Guides and resources
Every guide, fix card, workflow, learning path, lab, project, tool and glossary term on the site. Filter by topic, type, stack or platform and standard.
600 items
Guides 169
Show all 169 guidesPrevent XSS at the output boundary
Choose text rendering, context-aware encoding, or deliberate HTML sanitization according to how the browser will interpret the value.
Handle failures without leaking internals or weakening controls
Give callers a useful, bounded response while preserving protected diagnostic evidence and safe application state.
Ship without debug modes, verbose errors or exposed files
Turn off debug output, publish an allowlisted build and probe each deployment for exposed files and endpoints.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Run external programs without command or argument injection
Run programs from an argument list with no shell, end options before user values, and keep untrusted arguments away from Windows batch files.
Keep untrusted input out of eval, expression languages and templates
Keep code and templates constant, pass input as data, and treat in-process sandboxes as one layer, not a boundary.
Recipes 3
Fix SQL injection in Python sqlite3
Bind query values separately from SQL syntax, then prove the fix preserves legitimate behavior and blocks an injection probe.
Contain a leaked secret, then investigate and clean up
Revoke an exposed API key, token or private key at its issuer before anything else, end the sessions it minted, check the provider's logs, then remove every copy and replace it with a credential that expires on its own.
Call a hosted LLM API safely
A code-first checklist for wiring up an OpenAI or Anthropic API call from a backend: keep keys server-side, redact PII before prompts and logs, choose provider retention settings deliberately, validate structured output and still treat it as untrusted, and set timeouts, retries and per-user cost caps.
Weaknesses with fix cards 30
Show all 30 weaknesses with fix cardsCross-site scripting (XSS)
Cross-site scripting happens when request or stored data is written into a page without encoding for the exact spot it lands in, so the browser runs it as markup or script instead of showing it as text.
SQL injection
SQL injection happens when request data is pasted into the text of a SQL statement, so a crafted value can end a string literal and change what the query does: return other customers' rows, drop a filter or read columns the API never returns.
Cross-site request forgery (CSRF)
Cross-site request forgery happens when a server accepts a state-changing request because it carries the user's session cookie.
Missing object-level authorization (IDOR and BOLA)
Missing object-level authorization (IDOR, called BOLA in the OWASP API list) happens when an API checks that a caller is signed in and then loads whatever invoice, order or file the request names, so changing an ID in the URL, the query string or a bulk export returns someone else's data.
Path traversal
Path traversal happens when a file name or path from a request is joined to a base directory and opened without checking where the result lands.
OS command and argument injection
Command injection happens when request data is pasted into a command line that a shell then parses, so a crafted value can start a second command (OS command injection, CWE-78) or add an unintended option to the one you meant to run (argument injection, CWE-88).
References 10
Show all 10 referencesAbuse case library: tests and controls by feature
Recurring abuse cases for sign-up and login, password reset, MFA enrolment, invites, file upload, payments and coupons, webhooks, search, export, admin and AI chat or agents: the attacker goal, preconditions, a concrete test and the control, each linked to CWE and CAPEC.
Threat pattern library for threat modeling
Thirty-two recurring threat patterns grouped by identity, authorization, parsers, concurrency, integrations, data exposure, supply chain, availability and AI agents, each with where it shows up on a data-flow diagram, mitigations, a verification step and STRIDE, CWE and CAPEC links, plus a YAML catalog and a script that lists patterns per diagram element.
Secure design patterns: a catalogue for insecure-design (A06)
A catalogue of reusable secure-design patterns, grouped by concern, each with when to use it, a short example and the failure it prevents: choke-point authorization, capability tokens, parse-don't-validate, safe-by-default APIs, tenant scoping, fail-closed, idempotency, and more.
Choose cryptographic algorithms and parameters by job
A sourced quick reference for October 2026: which algorithm and parameters to use for encryption, hashing, passwords, MACs, signatures, key agreement, key derivation, randomness and TLS, the matching APIs in Node.js, Python, Java, Go and .NET, and where post-quantum migration stands.
ECB mode: why it leaks patterns and what to use instead
Derive exactly what ECB reveals and why a longer key cannot fix it, find where ECB enters real code, and replace it with an authenticated mode.
Padding oracle attacks
Use a byte-level CBC example to see how a tiny validity signal becomes plaintext information, then design verification that checks more than the error message.
Case studies 31
Show all 31 case studiesCase study: Spring4Shell (CVE-2022-22965)
How Spring's data binding let request parameters reach the class loader on JDK 9 and later in 2022, why the denylist workaround leaked, and what it teaches about framework-level mass assignment.
Case study: First American's EaglePro document exposure (2019)
How sequential IDs in unauthenticated links exposed First American's title documents in 2019, after its own penetration test found the flaw and a clerical error let it go unfixed.
Case study: CrowdStrike Channel File 291 (July 2024)
How a CrowdStrike content update crashed Windows hosts in July 2024: a field-count mismatch hidden by wildcard tests, a missing bounds check, and no staged rollout.
Case study: Log4Shell (CVE-2021-44228)
How a JNDI lookup in Apache Log4j became internet-wide remote code execution, why transitive and shaded dependencies made it so hard to patch, which mitigations held, and what it teaches about dependency inventory and SBOMs.
Case study: MOVEit Transfer mass exploitation (CVE-2023-34362)
How one unauthenticated SQL injection in an internet-facing file transfer product let the Cl0p group steal data from thousands of organizations in days in 2023, how defenders found the web shell, and the vendor and customer controls that would have limited it.
Case study: Citrix Bleed (CVE-2023-4966)
How a NetScaler memory over-read leaked session cookies that bypassed passwords and MFA in 2023, why patching did not end hijacked sessions, and how the pattern returned in 2025.
Workflows 6
Fix a finding
Move from a scanner alert to a tested, durable fix.
Secure a feature
Make security part of the implementation, from the first decision.
Review a design
Trace data, challenge assumptions, and make risk decisions explicit.
Test an application
Build a focused test plan around trust boundaries and real behavior.
Respond to a vulnerability
Understand exposure, contain risk, and verify the recovery.
Build an AppSec program
Connect ownership, engineering practices, and evidence of improvement.
Learning paths 9
Show all 9 learning pathsDeveloper foundations
Start at the data boundary. Build habits that make common defects harder to introduce.
Browser and API boundaries
Protect state changes, browser policies, rendering, object access and concurrent business operations, repairing seven concrete defects along the way.
AppSec in practice
Review a system, build a test plan, and carry a finding through to verified remediation.
Identity through the whole lifecycle
Connect login, token verification, phishing-resistant credentials, recovery and authorization to testable boundaries.
From source to trusted release
Generate and compare inventory, assess dependency risk, verify artifacts and retain evidence tied to the shipped release.
Runtime and cloud defense
Review workload identity, cluster boundaries, configuration drift, exposed APIs and incident evidence.
Labs 38
Show all 38 labsCSRF lab: Protect an account change from a forged request
An account settings handler trusts the session cookie even when another site causes the request. Repair the request policy and preserve legitimate settings updates.
Path traversal lab: Keep archive entries inside their extraction directory
An import job writes archive entry names directly beneath its work directory. An entry containing ../ can escape. Repair the entry-name policy before any file is created.
Race condition lab: Repair a balance check that races
Two simultaneous purchases both see the same balance and spend more credit than the account owns. Replace the read-then-write sequence with the supplied atomic debit.
IDOR lab: Repair an invoice authorization bug
Bob can retrieve Alice’s invoice by changing the URL. You own the endpoint’s permission check. Reproduce the leak, patch the function below, and prove that Alice can still read her invoice.
Webhook signature and replay lab: Repair a webhook handler that pays twice
Your handler rejects some genuine deliveries and records replayed payments twice. Fix the function below, then test valid, changed, replayed, and concurrent deliveries.
SSRF lab: Guard an outbound fetch against SSRF
A webhook sender fetches whatever URL the user gives it, and follows redirects. An attacker can point it at the cloud metadata service or an internal admin page, directly or through a redirect. Repair the guard so it resolves each host and refuses private addresses, in literals, encodings and redirects alike.
Projects 22
Show all 22 projectsSecure a real HTTP API
Run Express requests with real signed tokens. Repair invoice authorization and stop user-controlled properties from changing roles or tenants.
Make a checkout transaction atomic
Reproduce two competing withdrawals against SQLite, then repair the transaction so funds cannot be spent twice.
Keep extracted files inside their boundary
Inspect actual ZIP entries and repair a path policy. Test traversal, links, duplicate entries, expansion limits and ordinary nested files.
Parse bounded JSON and XML invoices safely
Repair a real JSON/XML parser boundary: reject duplicate fields, coercion, unknown schema, DTDs and oversized documents while keeping valid invoices usable.
Repair a native parser using sanitizer evidence
Compile a C parser with AddressSanitizer, observe a real out-of-bounds access, and repair allocation, length and output-capacity checks against boundary tests and 80 generated frames.
Stop prototype pollution at merge and authorization boundaries
Observe real prototype mutation from nested JSON merges, then repair schema selection, own-property authorization and arbitrary-key dictionaries without breaking valid updates.
Tools 11
Show all 11 toolsSBOM checker
Check a CycloneDX or SPDX JSON SBOM for missing versions, suppliers, hashes and broken references. Runs in your browser; nothing is uploaded.
Identifier lookup
Paste a CWE, OWASP Top 10, API, LLM or Agentic Top 10 or ASVS ID from a scanner or report and go straight to its page.
JWT inspector
Decode a JWT, flag alg none, key confusion, weak HMAC secrets, risky kid, jku and jwk headers and missing or expired claims, and verify HS256, RS256, ES256 or Ed25519 signatures.
CSP evaluator
Check a Content Security Policy for unsafe-inline, unsafe-eval, wildcards and broad schemes, missing object-src, base-uri and frame-ancestors, and weak reporting.
Security headers analyzer
Check pasted response headers: HSTS, CSP, X-Content-Type-Options, framing, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, caching and Set-Cookie attributes.
CVSS v4.0 calculator
Score CVSS v4.0 vectors with Base, Threat, Environmental and Supplemental metrics. Paste or build a vector; scores match FIRST’s reference calculator.
Glossary terms 271
Show all 271 glossary termsABAC (Attribute-based access control)
Each request is decided by a policy over attributes of the subject, the resource, the action and the environment, such as department, data classification or time.
Abuse case
A scenario written from an attacker’s or misuser’s point of view that describes how a feature could be abused, such as replaying a coupon or enumerating accounts, so the team can derive security requirements and tests from it.
Access token
A credential that an OAuth client presents to a resource server to call an API (RFC 6749).
ACME (Automatic Certificate Management Environment)
A protocol with which a client proves control of a domain, usually through an HTTP-01 or DNS-01 challenge, and obtains and renews certificates without manual steps, as with Let’s Encrypt.
AddressSanitizer
A compiler instrumentation in Clang and GCC that detects out-of-bounds accesses, use-after-free, double free and other memory errors at run time, with about a twofold slowdown.
Admission controller
A Kubernetes component that intercepts API server requests after authentication and authorization and can reject or modify objects before they are stored.
Nothing matches these filters. Clear a filter, or search every page.
Download the guide catalog
Every guide with the platforms it applies to and its practice, as data: JSON or CSV. The coverage map shows which security outcomes the guides, labs and projects cover, and the gaps.