "Case study: the 3CX DesktopApp supply-chain attack (CVE-2023-29059)",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-506",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.5",
            "relation": "mentions"
          },
          {
            "id": "PS.2",
            "relation": "mentions"
          },
          {
            "id": "PW.4",
            "relation": "mentions"
          },
          {
            "id": "PW.6",
            "relation": "mentions"
          },
          {
            "id": "RV.1",
            "relation": "mentions"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-206",
            "relation": "cites"
          },
          {
            "id": "CAPEC-444",
            "relation": "cites"
          },
          {
            "id": "CAPEC-511",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/builds/case-study-3cx/"
    },
    {
      "type": "Guide",
      "key": "case-study-event-stream",
      "title": "Case study: event-stream and ua-parser-js, two npm package takeovers",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-506",
            "relation": "cites"
          },
          {
            "id": "CWE-829",
            "relation": "cites"
          },
          {
            "id": "CWE-1357",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.5",
            "relation": "mentions"
          },
          {
            "id": "PS.1",
            "relation": "mentions"
          },
          {
            "id": "PS.2",
            "relation": "mentions"
          },
          {
            "id": "PW.4",
            "relation": "mentions"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-538",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/case-study-event-stream/"
    },
    {
      "type": "Guide",
      "key": "case-study-polyfill-io",
      "title": "Case study: the polyfill.io CDN takeover (2024)",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-494",
            "relation": "cites"
          },
          {
            "id": "CWE-829",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PW.4",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/case-study-polyfill-io/"
    },
    {
      "type": "Guide",
      "key": "case-study-moveit",
      "title": "Case study: MOVEit Transfer mass exploitation (CVE-2023-34362)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-89",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PW.5",
            "relation": "mentions"
          },
          {
            "id": "PW.7",
            "relation": "mentions"
          },
          {
            "id": "PW.8",
            "relation": "mentions"
          },
          {
            "id": "RV.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3",
            "relation": "mentions"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-66",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/case-study-moveit/"
    },
    {
      "type": "Guide",
      "key": "dependency-confusion",
      "title": "Stop dependency confusion and typosquatting at install time",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-494",
            "relation": "related"
          },
          {
            "id": "CWE-829",
            "relation": "related"
          },
          {
            "id": "CWE-1357",
            "relation": "related"
          },
          {
            "id": "CWE-427",
            "relation": "cites"
          },
          {
            "id": "CWE-1104",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V15.1.2",
            "relation": "cites"
          },
          {
            "id": "V15.2.4",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM04:2026",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-471",
            "relation": "cites"
          },
          {
            "id": "CAPEC-538",
            "relation": "cites"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-3",
            "relation": "primary"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/dependency-confusion/"
    },
    {
      "type": "Guide",
      "key": "github-actions-hardening",
      "title": "Harden GitHub Actions against workflow and supply-chain attacks",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-94",
            "relation": "related"
          },
          {
            "id": "CWE-829",
            "relation": "related"
          },
          {
            "id": "CWE-95",
            "relation": "cites"
          },
          {
            "id": "CWE-116",
            "relation": "cites"
          },
          {
            "id": "CWE-275",
            "relation": "cites"
          },
          {
            "id": "CWE-349",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "primary"
          },
          {
            "id": "A05:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V1.2.5",
            "relation": "cites"
          },
          {
            "id": "V13.3.1",
            "relation": "cites"
          },
          {
            "id": "V13.3.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-88",
            "relation": "cites"
          },
          {
            "id": "CAPEC-538",
            "relation": "cites"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-4",
            "relation": "primary"
          },
          {
            "id": "CICD-SEC-1",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-5",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-6",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-7",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-8",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/github-actions-hardening/"
    },
    {
      "type": "Guide",
      "key": "source-repository-protection",
      "title": "Protect the source repository: rulesets, reviews and signed commits",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-284",
            "relation": "cites"
          },
          {
            "id": "CWE-1357",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-284"
          }
        ],
        "asvs": [
          {
            "id": "V15",
            "relation": "cites"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-1",
            "relation": "primary"
          },
          {
            "id": "CICD-SEC-2",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-6",
            "relation": "related"
          },
          {
            "id": "CICD-SEC-9",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/source-repository-protection/"
    },
    {
      "type": "Guide",
      "key": "developer-workstation-security",
      "title": "Secure the developer workstation: extensions, package managers, secrets and AI agents",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-506",
            "relation": "cites"
          },
          {
            "id": "CWE-522",
            "relation": "cites"
          },
          {
            "id": "CWE-829",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-522"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-3",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/developer-workstation-security/"
    },
    {
      "type": "Guide",
      "key": "open-source-license-compliance",
      "title": "Open source license compliance: SPDX expressions, obligations and SBOM checks",
      "domain": "supply-chain",
      "mappings": {},
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/open-source-license-compliance/"
    },
    {
      "type": "Guide",
      "key": "cloud-provider-baselines",
      "title": "Apply a security baseline across AWS, Azure and Google Cloud",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-918",
            "relation": "related"
          },
          {
            "id": "CWE-732",
            "relation": "cites"
          },
          {
            "id": "CWE-778",
            "relation": "cites"
          },
          {
            "id": "CWE-798",
            "relation": "cites"
          },
          {
            "id": "CWE-1188",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          },
          {
            "id": "A09:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V13.2",
            "relation": "cites"
          },
          {
            "id": "V13.3",
            "relation": "cites"
          },
          {
            "id": "V16.4",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-560",
            "relation": "cites"
          },
          {
            "id": "CAPEC-664",
            "relation": "cites"
          }
        ],
        "k8s": [
          {
            "id": "K08:2025",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/cloud-provider-baselines/"
    },
    {
      "type": "Guide",
      "key": "runtime-threat-detection",
      "title": "Detect container and host threats at runtime with eBPF sensors and cloud services",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-778",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A09:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V16",
            "relation": "cites"
          }
        ],
        "k8s": [
          {
            "id": "K08:2025",
            "relation": "related"
          },
          {
            "id": "K10:2025",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/detection/runtime-threat-detection/"
    },
    {
      "type": "Guide",
      "key": "managed-kubernetes-hardening",
      "title": "Harden managed Kubernetes on EKS, AKS and GKE",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-250",
            "relation": "cites"
          },
          {
            "id": "CWE-269",
            "relation": "cites"
          },
          {
            "id": "CWE-284",
            "relation": "cites"
          },
          {
            "id": "CWE-1188",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-269"
          }
        ],
        "asvs": [
          {
            "id": "V13",
            "relation": "cites"
          }
        ],
        "k8s": [
          {
            "id": "K07:2025",
            "relation": "primary"
          },
          {
            "id": "K01:2025",
            "relation": "related"
          },
          {
            "id": "K02:2025",
            "relation": "related"
          },
          {
            "id": "K04:2025",
            "relation": "related"
          },
          {
            "id": "K06:2025",
            "relation": "related"
          },
          {
            "id": "K08:2025",
            "relation": "related"
          },
          {
            "id": "K09:2025",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/containers/managed-kubernetes-hardening/"
    },
    {
      "type": "Guide",
      "key": "l7-ddos-resilience",
      "title": "Keep HTTP services up under application-layer DDoS",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-400",
            "relation": "cites"
          },
          {
            "id": "CWE-770",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API4:2023",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-469",
            "relation": "cites"
          },
          {
            "id": "CAPEC-488",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/availability/l7-ddos-resilience/"
    },
    {
      "type": "Guide",
      "key": "cloud-security-posture",
      "title": "Choose cloud security posture tools and apply zero trust",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-250",
            "relation": "cites"
          },
          {
            "id": "CWE-732",
            "relation": "cites"
          },
          {
            "id": "CWE-1188",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A02:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/cloud-security-posture/"
    },
    {
      "type": "Guide",
      "key": "container-image-hardening",
      "title": "Harden container images from Dockerfile to admission",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-250",
            "relation": "related"
          },
          {
            "id": "CWE-494",
            "relation": "related"
          },
          {
            "id": "CWE-538",
            "relation": "cites"
          },
          {
            "id": "CWE-1395",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "related"
          },
          {
            "id": "A03:2025",
            "relation": "related"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-538"
          }
        ],
        "asvs": [
          {
            "id": "V13",
            "relation": "cites"
          },
          {
            "id": "V15",
            "relation": "cites"
          }
        ],
        "k8s": [
          {
            "id": "K01:2025",
            "relation": "related"
          },
          {
            "id": "K03:2025",
            "relation": "related"
          },
          {
            "id": "K04:2025",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/containers/container-image-hardening/"
    },
    {
      "type": "Guide",
      "key": "image-hardening-benchmarks",
      "title": "Harden the images you ship against CIS, STIG and SCAP benchmarks",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-1188",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "cites"
          }
        ],
        "k8s": [
          {
            "id": "K07:2025",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/containers/image-hardening-benchmarks/"
    },
    {
      "type": "Guide",
      "key": "osps-baseline-maintainers",
      "title": "Meet the OpenSSF OSPS Baseline as a maintainer: the levels, every Level 1 control on GitHub, and the evidence",
      "domain": "supply-chain",
      "mappings": {
        "cicd": [
          {
            "id": "CICD-SEC-1",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/ci-cd/osps-baseline-for-maintainers/"
    },
    {
      "type": "Guide",
      "key": "s2c2f-consumer-adoption",
      "title": "Adopt the OpenSSF S2C2F as a consumer: the eight practices, the four maturity levels and a staged plan with evidence",
      "domain": "supply-chain",
      "mappings": {
        "ssdf": [
          {
            "id": "PO.5.2",
            "relation": "mentions"
          },
          {
            "id": "PW.4.1",
            "relation": "mentions"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-3",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/dependencies/s2c2f-adoption/"
    },
    {
      "type": "Guide",
      "key": "crypto-quick-reference",
      "title": "Choose cryptographic algorithms and parameters by job",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-327",
            "relation": "related"
          },
          {
            "id": "CWE-347",
            "relation": "related"
          },
          {
            "id": "CWE-916",
            "relation": "related"
          },
          {
            "id": "CWE-323",
            "relation": "cites"
          },
          {
            "id": "CWE-326",
            "relation": "cites"
          },
          {
            "id": "CWE-328",
            "relation": "cites"
          },
          {
            "id": "CWE-338",
            "relation": "cites"
          },
          {
            "id": "CWE-757",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V11.2",
            "relation": "cites"
          },
          {
            "id": "V11.3",
            "relation": "cites"
          },
          {
            "id": "V11.4",
            "relation": "cites"
          },
          {
            "id": "V11.5",
            "relation": "cites"
          },
          {
            "id": "V11.6",
            "relation": "cites"
          },
          {
            "id": "V12.1",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-20",
            "relation": "cites"
          },
          {
            "id": "CAPEC-55",
            "relation": "cites"
          },
          {
            "id": "CAPEC-97",
            "relation": "cites"
          },
          {
            "id": "CAPEC-463",
            "relation": "cites"
          },
          {
            "id": "CAPEC-620",
            "relation": "cites"
          }
        ],
        "masvs": [
          {
            "id": "MASVS-CRYPTO-1",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/encryption/crypto-quick-reference/"
    },
    {
      "type": "Guide",
      "key": "jwt-attacks",
      "title": "Defend JWTs against forgery, confusion and replay",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-347",
            "relation": "related"
          },
          {
            "id": "CWE-287",
            "relation": "cites"
          },
          {
            "id": "CWE-290",
            "relation": "cites"
          },
          {
            "id": "CWE-326",
            "relation": "cites"
          },
          {
            "id": "CWE-613",
            "relation": "cites"
          },
          {
            "id": "CWE-918",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A04:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "primary"
          }
        ],
        "asvs": [
          {
            "id": "V7",
            "relation": "cites"
          },
          {
            "id": "V9",
            "relation": "cites"
          },
          {
            "id": "V10",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-196",
            "relation": "cites"
          },
          {
            "id": "CAPEC-475",
            "relation": "cites"
          },
          {
            "id": "CAPEC-593",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/jwt-attacks/"
    },
    {
      "type": "Guide",
      "key": "leaked-secret-response",
      "title": "Contain a leaked secret, then investigate and clean up",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-532",
            "relation": "related"
          },
          {
            "id": "CWE-321",
            "relation": "cites"
          },
          {
            "id": "CWE-522",
            "relation": "cites"
          },
          {
            "id": "CWE-540",
            "relation": "cites"
          },
          {
            "id": "CWE-798",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "related"
          },
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-540"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-522"
          },
          {
            "id": "A09:2025",
            "relation": "via-cwe",
            "via": "CWE-532"
          }
        ],
        "asvs": [
          {
            "id": "V13.2",
            "relation": "cites"
          },
          {
            "id": "V13.3",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-37",
            "relation": "cites"
          },
          {
            "id": "CAPEC-191",
            "relation": "cites"
          },
          {
            "id": "CAPEC-560",
            "relation": "cites"
          }
        ],
        "cicd": [
          {
            "id": "CICD-SEC-6",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/secrets/leaked-secret-response/"
    },
    {
      "type": "Guide",
      "key": "mfa-account-takeover",
      "title": "Stop account takeover with the right MFA and login defenses",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-204",
            "relation": "cites"
          },
          {
            "id": "CWE-208",
            "relation": "cites"
          },
          {
            "id": "CWE-294",
            "relation": "cites"
          },
          {
            "id": "CWE-307",
            "relation": "cites"
          },
          {
            "id": "CWE-308",
            "relation": "cites"
          },
          {
            "id": "CWE-521",
            "relation": "cites"
          },
          {
            "id": "CWE-640",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "primary"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V2.4",
            "relation": "cites"
          },
          {
            "id": "V6.2",
            "relation": "cites"
          },
          {
            "id": "V6.3",
            "relation": "cites"
          },
          {
            "id": "V6.4",
            "relation": "cites"
          },
          {
            "id": "V6.5",
            "relation": "cites"
          },
          {
            "id": "V6.6",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-49",
            "relation": "cites"
          },
          {
            "id": "CAPEC-94",
            "relation": "cites"
          },
          {
            "id": "CAPEC-565",
            "relation": "cites"
          },
          {
            "id": "CAPEC-575",
            "relation": "cites"
          },
          {
            "id": "CAPEC-600",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/mfa-account-takeover/"
    },
    {
      "type": "Guide",
      "key": "oauth-oidc-attacks",
      "title": "Defend OAuth and OIDC against redirect and token attacks",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-352",
            "relation": "related"
          },
          {
            "id": "CWE-287",
            "relation": "cites"
          },
          {
            "id": "CWE-294",
            "relation": "cites"
          },
          {
            "id": "CWE-346",
            "relation": "cites"
          },
          {
            "id": "CWE-601",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "related"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V3",
            "relation": "cites"
          },
          {
            "id": "V7",
            "relation": "cites"
          },
          {
            "id": "V10",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-62",
            "relation": "cites"
          },
          {
            "id": "CAPEC-593",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/oauth-oidc-attacks/"
    },
    {
      "type": "Guide",
      "key": "appsec-metrics-and-slas",
      "title": "Set remediation SLAs and measure AppSec outcomes",
      "domain": "governance",
      "mappings": {
        "asvs": [
          {
            "id": "V15",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.4.1",
            "relation": "mentions"
          },
          {
            "id": "RV.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3",
            "relation": "mentions"
          },
          {
            "id": "RV.3.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3.3",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/appsec-metrics-and-slas/"
    },
    {
      "type": "Guide",
      "key": "cra-reporting-runbook",
      "title": "Build a runbook for CRA vulnerability and incident reporting",
      "domain": "governance",
      "mappings": {
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/cra-reporting-runbook/"
    },
    {
      "type": "Guide",
      "key": "pci-dss-requirement-6",
      "title": "Map PCI DSS Requirement 6 to engineering practice and evidence",
      "domain": "governance",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-494",
            "relation": "cites"
          },
          {
            "id": "CWE-829",
            "relation": "cites"
          },
          {
            "id": "CWE-1395",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V3.6",
            "relation": "cites"
          },
          {
            "id": "V15.1",
            "relation": "cites"
          },
          {
            "id": "V15.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/pci-dss-requirement-6/"
    },
    {
      "type": "Guide",
      "key": "security-champions-program",
      "title": "Run a security champions program with protected time and outcome metrics",
      "domain": "governance",
      "mappings": {
        "ssdf": [
          {
            "id": "PO.2.1",
            "relation": "mentions"
          },
          {
            "id": "PO.2.2",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/security-champions-program/"
    },
    {
      "type": "Guide",
      "key": "vulnerability-prioritization",
      "title": "Prioritize vulnerabilities by exploitation, exposure and impact",
      "domain": "governance",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-1395",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V15",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/vulnerability-prioritization/"
    },
    {
      "type": "Guide",
      "key": "ai-assisted-development",
      "title": "Secure AI-assisted development with coding assistants and agents",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-829",
            "relation": "related"
          },
          {
            "id": "CWE-250",
            "relation": "cites"
          },
          {
            "id": "CWE-1357",
            "relation": "cites"
          },
          {
            "id": "CWE-1427",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V15",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM01:2026",
            "relation": "cites"
          },
          {
            "id": "LLM02:2026",
            "relation": "cites"
          },
          {
            "id": "LLM03:2026",
            "relation": "cites"
          },
          {
            "id": "LLM04:2026",
            "relation": "cites"
          },
          {
            "id": "LLM07:2026",
            "relation": "cites"
          },
          {
            "id": "LLM10:2026",
            "relation": "cites"
          }
        ],
        "agentic": [
          {
            "id": "ASI04:2026",
            "relation": "related"
          },
          {
            "id": "ASI05:2026",
            "relation": "related"
          },
          {
            "id": "ASI01:2026",
            "relation": "cites"
          },
          {
            "id": "ASI02:2026",
            "relation": "cites"
          },
          {
            "id": "ASI03:2026",
            "relation": "cites"
          },
          {
            "id": "ASI09:2026",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/ai-assisted-development/"
    },
    {
      "type": "Guide",
      "key": "security-requirements-definition-of-done",
      "title": "Write testable security requirements and a security Definition of Done",
      "domain": "appsec",
      "mappings": {
        "asvs": [
          {
            "id": "V2",
            "relation": "cites"
          },
          {
            "id": "V6",
            "relation": "cites"
          },
          {
            "id": "V8",
            "relation": "cites"
          },
          {
            "id": "V16",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.1.2",
            "relation": "mentions"
          },
          {
            "id": "PW.1.2",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/security-requirements-definition-of-done/"
    },
    {
      "type": "Guide",
      "key": "abuse-case-library",
      "title": "Abuse case library: tests and controls by feature",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-22",
            "relation": "cites"
          },
          {
            "id": "CWE-204",
            "relation": "cites"
          },
          {
            "id": "CWE-307",
            "relation": "cites"
          },
          {
            "id": "CWE-345",
            "relation": "cites"
          },
          {
            "id": "CWE-362",
            "relation": "cites"
          },
          {
            "id": "CWE-434",
            "relation": "cites"
          },
          {
            "id": "CWE-639",
            "relation": "cites"
          },
          {
            "id": "CWE-640",
            "relation": "cites"
          },
          {
            "id": "CWE-841",
            "relation": "cites"
          },
          {
            "id": "CWE-862",
            "relation": "cites"
          },
          {
            "id": "CWE-915",
            "relation": "cites"
          },
          {
            "id": "CWE-918",
            "relation": "cites"
          },
          {
            "id": "CWE-1236",
            "relation": "cites"
          },
          {
            "id": "CWE-1427",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "via-cwe",
            "via": "CWE-915"
          }
        ],
        "api": [
          {
            "id": "API1:2023",
            "relation": "cites"
          },
          {
            "id": "API5:2023",
            "relation": "cites"
          },
          {
            "id": "API6:2023",
            "relation": "cites"
          },
          {
            "id": "API7:2023",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM01:2026",
            "relation": "cites"
          },
          {
            "id": "LLM03:2026",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-26",
            "relation": "cites"
          },
          {
            "id": "CAPEC-50",
            "relation": "cites"
          },
          {
            "id": "CAPEC-62",
            "relation": "cites"
          },
          {
            "id": "CAPEC-66",
            "relation": "cites"
          },
          {
            "id": "CAPEC-87",
            "relation": "cites"
          },
          {
            "id": "CAPEC-126",
            "relation": "cites"
          },
          {
            "id": "CAPEC-565",
            "relation": "cites"
          },
          {
            "id": "CAPEC-575",
            "relation": "cites"
          },
          {
            "id": "CAPEC-600",
            "relation": "cites"
          },
          {
            "id": "CAPEC-650",
            "relation": "cites"
          },
          {
            "id": "CAPEC-664",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/abuse-case-library/"
    },
    {
      "type": "Guide",
      "key": "threat-pattern-library",
      "title": "Threat pattern library for threat modeling",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-89",
            "relation": "cites"
          },
          {
            "id": "CWE-290",
            "relation": "cites"
          },
          {
            "id": "CWE-294",
            "relation": "cites"
          },
          {
            "id": "CWE-367",
            "relation": "cites"
          },
          {
            "id": "CWE-436",
            "relation": "cites"
          },
          {
            "id": "CWE-441",
            "relation": "cites"
          },
          {
            "id": "CWE-502",
            "relation": "cites"
          },
          {
            "id": "CWE-532",
            "relation": "cites"
          },
          {
            "id": "CWE-639",
            "relation": "cites"
          },
          {
            "id": "CWE-770",
            "relation": "cites"
          },
          {
            "id": "CWE-829",
            "relation": "cites"
          },
          {
            "id": "CWE-863",
            "relation": "cites"
          },
          {
            "id": "CWE-915",
            "relation": "cites"
          },
          {
            "id": "CWE-918",
            "relation": "cites"
          },
          {
            "id": "CWE-1427",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "cites"
          },
          {
            "id": "A05:2025",
            "relation": "via-cwe",
            "via": "CWE-89"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-290"
          },
          {
            "id": "A08:2025",
            "relation": "via-cwe",
            "via": "CWE-915"
          },
          {
            "id": "A09:2025",
            "relation": "via-cwe",
            "via": "CWE-532"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-1",
            "relation": "cites"
          },
          {
            "id": "CAPEC-21",
            "relation": "cites"
          },
          {
            "id": "CAPEC-29",
            "relation": "cites"
          },
          {
            "id": "CAPEC-33",
            "relation": "cites"
          },
          {
            "id": "CAPEC-66",
            "relation": "cites"
          },
          {
            "id": "CAPEC-130",
            "relation": "cites"
          },
          {
            "id": "CAPEC-141",
            "relation": "cites"
          },
          {
            "id": "CAPEC-538",
            "relation": "cites"
          },
          {
            "id": "CAPEC-586",
            "relation": "cites"
          },
          {
            "id": "CAPEC-664",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/threat-pattern-library/"
    },
    {
      "type": "Guide",
      "key": "secure-by-design-principles",
      "title": "Apply CISA Secure by Design: principles, pledge goals and evidence",
      "domain": "governance",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-78",
            "relation": "cites"
          },
          {
            "id": "CWE-79",
            "relation": "cites"
          },
          {
            "id": "CWE-89",
            "relation": "cites"
          },
          {
            "id": "CWE-798",
            "relation": "cites"
          },
          {
            "id": "CWE-1392",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "via-cwe",
            "via": "CWE-89"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-798"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/secure-by-design/"
    },
    {
      "type": "Guide",
      "key": "choosing-bsimm-samm-ssdf",
      "title": "BSIMM vs SAMM vs SSDF: what each is for and which to use",
      "domain": "governance",
      "mappings": {
        "ssdf": [
          {
            "id": "PO.2.2",
            "relation": "mentions"
          },
          {
            "id": "PW.1.2",
            "relation": "mentions"
          },
          {
            "id": "RV.2.1",
            "relation": "mentions"
          },
          {
            "id": "RV.3.3",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/bsimm-samm-ssdf/"
    },
    {
      "type": "Guide",
      "key": "developer-security-training-program",
      "title": "Run a developer security training program that changes code",
      "domain": "governance",
      "mappings": {
        "ssdf": [
          {
            "id": "PO.2.2",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/developer-security-training/"
    },
    {
      "type": "Guide",
      "key": "psirt-operating-model",
      "title": "Set up a PSIRT: services, intake, triage, SLAs and the CNA role",
      "domain": "appsec",
      "mappings": {
        "ssdf": [
          {
            "id": "RV.1.3",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/psirt-operating-model/"
    },
    {
      "type": "Guide",
      "key": "security-advisories-csaf-vex",
      "title": "Publish security advisories with CSAF, VEX, CVE records and OSV",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-306",
            "relation": "cites"
          },
          {
            "id": "CWE-347",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "via-cwe",
            "via": "CWE-347"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-306"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/security-advisories-csaf-vex/"
    },
    {
      "type": "Guide",
      "key": "product-incident-response",
      "title": "Respond to product security incidents: plan, tabletop and postmortem",
      "domain": "appsec",
      "mappings": {},
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/product-incident-response/"
    },
    {
      "type": "Guide",
      "key": "appsec-careers",
      "title": "Build an application security career: roles, skills, portfolio and certifications",
      "domain": "governance",
      "mappings": {},
      "url": "https://softwaresecurity.com/frameworks/appsec-careers/"
    },
    {
      "type": "Guide",
      "key": "soc2-for-engineering-teams",
      "title": "SOC 2 for engineering teams: CC6, CC7 and CC8 controls and the evidence auditors test",
      "domain": "governance",
      "mappings": {},
      "url": "https://softwaresecurity.com/frameworks/soc2-for-engineering-teams/"
    },
    {
      "type": "Guide",
      "key": "iso-27001-secure-development",
      "title": "ISO 27001 secure development: Annex A 8.25 to 8.33 as engineering practice and evidence",
      "domain": "governance",
      "mappings": {},
      "url": "https://softwaresecurity.com/frameworks/iso-27001-secure-development/"
    },
    {
      "type": "Guide",
      "key": "nist-csf-2-for-product-teams",
      "title": "NIST CSF 2.0 for product teams: the outcomes you own and the evidence for them",
      "domain": "governance",
      "mappings": {
        "ssdf": [
          {
            "id": "PO.1.1",
            "relation": "mentions"
          },
          {
            "id": "PO.1.2",
            "relation": "mentions"
          },
          {
            "id": "PO.1.3",
            "relation": "mentions"
          },
          {
            "id": "PO.5.1",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/nist-csf-2-for-product-teams/"
    },
    {
      "type": "Guide",
      "key": "gdpr-privacy-by-design-engineering",
      "title": "GDPR privacy by design for engineers: Articles 25, 32 and 35 in code",
      "domain": "governance",
      "mappings": {
        "asvs": [
          {
            "id": "V14",
            "relation": "cites"
          }
        ],
        "masvs": [
          {
            "id": "MASVS-PRIVACY-1",
            "relation": "related"
          },
          {
            "id": "MASVS-PRIVACY-4",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/gdpr-privacy-by-design-engineering/"
    },
    {
      "type": "Guide",
      "key": "nis2-dora-for-software-suppliers",
      "title": "NIS2 and DORA for software suppliers: what reaches you and the evidence to keep",
      "domain": "governance",
      "mappings": {},
      "url": "https://softwaresecurity.com/frameworks/nis2-dora-for-software-suppliers/"
    },
    {
      "type": "Guide",
      "key": "uk-software-security-code-of-practice",
      "title": "UK Software Security Code of Practice: the 14 principles as engineering practice",
      "domain": "governance",
      "mappings": {
        "ssdf": [
          {
            "id": "PO.1",
            "relation": "mentions"
          },
          {
            "id": "PO.3.2",
            "relation": "mentions"
          },
          {
            "id": "PO.5",
            "relation": "mentions"
          },
          {
            "id": "PO.5.1",
            "relation": "mentions"
          },
          {
            "id": "PS.1.1",
            "relation": "mentions"
          },
          {
            "id": "PS.2.1",
            "relation": "mentions"
          },
          {
            "id": "PS.3.1",
            "relation": "mentions"
          },
          {
            "id": "PS.3.2",
            "relation": "mentions"
          },
          {
            "id": "PW.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4.4",
            "relation": "mentions"
          },
          {
            "id": "PW.7",
            "relation": "mentions"
          },
          {
            "id": "PW.8",
            "relation": "mentions"
          },
          {
            "id": "PW.9",
            "relation": "mentions"
          },
          {
            "id": "RV.1.1",
            "relation": "mentions"
          },
          {
            "id": "RV.1.3",
            "relation": "mentions"
          },
          {
            "id": "RV.2",
            "relation": "mentions"
          },
          {
            "id": "RV.2.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/uk-software-security-code-of-practice/"
    },
    {
      "type": "Guide",
      "key": "regulated-product-security-lifecycle",
      "title": "Regulated product security lifecycles: IEC 62443-4-1, FDA 524B, ISO/SAE 21434 and UN R155/R156",
      "domain": "governance",
      "mappings": {},
      "url": "https://softwaresecurity.com/frameworks/regulated-product-security-lifecycle/"
    },
    {
      "type": "Guide",
      "key": "compliance-evidence-reuse",
      "title": "Compliance evidence reuse: one evidence set for SSDF, PCI DSS, ISO 27001, SOC 2 and the CRA",
      "domain": "governance",
      "mappings": {
        "ssdf": [
          {
            "id": "PS.2.1",
            "relation": "mentions"
          },
          {
            "id": "PS.3.1",
            "relation": "mentions"
          },
          {
            "id": "PS.3.2",
            "relation": "mentions"
          },
          {
            "id": "PW.7.2",
            "relation": "mentions"
          },
          {
            "id": "PW.8.2",
            "relation": "mentions"
          },
          {
            "id": "RV.1",
            "relation": "mentions"
          },
          {
            "id": "RV.1.2",
            "relation": "mentions"
          },
          {
            "id": "RV.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/compliance-evidence-reuse/"
    },
    {
      "type": "Guide",
      "key": "federal-software-attestation",
      "title": "Answer a US federal secure software attestation request in 2026: the CISA form, its SSDF mapping and the evidence behind each statement",
      "domain": "governance",
      "mappings": {
        "ssdf": [
          {
            "id": "PO.1.1",
            "relation": "mentions"
          },
          {
            "id": "PO.1.3",
            "relation": "mentions"
          },
          {
            "id": "PO.3.1",
            "relation": "mentions"
          },
          {
            "id": "PO.3.2",
            "relation": "mentions"
          },
          {
            "id": "PO.3.3",
            "relation": "mentions"
          },
          {
            "id": "PO.4",
            "relation": "mentions"
          },
          {
            "id": "PO.4.1",
            "relation": "mentions"
          },
          {
            "id": "PO.4.2",
            "relation": "mentions"
          },
          {
            "id": "PO.5.1",
            "relation": "mentions"
          },
          {
            "id": "PO.5.2",
            "relation": "mentions"
          },
          {
            "id": "PS.1.1",
            "relation": "mentions"
          },
          {
            "id": "PS.2.1",
            "relation": "mentions"
          },
          {
            "id": "PS.3.1",
            "relation": "mentions"
          },
          {
            "id": "PS.3.2",
            "relation": "mentions"
          },
          {
            "id": "PW.2.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4.4",
            "relation": "mentions"
          },
          {
            "id": "PW.5.1",
            "relation": "mentions"
          },
          {
            "id": "PW.6.1",
            "relation": "mentions"
          },
          {
            "id": "PW.6.2",
            "relation": "mentions"
          },
          {
            "id": "PW.7.1",
            "relation": "mentions"
          },
          {
            "id": "PW.7.2",
            "relation": "mentions"
          },
          {
            "id": "PW.8.1",
            "relation": "mentions"
          },
          {
            "id": "PW.8.2",
            "relation": "mentions"
          },
          {
            "id": "PW.9.1",
            "relation": "mentions"
          },
          {
            "id": "PW.9.2",
            "relation": "mentions"
          },
          {
            "id": "RV.1.1",
            "relation": "mentions"
          },
          {
            "id": "RV.1.2",
            "relation": "mentions"
          },
          {
            "id": "RV.1.3",
            "relation": "mentions"
          },
          {
            "id": "RV.2.1",
            "relation": "mentions"
          },
          {
            "id": "RV.2.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3.3",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/frameworks/secure-software-attestation-form/"
    },
    {
      "type": "Guide",
      "key": "secrets-in-kubernetes-and-runtime",
      "title": "Secrets at runtime: Vault, Kubernetes Secrets, CSI driver, External Secrets and SOPS",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-312",
            "relation": "cites"
          },
          {
            "id": "CWE-522",
            "relation": "cites"
          },
          {
            "id": "CWE-732",
            "relation": "cites"
          },
          {
            "id": "CWE-798",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-732"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-522"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-798"
          }
        ],
        "asvs": [
          {
            "id": "V13.2.1",
            "relation": "cites"
          },
          {
            "id": "V13.3.1",
            "relation": "cites"
          },
          {
            "id": "V13.3.2",
            "relation": "cites"
          },
          {
            "id": "V13.3.4",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-37",
            "relation": "cites"
          },
          {
            "id": "CAPEC-560",
            "relation": "cites"
          }
        ],
        "k8s": [
          {
            "id": "K03:2025",
            "relation": "primary"
          },
          {
            "id": "K02:2025",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/secrets/secrets-in-kubernetes-and-runtime/"
    },
    {
      "type": "Guide",
      "key": "case-study-lastpass-2022",
      "title": "Case study: the LastPass breach (2022)",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-311",
            "relation": "cites"
          },
          {
            "id": "CWE-522",
            "relation": "cites"
          },
          {
            "id": "CWE-916",
            "relation": "cites"
          },
          {
            "id": "CWE-1104",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          },
          {
            "id": "A03:2025",
            "relation": "via-cwe",
            "via": "CWE-1104"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-522"
          }
        ],
        "asvs": [
          {
            "id": "V11.4.2",
            "relation": "cites"
          },
          {
            "id": "V13.3.1",
            "relation": "cites"
          },
          {
            "id": "V13.3.2",
            "relation": "cites"
          },
          {
            "id": "V14.2.4",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-55",
            "relation": "cites"
          },
          {
            "id": "CAPEC-568",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/secrets/case-study-lastpass-2022/"
    },
    {
      "type": "Guide",
      "key": "case-study-okta-har-2023",
      "title": "Case study: the Okta support-system breach and session tokens in HAR files (2023)",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-294",
            "relation": "cites"
          },
          {
            "id": "CWE-522",
            "relation": "cites"
          },
          {
            "id": "CWE-532",
            "relation": "cites"
          },
          {
            "id": "CWE-613",
            "relation": "cites"
          },
          {
            "id": "CWE-778",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          },
          {
            "id": "A09:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-522"
          }
        ],
        "asvs": [
          {
            "id": "V7.4.1",
            "relation": "cites"
          },
          {
            "id": "V7.4.2",
            "relation": "cites"
          },
          {
            "id": "V7.5.1",
            "relation": "cites"
          },
          {
            "id": "V16.2.1",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-60",
            "relation": "cites"
          },
          {
            "id": "CAPEC-560",
            "relation": "cites"
          },
          {
            "id": "CAPEC-593",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/case-study-okta-har-2023/"
    },
    {
      "type": "Guide",
      "key": "case-study-certificate-expiry",
      "title": "Case study: certificate expiry outages at Ericsson (2018) and Microsoft Teams (2020), and Equifax's blind spot",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-295",
            "relation": "cites"
          },
          {
            "id": "CWE-298",
            "relation": "cites"
          },
          {
            "id": "CWE-324",
            "relation": "cites"
          },
          {
            "id": "CWE-778",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A09:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-298"
          }
        ],
        "asvs": [
          {
            "id": "V12.1.1",
            "relation": "cites"
          },
          {
            "id": "V12.2.2",
            "relation": "cites"
          },
          {
            "id": "V13.3.4",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/key-management-pki/case-study-certificate-expiry/"
    },
    {
      "type": "Guide",
      "key": "file-inclusion",
      "title": "Prevent file inclusion: LFI, RFI, dynamic imports and template names",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-22",
            "relation": "cites"
          },
          {
            "id": "CWE-73",
            "relation": "cites"
          },
          {
            "id": "CWE-94",
            "relation": "cites"
          },
          {
            "id": "CWE-98",
            "relation": "cites"
          },
          {
            "id": "CWE-829",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "related"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-73"
          },
          {
            "id": "A08:2025",
            "relation": "via-cwe",
            "via": "CWE-829"
          }
        ],
        "asvs": [
          {
            "id": "V1.3.2",
            "relation": "cites"
          },
          {
            "id": "V1.3.7",
            "relation": "cites"
          },
          {
            "id": "V5.3.1",
            "relation": "cites"
          },
          {
            "id": "V5.3.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-193",
            "relation": "cites"
          },
          {
            "id": "CAPEC-252",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/file-inclusion/"
    },
    {
      "type": "Guide",
      "key": "insecure-temp-files",
      "title": "Create temporary files safely: mkstemp, O_EXCL and private directories",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-59",
            "relation": "cites"
          },
          {
            "id": "CWE-367",
            "relation": "cites"
          },
          {
            "id": "CWE-377",
            "relation": "cites"
          },
          {
            "id": "CWE-379",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "related"
          }
        ],
        "asvs": [
          {
            "id": "V5.3.2",
            "relation": "cites"
          },
          {
            "id": "V15.4",
            "relation": "cites"
          },
          {
            "id": "V15.4.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-27",
            "relation": "cites"
          },
          {
            "id": "CAPEC-29",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/insecure-temp-files/"
    },
    {
      "type": "Guide",
      "key": "third-party-api-consumption",
      "title": "Consume third-party APIs safely (OWASP API10:2023)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-20",
            "relation": "cites"
          },
          {
            "id": "CWE-295",
            "relation": "cites"
          },
          {
            "id": "CWE-522",
            "relation": "cites"
          },
          {
            "id": "CWE-601",
            "relation": "cites"
          },
          {
            "id": "CWE-770",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A05:2025",
            "relation": "cites"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-601"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-522"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-295"
          }
        ],
        "api": [
          {
            "id": "API10:2023",
            "relation": "primary"
          },
          {
            "id": "API7:2023",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V1.3.6",
            "relation": "cites"
          },
          {
            "id": "V5.4.1",
            "relation": "cites"
          },
          {
            "id": "V13.1.1",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-141",
            "relation": "cites"
          },
          {
            "id": "CAPEC-275",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-features/third-party-api-consumption/"
    },
    {
      "type": "Guide",
      "key": "secure-design-patterns",
      "title": "Secure design patterns: a catalogue for insecure-design (A06)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-636",
            "relation": "cites"
          },
          {
            "id": "CWE-657",
            "relation": "cites"
          },
          {
            "id": "CWE-862",
            "relation": "cites"
          },
          {
            "id": "CWE-863",
            "relation": "cites"
          },
          {
            "id": "CWE-1188",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "related"
          },
          {
            "id": "A10:2025",
            "relation": "via-cwe",
            "via": "CWE-636"
          }
        ],
        "asvs": [
          {
            "id": "V1.2",
            "relation": "cites"
          },
          {
            "id": "V1.3",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/secure-design-patterns/"
    },
    {
      "type": "Guide",
      "key": "threat-model-mobile-banking",
      "title": "Worked threat model: a mobile banking app",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-295",
            "relation": "cites"
          },
          {
            "id": "CWE-308",
            "relation": "cites"
          },
          {
            "id": "CWE-319",
            "relation": "cites"
          },
          {
            "id": "CWE-862",
            "relation": "cites"
          },
          {
            "id": "CWE-922",
            "relation": "cites"
          },
          {
            "id": "CWE-926",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-922"
          },
          {
            "id": "A04:2025",
            "relation": "via-cwe",
            "via": "CWE-319"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-295"
          },
          {
            "id": "A08:2025",
            "relation": "via-cwe",
            "via": "CWE-926"
          }
        ],
        "api": [
          {
            "id": "API1:2023",
            "relation": "cites"
          },
          {
            "id": "API2:2023",
            "relation": "cites"
          },
          {
            "id": "API6:2023",
            "relation": "cites"
          }
        ],
        "masvs": [
          {
            "id": "MASVS-AUTH-1",
            "relation": "related"
          },
          {
            "id": "MASVS-AUTH-3",
            "relation": "related"
          },
          {
            "id": "MASVS-NETWORK-1",
            "relation": "related"
          },
          {
            "id": "MASVS-NETWORK-2",
            "relation": "related"
          },
          {
            "id": "MASVS-PLATFORM-3",
            "relation": "related"
          },
          {
            "id": "MASVS-RESILIENCE-1",
            "relation": "related"
          },
          {
            "id": "MASVS-STORAGE-1",
            "relation": "related"
          },
          {
            "id": "MASVS-AUTH-2",
            "relation": "cites"
          },
          {
            "id": "MASVS-CRYPTO-1",
            "relation": "cites"
          },
          {
            "id": "MASVS-PLATFORM-1",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/mobile-banking-threat-model/"
    },
    {
      "type": "Guide",
      "key": "threat-model-llm-agent",
      "title": "Worked threat model: an LLM agent with tools",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-79",
            "relation": "cites"
          },
          {
            "id": "CWE-862",
            "relation": "cites"
          },
          {
            "id": "CWE-918",
            "relation": "cites"
          },
          {
            "id": "CWE-1427",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "primary"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-862"
          },
          {
            "id": "A05:2025",
            "relation": "via-cwe",
            "via": "CWE-79"
          }
        ],
        "llm": [
          {
            "id": "LLM01:2026",
            "relation": "cites"
          },
          {
            "id": "LLM02:2026",
            "relation": "cites"
          },
          {
            "id": "LLM03:2026",
            "relation": "cites"
          },
          {
            "id": "LLM06:2026",
            "relation": "cites"
          },
          {
            "id": "LLM09:2026",
            "relation": "cites"
          },
          {
            "id": "LLM10:2026",
            "relation": "cites"
          }
        ],
        "agentic": [
          {
            "id": "ASI01:2026",
            "relation": "cites"
          },
          {
            "id": "ASI02:2026",
            "relation": "cites"
          },
          {
            "id": "ASI03:2026",
            "relation": "cites"
          },
          {
            "id": "ASI04:2026",
            "relation": "cites"
          },
          {
            "id": "ASI06:2026",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/threat-modeling/llm-agent-threat-model/"
    },
    {
      "type": "Guide",
      "key": "llm-misinformation",
      "title": "Contain LLM misinformation (OWASP LLM07:2026)",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-1426",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM07:2026",
            "relation": "primary"
          },
          {
            "id": "LLM10:2026",
            "relation": "related"
          },
          {
            "id": "LLM04:2026",
            "relation": "cites"
          }
        ],
        "agentic": [
          {
            "id": "ASI09:2026",
            "relation": "related"
          },
          {
            "id": "ASI06:2026",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/llm-misinformation/"
    },
    {
      "type": "Guide",
      "key": "calling-llm-apis-safely",
      "title": "Call a hosted LLM API safely",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-359",
            "relation": "cites"
          },
          {
            "id": "CWE-522",
            "relation": "cites"
          },
          {
            "id": "CWE-532",
            "relation": "cites"
          },
          {
            "id": "CWE-770",
            "relation": "cites"
          },
          {
            "id": "CWE-798",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "cites"
          },
          {
            "id": "A09:2025",
            "relation": "cites"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-359"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-522"
          }
        ],
        "asvs": [
          {
            "id": "V1.3.6",
            "relation": "cites"
          },
          {
            "id": "V13.1.1",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM02:2026",
            "relation": "related"
          },
          {
            "id": "LLM06:2026",
            "relation": "related"
          },
          {
            "id": "LLM10:2026",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/calling-llm-apis-safely/"
    },
    {
      "type": "Guide",
      "key": "smart-contract-defi-attacks",
      "title": "DeFi attack patterns: oracles, flash loans, proxies and signatures",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-294",
            "relation": "cites"
          },
          {
            "id": "CWE-347",
            "relation": "cites"
          },
          {
            "id": "CWE-665",
            "relation": "cites"
          },
          {
            "id": "CWE-682",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "via-cwe",
            "via": "CWE-347"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-294"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/smart-contracts/defi-attack-patterns/"
    },
    {
      "type": "Guide",
      "key": "agent-code-sandboxing",
      "title": "Sandbox model-generated code and computer-use agents",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-94",
            "relation": "cites"
          },
          {
            "id": "CWE-250",
            "relation": "cites"
          },
          {
            "id": "CWE-653",
            "relation": "cites"
          },
          {
            "id": "CWE-770",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "via-cwe",
            "via": "CWE-94"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-653"
          }
        ],
        "asvs": [
          {
            "id": "V13.2.4",
            "relation": "cites"
          },
          {
            "id": "V15.2.2",
            "relation": "cites"
          },
          {
            "id": "V15.2.5",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM03:2026",
            "relation": "cites"
          },
          {
            "id": "LLM10:2026",
            "relation": "cites"
          }
        ],
        "agentic": [
          {
            "id": "ASI05:2026",
            "relation": "primary"
          },
          {
            "id": "ASI01:2026",
            "relation": "related"
          },
          {
            "id": "ASI09:2026",
            "relation": "related"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/agent-code-sandboxing/"
    },
    {
      "type": "Guide",
      "key": "hidden-context-exposure",
      "title": "Keep secrets and controls out of hidden context (OWASP LLM08:2026)",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-497",
            "relation": "cites"
          },
          {
            "id": "CWE-656",
            "relation": "cites"
          },
          {
            "id": "CWE-798",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-497"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-656"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-798"
          }
        ],
        "asvs": [
          {
            "id": "V8.3.1",
            "relation": "cites"
          },
          {
            "id": "V13.3.1",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM08:2026",
            "relation": "primary"
          },
          {
            "id": "LLM01:2026",
            "relation": "cites"
          },
          {
            "id": "LLM02:2026",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/hidden-context-exposure/"
    },
    {
      "type": "Guide",
      "key": "agent-memory-poisoning",
      "title": "Defend agent memory and context against poisoning (OWASP ASI06)",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-349",
            "relation": "cites"
          },
          {
            "id": "CWE-501",
            "relation": "cites"
          },
          {
            "id": "CWE-1427",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-501"
          }
        ],
        "asvs": [
          {
            "id": "V8.2.2",
            "relation": "cites"
          },
          {
            "id": "V14.2.7",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM01:2026",
            "relation": "cites"
          },
          {
            "id": "LLM05:2026",
            "relation": "cites"
          },
          {
            "id": "LLM09:2026",
            "relation": "cites"
          }
        ],
        "agentic": [
          {
            "id": "ASI06:2026",
            "relation": "primary"
          },
          {
            "id": "ASI01:2026",
            "relation": "related"
          },
          {
            "id": "ASI08:2026",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/agent-memory-poisoning/"
    },
    {
      "type": "Guide",
      "key": "case-study-air-canada-chatbot",
      "title": "Case study: Moffatt v. Air Canada, a chatbot that misstated the refund policy (2022-2024)",
      "domain": "ai-emerging",
      "mappings": {
        "llm": [
          {
            "id": "LLM07:2026",
            "relation": "related"
          }
        ],
        "agentic": [
          {
            "id": "ASI09:2026",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/llm-security/case-study-air-canada-chatbot/"
    },
    {
      "type": "Guide",
      "key": "case-study-nx-s1ngularity",
      "title": "Case study: the Nx s1ngularity compromise and its AI-assisted payload (2025)",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-78",
            "relation": "cites"
          },
          {
            "id": "CWE-506",
            "relation": "cites"
          },
          {
            "id": "CWE-829",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          },
          {
            "id": "A05:2025",
            "relation": "via-cwe",
            "via": "CWE-78"
          }
        ],
        "llm": [
          {
            "id": "LLM03:2026",
            "relation": "cites"
          }
        ],
        "agentic": [
          {
            "id": "ASI04:2026",
            "relation": "related"
          },
          {
            "id": "ASI05:2026",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/case-study-nx-s1ngularity/"
    },
    {
      "type": "Guide",
      "key": "case-study-amazon-q-extension",
      "title": "Case study: the Amazon Q Developer extension compromise (2025)",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-506",
            "relation": "cites"
          },
          {
            "id": "CWE-522",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-522"
          }
        ],
        "llm": [
          {
            "id": "LLM03:2026",
            "relation": "cites"
          }
        ],
        "agentic": [
          {
            "id": "ASI04:2026",
            "relation": "related"
          },
          {
            "id": "ASI05:2026",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/ai-emerging/agent-security/case-study-amazon-q-extension/"
    },
    {
      "type": "Guide",
      "key": "case-study-storm-0558",
      "title": "Case study: Storm-0558 and the forged Microsoft tokens (2023)",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-324",
            "relation": "cites"
          },
          {
            "id": "CWE-347",
            "relation": "cites"
          },
          {
            "id": "CWE-778",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          },
          {
            "id": "A09:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V9.1.3",
            "relation": "cites"
          },
          {
            "id": "V11.1.1",
            "relation": "cites"
          },
          {
            "id": "V13.3.4",
            "relation": "cites"
          },
          {
            "id": "V16.3.2",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.1.3",
            "relation": "mentions"
          },
          {
            "id": "PO.5.1",
            "relation": "mentions"
          },
          {
            "id": "PS.1.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4.4",
            "relation": "mentions"
          },
          {
            "id": "PW.5.1",
            "relation": "mentions"
          },
          {
            "id": "PW.8.2",
            "relation": "mentions"
          },
          {
            "id": "RV.1.1",
            "relation": "mentions"
          },
          {
            "id": "RV.3.1",
            "relation": "mentions"
          },
          {
            "id": "RV.3.3",
            "relation": "mentions"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-196",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/identity-crypto/authentication/case-study-storm-0558/"
    },
    {
      "type": "Guide",
      "key": "case-study-ingress-nginx",
      "title": "Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025)",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-94",
            "relation": "cites"
          },
          {
            "id": "CWE-306",
            "relation": "cites"
          },
          {
            "id": "CWE-653",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A05:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-653"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-306"
          }
        ],
        "ssdf": [
          {
            "id": "PW.4.4",
            "relation": "mentions"
          },
          {
            "id": "PW.5.1",
            "relation": "mentions"
          },
          {
            "id": "PW.8.2",
            "relation": "mentions"
          },
          {
            "id": "PW.9.1",
            "relation": "mentions"
          },
          {
            "id": "RV.1.1",
            "relation": "mentions"
          },
          {
            "id": "RV.2.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3.3",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/containers/case-study-ingress-nginx/"
    },
    {
      "type": "Guide",
      "key": "case-study-circleci-2023",
      "title": "Case study: the CircleCI security incident (January 2023)",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-294",
            "relation": "cites"
          },
          {
            "id": "CWE-522",
            "relation": "cites"
          },
          {
            "id": "CWE-798",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-522"
          }
        ],
        "asvs": [
          {
            "id": "V13.2.1",
            "relation": "cites"
          },
          {
            "id": "V13.3.1",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.5.1",
            "relation": "mentions"
          },
          {
            "id": "PO.5.2",
            "relation": "mentions"
          },
          {
            "id": "PS.1.1",
            "relation": "mentions"
          },
          {
            "id": "RV.2.2",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/case-study-circleci-2023/"
    },
    {
      "type": "Guide",
      "key": "case-study-microsoft-sas-token",
      "title": "Case study: Microsoft AI researchers' over-permissive SAS token (2023)",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-732",
            "relation": "cites"
          },
          {
            "id": "CWE-798",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-798"
          }
        ],
        "asvs": [
          {
            "id": "V13.3.2",
            "relation": "cites"
          },
          {
            "id": "V13.3.4",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.3.2",
            "relation": "mentions"
          },
          {
            "id": "PO.5.1",
            "relation": "mentions"
          },
          {
            "id": "PS.1.1",
            "relation": "mentions"
          },
          {
            "id": "PW.9.1",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/runtime/cloud-posture/case-study-microsoft-sas-token/"
    },
    {
      "type": "Guide",
      "key": "case-study-first-american",
      "title": "Case study: First American's EaglePro document exposure (2019)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-306",
            "relation": "cites"
          },
          {
            "id": "CWE-639",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "via-cwe",
            "via": "CWE-306"
          }
        ],
        "asvs": [
          {
            "id": "V8.2.2",
            "relation": "cites"
          },
          {
            "id": "V8.3.1",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.2.1",
            "relation": "mentions"
          },
          {
            "id": "PO.4.1",
            "relation": "mentions"
          },
          {
            "id": "PW.1.1",
            "relation": "mentions"
          },
          {
            "id": "PW.5.1",
            "relation": "mentions"
          },
          {
            "id": "PW.8.2",
            "relation": "mentions"
          },
          {
            "id": "RV.2.1",
            "relation": "mentions"
          },
          {
            "id": "RV.2.2",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/authorization/case-study-first-american/"
    },
    {
      "type": "Guide",
      "key": "case-study-citrix-bleed",
      "title": "Case study: Citrix Bleed (CVE-2023-4966)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-119",
            "relation": "cites"
          },
          {
            "id": "CWE-613",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V7.4.5",
            "relation": "cites"
          }
        ],
        "ssdf": [
          {
            "id": "PO.1.3",
            "relation": "mentions"
          },
          {
            "id": "PW.5.1",
            "relation": "mentions"
          },
          {
            "id": "PW.6.2",
            "relation": "mentions"
          },
          {
            "id": "PW.8.2",
            "relation": "mentions"
          },
          {
            "id": "RV.2.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3.3",
            "relation": "mentions"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-593",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/vulnerability-response/case-study-citrix-bleed/"
    },
    {
      "type": "Guide",
      "key": "case-study-spring4shell",
      "title": "Case study: Spring4Shell (CVE-2022-22965)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-94",
            "relation": "cites"
          },
          {
            "id": "CWE-915",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A05:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "via-cwe",
            "via": "CWE-915"
          }
        ],
        "ssdf": [
          {
            "id": "PS.3.2",
            "relation": "mentions"
          },
          {
            "id": "PW.1.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4.1",
            "relation": "mentions"
          },
          {
            "id": "PW.4.4",
            "relation": "mentions"
          },
          {
            "id": "PW.5.1",
            "relation": "mentions"
          },
          {
            "id": "PW.7.2",
            "relation": "mentions"
          },
          {
            "id": "RV.2.1",
            "relation": "mentions"
          },
          {
            "id": "RV.2.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3.3",
            "relation": "mentions"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-242",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/secure-coding/case-study-spring4shell/"
    },
    {
      "type": "Guide",
      "key": "case-study-crowdstrike-channel-file-291",
      "title": "Case study: CrowdStrike Channel File 291 (July 2024)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-125",
            "relation": "cites"
          },
          {
            "id": "CWE-129",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A10:2025",
            "relation": "cites"
          },
          {
            "id": "A05:2025",
            "relation": "via-cwe",
            "via": "CWE-129"
          }
        ],
        "ssdf": [
          {
            "id": "PO.4.1",
            "relation": "mentions"
          },
          {
            "id": "PW.5.1",
            "relation": "mentions"
          },
          {
            "id": "PW.8.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3.3",
            "relation": "mentions"
          },
          {
            "id": "RV.3.4",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/appsec/platform-security/case-study-crowdstrike-channel-file-291/"
    },
    {
      "type": "Guide",
      "key": "staged-rollout-rollback",
      "title": "Staged rollout and rollback for security-critical updates",
      "domain": "supply-chain",
      "mappings": {
        "ssdf": [
          {
            "id": "PO.4.1",
            "relation": "mentions"
          },
          {
            "id": "PS.2.1",
            "relation": "mentions"
          },
          {
            "id": "PS.3.1",
            "relation": "mentions"
          },
          {
            "id": "PW.8.2",
            "relation": "mentions"
          },
          {
            "id": "RV.3.3",
            "relation": "mentions"
          },
          {
            "id": "RV.3.4",
            "relation": "mentions"
          }
        ]
      },
      "url": "https://softwaresecurity.com/domains/supply-chain/releases/staged-rollout-rollback/"
    },
    {
      "type": "Fix card",
      "key": "clickjacking",
      "title": "Clickjacking",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-1021",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V3.4.6",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-103",
            "relation": "cites"
          },
          {
            "id": "CAPEC-222",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/clickjacking/"
    },
    {
      "type": "Fix card",
      "key": "code-injection",
      "title": "Code injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-94",
            "relation": "cites"
          },
          {
            "id": "CWE-95",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V1.3.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-35",
            "relation": "cites"
          },
          {
            "id": "CAPEC-242",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/code-injection/"
    },
    {
      "type": "Fix card",
      "key": "command-injection",
      "title": "OS command and argument injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-78",
            "relation": "cites"
          },
          {
            "id": "CWE-88",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-6",
            "relation": "cites"
          },
          {
            "id": "CAPEC-88",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/command-injection/"
    },
    {
      "type": "Fix card",
      "key": "cors-misconfiguration",
      "title": "CORS misconfiguration on credentialed APIs",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-346",
            "relation": "cites"
          },
          {
            "id": "CWE-942",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V3.4.2",
            "relation": "cites"
          },
          {
            "id": "V3.5.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/cors-misconfiguration/"
    },
    {
      "type": "Fix card",
      "key": "crlf-log-injection",
      "title": "CRLF injection in logs and response headers",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-93",
            "relation": "cites"
          },
          {
            "id": "CWE-113",
            "relation": "cites"
          },
          {
            "id": "CWE-117",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          },
          {
            "id": "A09:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V1.2.1",
            "relation": "cites"
          },
          {
            "id": "V1.3.3",
            "relation": "cites"
          },
          {
            "id": "V16.4.1",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-34",
            "relation": "cites"
          },
          {
            "id": "CAPEC-93",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/crlf-log-injection/"
    },
    {
      "type": "Fix card",
      "key": "csrf",
      "title": "Cross-site request forgery (CSRF)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-352",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V3.3.2",
            "relation": "cites"
          },
          {
            "id": "V3.5.1",
            "relation": "cites"
          },
          {
            "id": "V3.5.3",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-62",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/csrf/"
    },
    {
      "type": "Fix card",
      "key": "csv-formula-injection",
      "title": "CSV formula injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-74",
            "relation": "cites"
          },
          {
            "id": "CWE-1236",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V1.2.10",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/csv-formula-injection/"
    },
    {
      "type": "Fix card",
      "key": "deserialization",
      "title": "Insecure deserialization",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-502",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-586",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/deserialization/"
    },
    {
      "type": "Fix card",
      "key": "file-upload",
      "title": "Unrestricted file upload",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-73",
            "relation": "cites"
          },
          {
            "id": "CWE-434",
            "relation": "cites"
          },
          {
            "id": "CWE-646",
            "relation": "cites"
          },
          {
            "id": "CWE-770",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V3.2.1",
            "relation": "cites"
          },
          {
            "id": "V3.4.4",
            "relation": "cites"
          },
          {
            "id": "V5.2.1",
            "relation": "cites"
          },
          {
            "id": "V5.2.2",
            "relation": "cites"
          },
          {
            "id": "V5.3.1",
            "relation": "cites"
          },
          {
            "id": "V5.3.2",
            "relation": "cites"
          },
          {
            "id": "V5.4.1",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-1",
            "relation": "cites"
          },
          {
            "id": "CAPEC-209",
            "relation": "cites"
          },
          {
            "id": "CAPEC-635",
            "relation": "cites"
          },
          {
            "id": "CAPEC-650",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/file-upload/"
    },
    {
      "type": "Fix card",
      "key": "hardcoded-secrets",
      "title": "Hard-coded secrets",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-260",
            "relation": "cites"
          },
          {
            "id": "CWE-261",
            "relation": "cites"
          },
          {
            "id": "CWE-798",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V13.3.1",
            "relation": "cites"
          },
          {
            "id": "V14.2.1",
            "relation": "cites"
          },
          {
            "id": "V16.2.5",
            "relation": "cites"
          },
          {
            "id": "V16.5.1",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-191",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/hardcoded-secrets/"
    },
    {
      "type": "Fix card",
      "key": "insecure-randomness",
      "title": "Insecure randomness for security tokens",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-330",
            "relation": "cites"
          },
          {
            "id": "CWE-338",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V11.5.1",
            "relation": "cites"
          },
          {
            "id": "V11.5.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-59",
            "relation": "cites"
          },
          {
            "id": "CAPEC-112",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/insecure-randomness/"
    },
    {
      "type": "Fix card",
      "key": "jwt-validation",
      "title": "JWT validation in APIs (bearer tokens)",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-287",
            "relation": "cites"
          },
          {
            "id": "CWE-347",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V9.1.1",
            "relation": "cites"
          },
          {
            "id": "V9.1.2",
            "relation": "cites"
          },
          {
            "id": "V9.1.3",
            "relation": "cites"
          },
          {
            "id": "V9.2.1",
            "relation": "cites"
          },
          {
            "id": "V9.2.3",
            "relation": "cites"
          },
          {
            "id": "V10.3.1",
            "relation": "cites"
          },
          {
            "id": "V10.3.3",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-196",
            "relation": "cites"
          },
          {
            "id": "CAPEC-475",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/jwt-validation/"
    },
    {
      "type": "Fix card",
      "key": "ldap-injection",
      "title": "LDAP filter injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-90",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V1.2.6",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-136",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/ldap-injection/"
    },
    {
      "type": "Fix card",
      "key": "mass-assignment",
      "title": "Mass assignment (over-posting)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-915",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API3:2023",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V8.2.3",
            "relation": "cites"
          },
          {
            "id": "V15.3.3",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/mass-assignment/"
    },
    {
      "type": "Fix card",
      "key": "missing-authentication",
      "title": "Missing authentication for a critical function",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-287",
            "relation": "cites"
          },
          {
            "id": "CWE-288",
            "relation": "cites"
          },
          {
            "id": "CWE-290",
            "relation": "cites"
          },
          {
            "id": "CWE-306",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V6.3.4",
            "relation": "cites"
          },
          {
            "id": "V8.3.1",
            "relation": "cites"
          },
          {
            "id": "V13.2.1",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-12",
            "relation": "cites"
          },
          {
            "id": "CAPEC-36",
            "relation": "cites"
          },
          {
            "id": "CAPEC-216",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/missing-authentication/"
    },
    {
      "type": "Fix card",
      "key": "missing-authorization",
      "title": "Missing object-level authorization (IDOR and BOLA)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-639",
            "relation": "cites"
          },
          {
            "id": "CWE-862",
            "relation": "cites"
          },
          {
            "id": "CWE-863",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API1:2023",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/missing-authorization/"
    },
    {
      "type": "Fix card",
      "key": "nosql-injection",
      "title": "NoSQL operator injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-943",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V1.2.4",
            "relation": "cites"
          },
          {
            "id": "V15.3.5",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-676",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/nosql-injection/"
    },
    {
      "type": "Fix card",
      "key": "open-redirect",
      "title": "Open redirect",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-601",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V3.7.2",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/open-redirect/"
    },
    {
      "type": "Fix card",
      "key": "password-hashing",
      "title": "Weak password hashing",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-327",
            "relation": "cites"
          },
          {
            "id": "CWE-759",
            "relation": "cites"
          },
          {
            "id": "CWE-916",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-49",
            "relation": "cites"
          },
          {
            "id": "CAPEC-55",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/password-hashing/"
    },
    {
      "type": "Fix card",
      "key": "path-traversal",
      "title": "Path traversal",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-22",
            "relation": "cites"
          },
          {
            "id": "CWE-23",
            "relation": "cites"
          },
          {
            "id": "CWE-36",
            "relation": "cites"
          },
          {
            "id": "CWE-59",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-64",
            "relation": "cites"
          },
          {
            "id": "CAPEC-79",
            "relation": "cites"
          },
          {
            "id": "CAPEC-126",
            "relation": "cites"
          },
          {
            "id": "CAPEC-132",
            "relation": "cites"
          },
          {
            "id": "CAPEC-139",
            "relation": "cites"
          },
          {
            "id": "CAPEC-597",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/path-traversal/"
    },
    {
      "type": "Fix card",
      "key": "regex-dos",
      "title": "Regular-expression denial of service (ReDoS)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-1333",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-492",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/regex-dos/"
    },
    {
      "type": "Fix card",
      "key": "resource-limits",
      "title": "Unbounded resource consumption",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-400",
            "relation": "cites"
          },
          {
            "id": "CWE-770",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API4:2023",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V2.4.1",
            "relation": "cites"
          },
          {
            "id": "V15.2.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-125",
            "relation": "cites"
          },
          {
            "id": "CAPEC-130",
            "relation": "cites"
          },
          {
            "id": "CAPEC-469",
            "relation": "cites"
          },
          {
            "id": "CAPEC-488",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/resource-limits/"
    },
    {
      "type": "Fix card",
      "key": "session-cookies",
      "title": "Session fixation and session cookies",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-384",
            "relation": "cites"
          },
          {
            "id": "CWE-613",
            "relation": "cites"
          },
          {
            "id": "CWE-614",
            "relation": "cites"
          },
          {
            "id": "CWE-1004",
            "relation": "cites"
          },
          {
            "id": "CWE-1275",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V3.3.1",
            "relation": "cites"
          },
          {
            "id": "V3.3.2",
            "relation": "cites"
          },
          {
            "id": "V3.3.3",
            "relation": "cites"
          },
          {
            "id": "V3.3.4",
            "relation": "cites"
          },
          {
            "id": "V7.2.4",
            "relation": "cites"
          },
          {
            "id": "V7.3.1",
            "relation": "cites"
          },
          {
            "id": "V7.3.2",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-60",
            "relation": "cites"
          },
          {
            "id": "CAPEC-61",
            "relation": "cites"
          },
          {
            "id": "CAPEC-102",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/session-cookies/"
    },
    {
      "type": "Fix card",
      "key": "sql-injection",
      "title": "SQL injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-89",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-66",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/sql-injection/"
    },
    {
      "type": "Fix card",
      "key": "ssrf",
      "title": "Server-side request forgery (SSRF)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-918",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-664",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/ssrf/"
    },
    {
      "type": "Fix card",
      "key": "template-injection",
      "title": "Server-side template injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-94",
            "relation": "cites"
          },
          {
            "id": "CWE-95",
            "relation": "cites"
          },
          {
            "id": "CWE-1336",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-242",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/template-injection/"
    },
    {
      "type": "Fix card",
      "key": "tls-certificate-validation",
      "title": "Improper TLS certificate validation",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-295",
            "relation": "cites"
          },
          {
            "id": "CWE-296",
            "relation": "cites"
          },
          {
            "id": "CWE-297",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V12.3.2",
            "relation": "cites"
          },
          {
            "id": "V12.3.4",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-94",
            "relation": "cites"
          },
          {
            "id": "CAPEC-459",
            "relation": "cites"
          },
          {
            "id": "CAPEC-475",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/tls-certificate-validation/"
    },
    {
      "type": "Fix card",
      "key": "xpath-injection",
      "title": "XPath injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-91",
            "relation": "cites"
          },
          {
            "id": "CWE-643",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "asvs": [
          {
            "id": "V1.2.7",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-83",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/xpath-injection/"
    },
    {
      "type": "Fix card",
      "key": "xss",
      "title": "Cross-site scripting (XSS)",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-79",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-63",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/xss/"
    },
    {
      "type": "Fix card",
      "key": "xxe",
      "title": "XML external entity (XXE) processing",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-611",
            "relation": "cites"
          },
          {
            "id": "CWE-776",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "cites"
          }
        ],
        "capec": [
          {
            "id": "CAPEC-197",
            "relation": "cites"
          },
          {
            "id": "CAPEC-221",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/fix/xxe/"
    },
    {
      "type": "Lab",
      "key": "csrf",
      "title": "CSRF lab: Protect an account change from a forged request",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-352",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/csrf/"
    },
    {
      "type": "Lab",
      "key": "archive-paths",
      "title": "Path traversal lab: Keep archive entries inside their extraction directory",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-22",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/archive-paths/"
    },
    {
      "type": "Lab",
      "key": "checkout-race",
      "title": "Race condition lab: Repair a balance check that races",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-362",
            "relation": "cites"
          },
          {
            "id": "CWE-367",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/checkout-race/"
    },
    {
      "type": "Lab",
      "key": "sbom-inventory",
      "title": "SBOM completeness lab: Find the dependencies missing from a release SBOM",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-1395",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/sbom-inventory/"
    },
    {
      "type": "Lab",
      "key": "artifact-policy",
      "title": "Signed artifact provenance lab: Reject a release from the wrong producer",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-345",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/artifact-policy/"
    },
    {
      "type": "Lab",
      "key": "kubernetes-policy",
      "title": "Privileged container lab: Reject a privileged workload before deployment",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-250",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/kubernetes-policy/"
    },
    {
      "type": "Lab",
      "key": "token-validation",
      "title": "JWT validation lab: Validate the purpose and audience of a token",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-287",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/token-validation/"
    },
    {
      "type": "Lab",
      "key": "recovery",
      "title": "Password reset token lab: Make a recovery credential single-use",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-640",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/recovery/"
    },
    {
      "type": "Lab",
      "key": "rag-isolation",
      "title": "RAG access control lab: Stop a retriever from returning another tenant’s documents",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-285",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM02:2026",
            "relation": "cites"
          },
          {
            "id": "LLM09:2026",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/rag-isolation/"
    },
    {
      "type": "Lab",
      "key": "agent-tool-gateway",
      "title": "Excessive agency lab: Bind an agent’s action to the approved arguments",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-862",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM03:2026",
            "relation": "cites"
          }
        ],
        "agentic": [
          {
            "id": "ASI02:2026",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/agent-tool-gateway/"
    },
    {
      "type": "Lab",
      "key": "output-rendering",
      "title": "XSS lab: Render a model’s answer as text instead of active markup",
      "domain": "ai-emerging",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-79",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "llm": [
          {
            "id": "LLM10:2026",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/output-rendering/"
    },
    {
      "type": "Lab",
      "key": "release-evidence",
      "title": "Release evidence lab: Keep stale test evidence out of a release decision",
      "domain": "governance",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-345",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/release-evidence/"
    },
    {
      "type": "Lab",
      "key": "authorization",
      "title": "IDOR lab: Repair an invoice authorization bug",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-639",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API1:2023",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/authorization/"
    },
    {
      "type": "Lab",
      "key": "nonces",
      "title": "AES-GCM nonce reuse lab: Fix a nonce allocator that breaks after restart",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-323",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/nonces/"
    },
    {
      "type": "Lab",
      "key": "webhooks",
      "title": "Webhook signature and replay lab: Repair a webhook handler that pays twice",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-294",
            "relation": "cites"
          },
          {
            "id": "CWE-345",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "cites"
          },
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/webhooks/"
    },
    {
      "type": "Lab",
      "key": "ssrf-url-policy",
      "title": "SSRF lab: Guard an outbound fetch against SSRF",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-918",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "cites"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-918"
          }
        ],
        "api": [
          {
            "id": "API7:2023",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/ssrf-url-policy/"
    },
    {
      "type": "Lab",
      "key": "cors-policy",
      "title": "CORS policy lab: Grant CORS to the right origins only",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-942",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A02:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/cors-policy/"
    },
    {
      "type": "Lab",
      "key": "csp-policy",
      "title": "CSP builder lab: Build a strict Content-Security-Policy",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-1021",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "cites"
          },
          {
            "id": "A05:2025",
            "relation": "cites"
          },
          {
            "id": "A06:2025",
            "relation": "via-cwe",
            "via": "CWE-1021"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/csp-policy/"
    },
    {
      "type": "Lab",
      "key": "html-sanitizer",
      "title": "HTML sanitization lab: Configure a sanitizer for user comments",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-79",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/html-sanitizer/"
    },
    {
      "type": "Lab",
      "key": "jwt-verification",
      "title": "JWT verification lab: Verify a JWT before trusting it",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-347",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A07:2025",
            "relation": "cites"
          },
          {
            "id": "A04:2025",
            "relation": "via-cwe",
            "via": "CWE-347"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/jwt-verification/"
    },
    {
      "type": "Lab",
      "key": "actions-injection",
      "title": "Actions injection lab: Flag GitHub Actions expression injection",
      "domain": "supply-chain",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-78",
            "relation": "cites"
          },
          {
            "id": "CWE-94",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A03:2025",
            "relation": "cites"
          },
          {
            "id": "A05:2025",
            "relation": "via-cwe",
            "via": "CWE-94"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/actions-injection/"
    },
    {
      "type": "Lab",
      "key": "coupon-limits",
      "title": "Business logic lab: Price an order without trusting the client",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-472",
            "relation": "cites"
          },
          {
            "id": "CWE-837",
            "relation": "cites"
          },
          {
            "id": "CWE-1284",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API6:2023",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/coupon-limits/"
    },
    {
      "type": "Lab",
      "key": "sql-injection-sqlite",
      "title": "SQL injection lab: Separate SQL structure from data with sqlite3",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-89",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API8:2023",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/sql-injection-sqlite/"
    },
    {
      "type": "Lab",
      "key": "path-traversal-python",
      "title": "Path traversal lab: Serve an uploaded file without path traversal",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-22",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/path-traversal-python/"
    },
    {
      "type": "Lab",
      "key": "ssrf-validation-python",
      "title": "SSRF validation lab: Validate a fetch URL with ipaddress",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-918",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "cites"
          },
          {
            "id": "A01:2025",
            "relation": "via-cwe",
            "via": "CWE-918"
          }
        ],
        "api": [
          {
            "id": "API7:2023",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/ssrf-validation-python/"
    },
    {
      "type": "Lab",
      "key": "safe-redirect",
      "title": "Open redirect lab: Return users to this site only",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-601",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/safe-redirect/"
    },
    {
      "type": "Lab",
      "key": "file-upload",
      "title": "File upload lab: Accept avatars without publishing pages",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-73",
            "relation": "cites"
          },
          {
            "id": "CWE-434",
            "relation": "cites"
          },
          {
            "id": "CWE-646",
            "relation": "cites"
          },
          {
            "id": "CWE-770",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A06:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API4:2023",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/file-upload/"
    },
    {
      "type": "Lab",
      "key": "command-injection",
      "title": "OS command injection lab: Run git without a shell",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-78",
            "relation": "cites"
          },
          {
            "id": "CWE-88",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/command-injection/"
    },
    {
      "type": "Lab",
      "key": "mass-assignment",
      "title": "Mass assignment lab: Update only the fields users may edit",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-915",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API3:2023",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/mass-assignment/"
    },
    {
      "type": "Lab",
      "key": "oauth-redirect-pkce",
      "title": "OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-287",
            "relation": "cites"
          },
          {
            "id": "CWE-601",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          }
        ],
        "api": [
          {
            "id": "API2:2023",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/oauth-redirect-pkce/"
    },
    {
      "type": "Lab",
      "key": "network-policy",
      "title": "NetworkPolicy lab: Lock down a shop namespace",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-284",
            "relation": "cites"
          },
          {
            "id": "CWE-668",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A02:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/network-policy/"
    },
    {
      "type": "Lab",
      "key": "insecure-randomness",
      "title": "Insecure randomness lab: Generate unguessable API keys",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-330",
            "relation": "cites"
          },
          {
            "id": "CWE-331",
            "relation": "cites"
          },
          {
            "id": "CWE-338",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/insecure-randomness/"
    },
    {
      "type": "Lab",
      "key": "heartbeat-bounds",
      "title": "Buffer over-read lab: Stop a heartbeat over-read",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-125",
            "relation": "cites"
          },
          {
            "id": "CWE-130",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A10:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/heartbeat-bounds/"
    },
    {
      "type": "Lab",
      "key": "template-injection-jinja",
      "title": "SSTI lab: Render a welcome banner without template injection",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-94",
            "relation": "cites"
          },
          {
            "id": "CWE-95",
            "relation": "cites"
          },
          {
            "id": "CWE-1336",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A05:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/template-injection-jinja/"
    },
    {
      "type": "Lab",
      "key": "xxe-lxml",
      "title": "XXE lab: Parse an uploaded invoice without resolving external entities",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-611",
            "relation": "cites"
          },
          {
            "id": "CWE-776",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A02:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/xxe-lxml/"
    },
    {
      "type": "Lab",
      "key": "pickle-deserialization",
      "title": "Pickle deserialization lab: Load a session token without pickle",
      "domain": "appsec",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-502",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A08:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/pickle-deserialization/"
    },
    {
      "type": "Lab",
      "key": "password-hashing-argon2",
      "title": "Password hashing lab: Verify and upgrade an Argon2 password hash on login",
      "domain": "identity-crypto",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-327",
            "relation": "cites"
          },
          {
            "id": "CWE-759",
            "relation": "cites"
          },
          {
            "id": "CWE-916",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A04:2025",
            "relation": "cites"
          },
          {
            "id": "A07:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/password-hashing-argon2/"
    },
    {
      "type": "Lab",
      "key": "iam-trust-policy",
      "title": "IAM trust policy lab: Evaluate a role trust policy against the confused deputy",
      "domain": "runtime",
      "mappings": {
        "cwe": [
          {
            "id": "CWE-284",
            "relation": "cites"
          },
          {
            "id": "CWE-863",
            "relation": "cites"
          }
        ],
        "owasp": [
          {
            "id": "A01:2025",
            "relation": "cites"
          },
          {
            "id": "A02:2025",
            "relation": "cites"
          }
        ]
      },
      "url": "https://softwaresecurity.com/labs/iam-trust-policy/"
    }
  ]
}