# Software Security

> A vendor-neutral software security reference: answer-first guides cited to sources, fixes proved by tests, and pages for every CWE, OWASP and ASVS ID.

Software Security has 213 guides in 6 domains, 188 fix cards for 30 weaknesses, 6 task workflows, 9 learning paths, 38 browser labs, a glossary of 271 terms and an SBOM checker. Each guide below links to its Markdown version, which includes the canonical page URL, publication dates, the guided practice and the sources. Weakness and standard identifiers, such as CWE-79, follow the title in parentheses.

Reuse: guides and teaching material are licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); original code is MIT licensed. Attribute "Software Security" and link to the page.

Full text: [every guide and fix card in one file](https://softwaresecurity.com/llms-full.txt), or the guides of one domain: [Application security](https://softwaresecurity.com/llms/appsec.txt), [Software supply chain](https://softwaresecurity.com/llms/supply-chain.txt), [Runtime, cloud & APIs](https://softwaresecurity.com/llms/runtime.txt), [Identity & cryptography](https://softwaresecurity.com/llms/identity-crypto.txt), [Governance & frameworks](https://softwaresecurity.com/llms/governance.txt), [AI security](https://softwaresecurity.com/llms/ai-emerging.txt).

Structured data: [the content API](https://softwaresecurity.com/api/) serves every guide as versioned JSON (https://softwaresecurity.com/api/v1/index.json), with the answer, key points, identifiers, dates and sections as plain text.

## Application security

Secure design, implementation, testing, and response throughout the software lifecycle.

- [SQL injection in Python: parameterized sqlite3 queries (CWE-89, A05:2025, V1.2.4, CAPEC-66, WSTG-INPV-05)](https://softwaresecurity.com/downloads/sql-injection-python.md): Bind query values separately from SQL syntax, then prove the fix preserves legitimate behavior and blocks an injection probe.
- [IDOR and BOLA prevention: object-level authorization (CWE-639, CWE-862, CWE-863, A01:2025, API1:2023, V8.2.2, V8.3.1, V8.4.1, WSTG-ATHZ-04)](https://softwaresecurity.com/downloads/object-authorization.md): Authorize the authenticated subject, requested operation, and specific resource together; a valid login or unpredictable identifier is insufficient.
- [Secure file uploads: validation, quarantine and safe serving (CWE-434, CWE-770, A06:2025, API4:2023, V5.2.1, V5.2.2, V5.2.6, V5.3.2, V5.4.1, WSTG-BUSL-08, WSTG-BUSL-09)](https://softwaresecurity.com/downloads/secure-uploads.md): Treat upload receipt, content processing, storage, and later delivery as separate security decisions.
- [Webhook signature verification: HMAC, replay and idempotency (CWE-347, CWE-294, CWE-306, CWE-208, A08:2025, A07:2025, API10:2023)](https://softwaresecurity.com/downloads/webhook-verification.md): Verify the provider’s signature over the correct bytes, then apply replay, authorization, and idempotency controls before a business action.
- [Multi-tenant threat modeling: trace tenant isolation (CWE-639, CWE-863, A06:2025, A01:2025, API1:2023, V8.4.1)](https://softwaresecurity.com/downloads/multitenant-threat-model.md): Trace tenant identity through requests, data stores, caches, jobs, and administration, then turn plausible isolation failures into tests.
- [Dependency incident response: exploited or malicious package (CWE-1395, CWE-1104, CWE-506, A03:2025, V15.1.1, V15.1.2, V15.2.1)](https://softwaresecurity.com/downloads/dependency-response.md): When a dependency vulnerability is being exploited, or a package version is malicious, triage gives way to incident response: find every running copy, contain it, patch and redeploy, hunt for exploitation, rotate secrets and close on deployed evidence.
- [Mobile app trust boundaries: server checks and deep links (CWE-602, CWE-639, CWE-939, A06:2025, A01:2025, API1:2023, V8.3.1, V2.2.2)](https://softwaresecurity.com/downloads/mobile-native-boundaries.md): Protect local data and platform interactions while keeping server-side authorization independent of the client’s behavior.
- [XSS prevention: output encoding, safe sinks, escape hatches (CWE-79, CWE-116, A05:2025, V1.2.1, V1.2.2, V1.3.1, V3.2.2, CAPEC-63, CAPEC-588, CAPEC-591, CAPEC-592, WSTG-INPV-01, WSTG-INPV-02)](https://softwaresecurity.com/downloads/xss-output-encoding.md): Choose text rendering, context-aware encoding, or deliberate HTML sanitization according to how the browser will interpret the value.
- [SSRF prevention: safe URL fetching and egress control (CWE-918, A01:2025, API7:2023, V1.3.6, V13.2.4, V15.3.2, CAPEC-664, WSTG-INPV-19)](https://softwaresecurity.com/downloads/ssrf-egress-boundaries.md): Prevent untrusted URLs from turning a preview, import, or webhook feature into access to internal services.
- [Secure error handling: fail closed without leaking details (CWE-209, CWE-636, CWE-460, CWE-489, A10:2025, API8:2023, V16.5.1, V16.5.3, V13.4.2, WSTG-ERRH-01, WSTG-ERRH-02)](https://softwaresecurity.com/downloads/secure-error-handling.md): Give callers a useful, bounded response while preserving protected diagnostic evidence and safe application state.
- [Security misconfiguration and information disclosure (CWE-200, CWE-209, CWE-215, CWE-489, CWE-548, CWE-527, CWE-538, A02:2025, V13.4, V16.5.1, WSTG-CONF-02, WSTG-CONF-04, WSTG-CONF-05, WSTG-ERRH-01)](https://softwaresecurity.com/downloads/information-disclosure-misconfiguration.md): Turn off debug output, publish an allowlisted build and probe each deployment for exposed files and endpoints.
- [Coordinated vulnerability disclosure: intake to advisory](https://softwaresecurity.com/downloads/coordinated-disclosure.md): Make private reporting discoverable, verify reports, coordinate a tested remedy, and give affected users enough information to act.
- [CSRF protection: Fetch Metadata, tokens and SameSite (CWE-352, CWE-1275, A01:2025, V3.3.2, V3.3.3, V3.5.1, V3.5.2, V3.5.3, CAPEC-62, WSTG-SESS-05)](https://softwaresecurity.com/downloads/csrf-origin-defense.md): Make the server distinguish an intended action from a request another site caused the browser to send.
- [CORS and CSP configuration: exact origins and strict CSP (CWE-942, CWE-346, CWE-1021, A02:2025, API8:2023, V3.4.2, V3.4.3, V3.4.6, V3.4.7, V3.5.2, WSTG-CLNT-07)](https://softwaresecurity.com/downloads/cors-csp-browser-boundaries.md): Control who can read API responses and which resources a page may execute without confusing either control with authorization.
- [HTML sanitization: DOMPurify, setHTML and Trusted Types (CWE-79, CWE-346, A05:2025, V1.3.1, V1.3.5, V3.2.2, V3.2.3, V3.5.5, CAPEC-588, CAPEC-592)](https://softwaresecurity.com/downloads/rich-text-dom-security.md): Choose text rendering or a restricted HTML policy, then test the final DOM after every transformation.
- [Mass assignment and BOPLA: field and function authorization (CWE-915, CWE-213, CWE-862, CWE-863, A01:2025, A08:2025, API3:2023, API5:2023, V8.2.1, V8.2.3, V15.3.1, V15.3.3)](https://softwaresecurity.com/downloads/function-property-authorization.md): Prevent mass assignment, sensitive-field exposure and administrative actions that a valid object lookup alone cannot protect.
- [Race conditions: prevent double spending with atomic updates (CWE-362, CWE-367, CWE-837, A06:2025, V2.3.3, V2.3.4, V15.4.2, CAPEC-26, CAPEC-29)](https://softwaresecurity.com/downloads/transaction-races.md): Make a balance, reservation or approval rule hold when requests overlap, retry and fail halfway through.
- [Command injection, XXE, NoSQL and unsafe deserialization (CWE-78, CWE-88, CWE-94, CWE-611, CWE-502, CWE-943, CWE-90, CWE-1336, CWE-917, A05:2025, A08:2025, A02:2025, V1.2.4, V1.2.5, V1.2.6, V1.3.2, V1.3.7, V1.5.1, V1.5.2, CAPEC-88, CAPEC-201, CAPEC-586, CAPEC-676, CAPEC-136, CAPEC-242)](https://softwaresecurity.com/downloads/injection-parser-boundaries.md): Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
- [Prevent OS command and argument injection (CWE-78, CWE-77, CWE-88, A05:2025, V1.2.5, V1.2.8, V2.2.1, CAPEC-88, CAPEC-6, CAPEC-248, WSTG-INPV-12)](https://softwaresecurity.com/downloads/os-command-injection.md): Run programs from an argument list with no shell, end options before user values, and keep untrusted arguments away from Windows batch files.
- [Prevent code injection and server-side template injection (CWE-94, CWE-95, CWE-1336, CWE-917, A05:2025, V1.3.2, V1.3.7, CAPEC-242, WSTG-INPV-11, WSTG-INPV-18)](https://softwaresecurity.com/downloads/code-template-injection.md): Keep code and templates constant, pass input as data, and treat in-process sandboxes as one layer, not a boundary.
- [Zip Slip and archive path traversal: safe extraction (CWE-22, CWE-23, CWE-36, CWE-59, CWE-409, A01:2025, API4:2023, V5.2.3, V5.2.5, V5.3.3, CAPEC-126, CAPEC-139, CAPEC-597)](https://softwaresecurity.com/downloads/archive-path-safety.md): Prevent traversal, link tricks, overwrites and decompression exhaustion while preserving legitimate file extraction.
- [Convert untrusted DOCX, XLSX and PDF files safely (CWE-611, CWE-409, CWE-918, CWE-22, CWE-400, A02:2025, A01:2025, V5.2.2, V5.2.3, V1.5.1, V15.2.5)](https://softwaresecurity.com/downloads/untrusted-document-conversion.md): DOCX, XLSX and ODF files are ZIP archives of XML, and PDFs can carry scripts; the converters that read them are large C and C++ programs with a long CVE history. Check the package before any parser reads it, convert each document in a container with no network, no writable root and hard limits, kill it at a deadline, and re-render to pixels when people will open the result.
- [WebRTC security: signaling, TURN, ICE and DTLS-SRTP (CWE-441, CWE-770, CWE-295, CWE-359, V17, V17.1.1, V17.1.2, V17.2.1, V17.2.2, V17.2.3, V17.2.4, V17.2.5, V17.2.6, V17.2.7, V17.2.8, V17.3.1, V17.3.2)](https://softwaresecurity.com/downloads/webrtc-security.md): WebRTC encrypts media, but signaling decides whose keys you trust and TURN relays wherever it is allowed. Authorize every signaling message, mint short-lived TURN credentials, deny internal addresses and harden media servers.
- [Security code review: trace a pull request's boundaries (CWE-862, CWE-639, A01:2025, API1:2023, V8.2.2, V8.3.1)](https://softwaresecurity.com/downloads/security-code-review.md): Turn a pull request into a small set of security claims that can be checked against the surrounding system and tests.
- [SAST and DAST workflow: Semgrep, SARIF and ZAP scans (A05:2025)](https://softwaresecurity.com/downloads/sast-dast-workflow.md): Use analysis tools to find evidence, then retain an application regression that demonstrates the failure and the fix.
- [Parser fuzzing: libFuzzer, AFL++ and Go fuzz harnesses (CWE-130, CWE-125, CWE-1284, V1.4.1, V1.4.2, CAPEC-28)](https://softwaresecurity.com/downloads/parser-fuzzing.md): Build a narrow harness, observe memory and resource failures, minimize the input, and test the repaired parser.
- [Framework security settings: Django, Spring, ASP.NET Core (CWE-1188, CWE-288, CWE-489, CWE-352, A02:2025, A01:2025, V13.4.2, V3.3.1, V3.4.1, V3.4.3, V15.3.4)](https://softwaresecurity.com/downloads/framework-security-patterns.md): Trace middleware, persistence and rendering so custom code does not bypass the protections supplied by the framework.
- [Android and iOS app security: storage, links and backups (CWE-926, CWE-939, CWE-922, CWE-532, CWE-295)](https://softwaresecurity.com/downloads/android-ios-security.md): Keep local artifacts and platform entry points from exposing authority that belongs on the server.
- [Electron security: IPC, contextBridge, fuses, openExternal (CWE-749, CWE-346, CWE-940, A01:2025)](https://softwaresecurity.com/downloads/electron-native-security.md): Keep renderer content, local callers and plugins from turning a narrow feature into unrestricted operating-system access.
- [Secure firmware updates: signing, rollback and A/B recovery (CWE-494, CWE-347, CWE-1277, CWE-1329, A08:2025, A03:2025)](https://softwaresecurity.com/downloads/embedded-update-security.md): Connect trusted boot, update authorization, rollback policy and end-of-life behavior to the device’s actual failure modes.
- [Smart contract reentrancy: invariants and Foundry tests (CWE-1265, CWE-841)](https://softwaresecurity.com/downloads/smart-contract-invariants.md): Define the properties funds and privileges must preserve, then exercise callbacks, transaction sequences and exceptional conditions locally.
- [Safe JSON and XML parsing: limits, duplicate keys and XXE (CWE-20, CWE-502, CWE-611, CWE-776, CWE-770, A05:2025, A08:2025, A02:2025, API4:2023, V1.5.1, V1.5.2, V1.5.3, V2.2.1)](https://softwaresecurity.com/downloads/bounded-json-xml-parsing.md): Separate parser capabilities from schema rules, reject ambiguous and coercible inputs, and implement the boundary in a complete Python project.
- [Prototype pollution in JavaScript: prevent and test it (CWE-1321, CWE-915, A08:2025, A05:2025, API3:2023, V15.3.6, V15.3.3)](https://softwaresecurity.com/downloads/prototype-pollution-boundaries.md): Trace an actual nested-merge mutation, replace it with a narrow schema, and make authorization independent of inherited properties.
- [Android secure coding in Kotlin: Keystore, NSC, intents (CWE-312, CWE-319, CWE-295, CWE-926, CWE-927, CWE-749, CWE-939, CWE-532, A01:2025, A02:2025, A04:2025, A07:2025, A08:2025)](https://softwaresecurity.com/downloads/android-secure-coding.md): Encrypt local secrets with Android Keystore keys now that Jetpack Security is deprecated, set transport policy in Network Security Configuration, close exported components and mutable PendingIntents, confine WebViews, verify App Links and judge Play Integrity verdicts on the server, mapped to OWASP MASVS 2.1.
- [Business logic vulnerabilities: prevention and testing (CWE-472, CWE-602, CWE-1284, CWE-839, CWE-837, CWE-841, CWE-640, CWE-799, A06:2025, A07:2025, API6:2023, V2.2, V2.3, V2.4, V6.4, CAPEC-162, CAPEC-74, CAPEC-50, CAPEC-212)](https://softwaresecurity.com/downloads/business-logic-flaws.md): Recompute prices on the server, run workflows as state machines, build reset links from configuration, limit valuable flows, and turn each business rule into an invariant that the database and the tests both check.
- [Log4Shell case study: CVE-2021-44228 explained (CWE-917, CWE-502, CWE-400, CWE-674, CWE-1104, A05:2025, A03:2025, A08:2025, V1, V15, CAPEC-137, CAPEC-242)](https://softwaresecurity.com/downloads/case-study-log4shell.md): How a JNDI lookup in Apache Log4j became internet-wide remote code execution, why transitive and shaded dependencies made it so hard to patch, which mitigations held, and what it teaches about dependency inventory and SBOMs.
- [CRLF injection: headers, log forging and CSV formulas (CWE-93, CWE-113, CWE-117, CWE-1236, A05:2025, A09:2025, V1.2, V4.2, V16.4, CAPEC-34, CAPEC-105, CAPEC-93, CAPEC-81)](https://softwaresecurity.com/downloads/crlf-header-log-injection.md): Carriage return and line feed separate HTTP header fields, log records and CSV rows, and a leading = turns a spreadsheet cell into a formula. Let the framework write headers, log structured JSON, and neutralize formula triggers in exports.
- [DevSecOps pipeline: where each security control belongs (CWE-798, CWE-1395, CWE-1104, CWE-494, A02:2025, A03:2025, A08:2025, V13.3, V15.1, V15.2)](https://softwaresecurity.com/downloads/devsecops-pipeline.md): Put secrets scanning, SAST, SCA, IaC and image scanning, DAST, fuzzing, attestation and admission control where each sees the right input, block only on findings a developer can act on, and deploy only images the pipeline has attested.
- [SAST vs DAST vs IAST, SCA and ASPM: choosing AppSec tools (A03:2025, A05:2025, V15.1, V15.2)](https://softwaresecurity.com/downloads/appsec-tool-categories-and-evaluation.md): What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.
- [DOM XSS and postMessage security: sinks and Trusted Types (CWE-79, CWE-95, CWE-1336, CWE-346, A05:2025, V1.2, V1.3, V3.2, V3.5, CAPEC-588, CAPEC-63)](https://softwaresecurity.com/downloads/dom-xss-postmessage.md): Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.
- [iOS secure coding in Swift: Keychain, ATS and App Attest (CWE-312, CWE-319, CWE-295, CWE-939, CWE-940, CWE-749, CWE-532, CWE-602, A01:2025, A02:2025, A04:2025, A06:2025, A07:2025)](https://softwaresecurity.com/downloads/ios-secure-coding.md): Store secrets in the Keychain with the narrowest accessibility class, set file protection explicitly, keep App Transport Security on, prefer universal links, constrain WKWebView bridges, keep step-up keys in the Secure Enclave, verify App Attest on the server and ship an accurate privacy manifest, mapped to OWASP MASVS 2.1.
- [C and C++ memory safety: fixes, hardening flags, sanitizers (CWE-787, CWE-125, CWE-416, CWE-120, CWE-121, CWE-122, CWE-476, CWE-190, A10:2025, V1.4, CAPEC-100, CAPEC-540, CAPEC-92)](https://softwaresecurity.com/downloads/memory-safety-c-cpp.md): Recognize out-of-bounds access, use after free, NULL dereference and integer overflow in C and C++, fix them with checked lengths and single ownership, harden release builds, catch the rest with sanitizers and fuzzing, and plan new code in a memory-safe language.
- [NoSQL, LDAP, XPath and SpEL injection: prevention (CWE-943, CWE-90, CWE-643, CWE-917, CWE-1287, A05:2025, V1.2, V1.3, V15.3, CAPEC-676, CAPEC-136, CAPEC-83)](https://softwaresecurity.com/downloads/nosql-ldap-xpath-injection.md): SQL is not the only query language that receives user input. Stop MongoDB operator injection with type checks and $eq, escape LDAP filter values, pass XPath values as variables, and never evaluate SpEL or OGNL built from request data.
- [Open redirect (CWE-601): prevention and safe validation (CWE-601, A01:2025, V3, V10, WSTG-CLNT-04)](https://softwaresecurity.com/downloads/open-redirect.md): Check every redirect target taken from a request, so attackers cannot borrow your domain for phishing, carry OAuth tokens off-site or steer a server-side fetcher through your redirects.
- [ReDoS and input validation: safe regex, RE2 and schemas (CWE-1333, CWE-20, CWE-1287, CWE-777, CWE-180, CWE-235, A05:2025, API4:2023, V1.1, V1.2, V1.3, V2.2, V15.3, CAPEC-492, CAPEC-460, CAPEC-267, CAPEC-71)](https://softwaresecurity.com/downloads/redos-input-validation.md): Find and fix exponential and quadratic regex backtracking with measured examples, choose linear-time engines or timeouts, and build allowlist validation that decodes once and rejects type confusion and parameter pollution.
- [Rust security: unsafe code, FFI, panics and crate audits (CWE-758, CWE-416, CWE-762, CWE-190, CWE-617, CWE-1395, CWE-1357, A03:2025, A10:2025, V1.4, V15.1, V15.2, CAPEC-538, CAPEC-100)](https://softwaresecurity.com/downloads/rust-unsafe-ffi.md): Know what the Rust compiler proves and what it leaves to you: review unsafe code for soundness, wrap foreign calls in small safe functions, decide how overflow and panics behave in release builds, gate crates with RustSec, and replace C one boundary at a time.
- [HTTP security headers: recommended values and config (CWE-1021, CWE-319, CWE-614, CWE-1004, A02:2025, A04:2025, A06:2025, API8:2023, V3, CAPEC-103, CAPEC-102, WSTG-CONF-07, WSTG-CLNT-09)](https://softwaresecurity.com/downloads/security-headers.md): Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.
- [Threat modeling methods: STRIDE, PASTA, LINDDUN compared (A06:2025)](https://softwaresecurity.com/downloads/threat-modeling-methods.md): Use the four-question frame to scope a design, pick STRIDE, attack trees, LINDDUN or PASTA by the question you need answered, and leave behind threat records and abuse-case tests the team can run.
- [VDP vs bug bounty vs pentest: when and how to run each](https://softwaresecurity.com/downloads/vdp-bug-bounty-pentest.md): Publish a vulnerability disclosure policy and security.txt first, add a bug bounty only when you can triage and fix at the pace rewards bring, and buy penetration tests with a written scope, rules of engagement and a retest.
- [MOVEit Transfer case study: CVE-2023-34362 SQL injection (CWE-89, A05:2025, CAPEC-66)](https://softwaresecurity.com/downloads/case-study-moveit.md): How one unauthenticated SQL injection in an internet-facing file transfer product let the Cl0p group steal data from thousands of organizations in days in 2023, how defenders found the web shell, and the vendor and customer controls that would have limited it.
- [Security requirements and Definition of Done (ASVS 5.0) (V2, V6, V8, V16)](https://softwaresecurity.com/downloads/security-requirements-definition-of-done.md): Derive security requirements from OWASP ASVS 5.0, abuse cases and the threat model, write them as acceptance criteria a test can fail, trace each one to a test or evidence, and close stories against a short security Definition of Done.
- [Abuse case library: attacker goals, tests and controls (CWE-307, CWE-204, CWE-640, CWE-639, CWE-862, CWE-915, CWE-434, CWE-22, CWE-362, CWE-841, CWE-345, CWE-918, CWE-1236, CWE-1427, A01:2025, A06:2025, A07:2025, API1:2023, API5:2023, API6:2023, API7:2023, LLM01:2026, LLM03:2026, CAPEC-600, CAPEC-565, CAPEC-575, CAPEC-50, CAPEC-650, CAPEC-126, CAPEC-26, CAPEC-664, CAPEC-66, CAPEC-87, CAPEC-62)](https://softwaresecurity.com/downloads/abuse-case-library.md): Recurring abuse cases for sign-up and login, password reset, MFA enrolment, invites, file upload, payments and coupons, webhooks, search, export, admin and AI chat or agents: the attacker goal, preconditions, a concrete test and the control, each linked to CWE and CAPEC.
- [Threat pattern library: recurring threats and mitigations (CWE-290, CWE-441, CWE-639, CWE-863, CWE-915, CWE-89, CWE-436, CWE-502, CWE-367, CWE-294, CWE-918, CWE-532, CWE-829, CWE-770, CWE-1427, A01:2025, A06:2025, CAPEC-21, CAPEC-1, CAPEC-66, CAPEC-33, CAPEC-586, CAPEC-29, CAPEC-664, CAPEC-141, CAPEC-538, CAPEC-130)](https://softwaresecurity.com/downloads/threat-pattern-library.md): Thirty-two recurring threat patterns grouped by identity, authorization, parsers, concurrency, integrations, data exposure, supply chain, availability and AI agents, each with where it shows up on a data-flow diagram, mitigations, a verification step and STRIDE, CWE and CAPEC links, plus a YAML catalog and a script that lists patterns per diagram element.
- [PSIRT operating model: services, intake, SLAs and CNA role](https://softwaresecurity.com/downloads/psirt-operating-model.md): How to structure and run a product security incident response team on the FIRST PSIRT Services Framework: organizational models, intake channels, triage, response targets, a case record and SLA script, becoming a CVE Numbering Authority under the CNA rules 4.2.0, and coordinating with other vendors.
- [Security advisories with CSAF 2.0, VEX, CVE and OSV (CWE-306, CWE-347)](https://softwaresecurity.com/downloads/security-advisories-csaf-vex.md): What a useful security advisory contains and how to publish it in the formats tools read: a validated CSAF 2.0 VEX document, the CSAF provider files, CVE records through a CNA (CVE Record Format 5.2), and OSV records for open-source packages. Covers the status of CSAF 2.1 as of October 2026.
- [Product security incident response plan and postmortem](https://softwaresecurity.com/downloads/product-incident-response.md): An incident response plan for product security incidents (exploited vulnerabilities, compromised releases, leaked signing keys, malicious dependencies shipped to customers), aligned with NIST SP 800-61 Rev. 3, with reporting clocks, a two-scenario tabletop exercise template and a blameless postmortem template.
- [File inclusion (LFI and RFI): causes and fixes by language (CWE-98, CWE-73, CWE-829, CWE-22, CWE-94, A05:2025, A01:2025, V5.3.1, V5.3.2, V1.3.2, V1.3.7, CAPEC-252, CAPEC-193, WSTG-INPV-11, WSTG-ATHZ-01)](https://softwaresecurity.com/downloads/file-inclusion.md): Stop request data from choosing which file, module or template your application loads: local and remote file inclusion in PHP, dynamic require() and import() in Node.js, importlib and template names in Python, Thymeleaf view names in Spring, render in Rails, and the allowlist fix that works in all of them.
- [Insecure temp files: symlink attacks and safe temp APIs (CWE-377, CWE-379, CWE-59, CWE-367, A01:2025, V15.4, V15.4.2, V5.3.2, CAPEC-27, CAPEC-29)](https://softwaresecurity.com/downloads/insecure-temp-files.md): Stop symlink, hardlink and pre-created-file attacks on the temporary files your code writes in shared directories such as /tmp: create each file atomically with O_EXCL and owner-only permissions through mkstemp or its equivalent in shell, Python, Java, Node.js, Go, .NET and Rust, keep related files in a private directory, and treat the Linux protected\_\* sysctls and systemd PrivateTmp as a backstop.
- [Consume third-party APIs safely: API10:2023 fixes (CWE-20, CWE-295, CWE-770, CWE-601, CWE-522, A03:2025, A05:2025, API10:2023, API7:2023, V1.3.6, V13.1.1, V5.4.1, CAPEC-141, CAPEC-275)](https://softwaresecurity.com/downloads/third-party-api-consumption.md): Treat every upstream and third-party API response as untrusted input: validate it against a schema, set connect and read timeouts, cap the response size, refuse to follow redirects blindly, keep TLS verification on, and scope the credentials you hold for each provider.
- [Secure design patterns catalogue: choke point to parse-first (CWE-657, CWE-862, CWE-863, CWE-636, CWE-1188, A06:2025, A01:2025, V1.2, V1.3)](https://softwaresecurity.com/downloads/secure-design-patterns.md): A catalogue of reusable secure-design patterns, grouped by concern, each with when to use it, a short example and the failure it prevents: choke-point authorization, capability tokens, parse-don't-validate, safe-by-default APIs, tenant scoping, fail-closed, idempotency, and more.
- [Mobile banking threat model: STRIDE, MASVS, mitigations (CWE-922, CWE-295, CWE-319, CWE-308, CWE-926, CWE-862, API1:2023, API2:2023, API6:2023)](https://softwaresecurity.com/downloads/threat-model-mobile-banking.md): A complete worked threat model for a mobile banking-style app: the data-flow diagram and its elements, STRIDE threats on the client, the transport and the backend, and the mitigations mapped to OWASP MASVS v2 controls and current Android and iOS platform APIs.
- [LLM agent threat model: tools, RAG, MCP and mitigations (CWE-1427, CWE-862, CWE-918, CWE-79, LLM01:2026, LLM02:2026, LLM03:2026, LLM06:2026, LLM09:2026, LLM10:2026, ASI01:2026, ASI02:2026, ASI03:2026, ASI04:2026, ASI06:2026)](https://softwaresecurity.com/downloads/threat-model-llm-agent.md): A complete worked threat model for an LLM agent with tools: the data-flow diagram, the threats from prompt injection, excessive agency, data exfiltration, confused-deputy and memory poisoning, and the mitigations, mapped to the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications 2026.
- [DeFi attacks: oracle, flash loan, proxy and signature replay (CWE-347, CWE-294, CWE-665, CWE-682)](https://softwaresecurity.com/downloads/smart-contract-defi-attacks.md): The four smart-contract attack classes beyond reentrancy: price-oracle manipulation, flash-loan amplification, upgradeable-proxy storage collisions and uninitialized implementations, and signature replay, each with vulnerable and fixed Solidity, Foundry tests and verified incidents.
- [First American EaglePro case study: an IDOR found, then lost (CWE-639, CWE-306, A01:2025, V8.2.2, V8.3.1)](https://softwaresecurity.com/downloads/case-study-first-american.md): How sequential IDs in unauthenticated links exposed First American's title documents in 2019, after its own penetration test found the flaw and a clerical error let it go unfixed.
- [Citrix Bleed case study: CVE-2023-4966 session theft (CWE-119, CWE-613, A07:2025, V7.4.5, CAPEC-593)](https://softwaresecurity.com/downloads/case-study-citrix-bleed.md): How a NetScaler memory over-read leaked session cookies that bypassed passwords and MFA in 2023, why patching did not end hijacked sessions, and how the pattern returned in 2025.
- [Spring4Shell case study: CVE-2022-22965 data binding RCE (CWE-94, CWE-915, A05:2025, A03:2025, CAPEC-242)](https://softwaresecurity.com/downloads/case-study-spring4shell.md): How Spring's data binding let request parameters reach the class loader on JDK 9 and later in 2022, why the denylist workaround leaked, and what it teaches about framework-level mass assignment.
- [CrowdStrike Channel File 291 case study (July 2024) (CWE-125, CWE-129, A10:2025)](https://softwaresecurity.com/downloads/case-study-crowdstrike-channel-file-291.md): How a CrowdStrike content update crashed Windows hosts in July 2024: a field-count mismatch hidden by wildcard tests, a missing bounds check, and no staged rollout.

## Software supply chain

Know what you ship. Protect dependencies, build systems, artifacts, and their provenance.

- [GitHub Actions build integrity: PR jobs vs release jobs (CWE-829, A03:2025, A08:2025, CAPEC-444)](https://softwaresecurity.com/downloads/ci-build-integrity.md): Separate untrusted contribution checks from privileged release work and verify the identity of the artifact that is actually deployed.
- [SBOM generation: Syft, Trivy and CISA 2026 elements (A03:2025, V15.1.2)](https://softwaresecurity.com/downloads/sbom-generation.md): Define the inventory boundary, compare build and artifact evidence, and connect the resulting SBOM to an immutable release.
- [SBOM formats and identifiers: CycloneDX, SPDX, purl, CPE (A03:2025)](https://softwaresecurity.com/downloads/sbom-formats-identifiers.md): Separate schema versions, document references and package identities so inventory conversion and advisory matching preserve meaning.
- [SBOM diff between releases: upgrades, swaps, corrections (A03:2025)](https://softwaresecurity.com/downloads/sbom-release-diff.md): Turn inventory differences into explainable release decisions without confusing generator changes with software changes.
- [Dependency vulnerability triage: routine scanner findings (CWE-1395, CWE-1104, A03:2025, V15.1.1, V15.2.1)](https://softwaresecurity.com/downloads/dependency-risk-triage.md): Turn a weekly batch of Dependabot, OSV-Scanner or npm audit findings into a short list of distinct, shipped, reachable issues, each routed to one outcome: fix, not affected, accept or escalate.
- [Verify cosign signatures against identity and issuer (CWE-347, A03:2025, A08:2025, CAPEC-206)](https://softwaresecurity.com/downloads/artifact-signature-policy.md): Require the expected artifact, signer and release context before allowing a signed package or image to proceed.
- [Verify SLSA provenance: buildType, parameters, builder (CWE-494, A03:2025, A08:2025, CAPEC-444)](https://softwaresecurity.com/downloads/slsa-provenance.md): Connect an artifact to its build evidence while distinguishing provenance, build assurance and source controls.
- [GitHub Actions script injection and workflow_run artifacts (CWE-78, CWE-94, CWE-829, A03:2025, A05:2025, A08:2025, CAPEC-88, CAPEC-242)](https://softwaresecurity.com/downloads/ci-untrusted-workflows.md): Review workflow authority, persistent state and artifact handoffs before contributor-controlled code reaches privileged jobs.
- [Malicious npm package response and dependency confusion (CWE-506, CWE-1357, A03:2025, A08:2025, V15.2.4, CAPEC-538)](https://softwaresecurity.com/downloads/package-attack-response.md): Distinguish package substitution, publisher compromise and dangerous installation behavior while containing exposure and preserving evidence.
- [VEX statements: OpenVEX, CSAF and CycloneDX in practice (A03:2025)](https://softwaresecurity.com/downloads/vex-decisions.md): Produce and consume precise vulnerability status statements tied to the product, version, justification and evidence.
- [Reproducible builds: SOURCE_DATE_EPOCH, tar and diffoscope (A03:2025, A08:2025)](https://softwaresecurity.com/downloads/reproducible-builds.md): Control inputs and environment, compare artifact bytes, and explain the security properties a repeatable build can demonstrate.
- [Open source dependency health: Scorecard and provenance (CWE-1104, CWE-1357, A03:2025, V15.1.2, V15.1.4)](https://softwaresecurity.com/downloads/dependency-project-health.md): Combine security practices, maintenance, licensing and product exposure into a recorded adoption or replacement decision.
- [Trusted publishing for npm and PyPI: OIDC, tokens, updates (CWE-494, A03:2025, A08:2025, CAPEC-657)](https://softwaresecurity.com/downloads/trusted-publishing-updates.md): Constrain release identities, verify what consumers receive, and prepare for publisher or update-key compromise.
- [Shai-Hulud npm worm case study: how it spread (CWE-506, CWE-829, CWE-1357, CWE-522, A03:2025, A08:2025, V15.2, V13.3, CAPEC-538, CAPEC-511)](https://softwaresecurity.com/downloads/case-study-shai-hulud.md): How a self-replicating npm worm turned stolen tokens into hundreds of infected packages in 2025, how its 2026 successors hijacked release pipelines and trusted publishing, what npm and GitHub changed in response, and the publishing, install and response practices that stop it.
- [tj-actions/changed-files case study: CVE-2025-30066 (CWE-506, CWE-829, CWE-494, CWE-532, A03:2025, A08:2025, V13.3, CAPEC-538, CAPEC-439)](https://softwaresecurity.com/downloads/case-study-tj-actions.md): In March 2025 an attacker moved the version tags of a popular GitHub Action, and of a reviewdog action before it, to code that printed CI secrets into build logs. This case study traces the token chain back to one pull_request_target workflow, sizes the exposure, and shows how it was caught and which controls held.
- [xz Utils backdoor case study: CVE-2024-3094 (CWE-506, CWE-912, CWE-1357, CWE-494, A03:2025, A08:2025, V15, CAPEC-444, CAPEC-538)](https://softwaresecurity.com/downloads/case-study-xz-utils.md): How a multi-year maintainer takeover planted a backdoor in xz Utils release tarballs, how build-time injection hid it from the git repository, why a performance anomaly exposed it, which systems shipped it, and what it teaches about reproducible builds and maintainer health.
- [SolarWinds SUNBURST case study: a compromised build (CWE-506, CWE-912, A03:2025, A08:2025, CAPEC-444, CAPEC-511, CAPEC-206)](https://softwaresecurity.com/downloads/case-study-solarwinds.md): How an implant on SolarWinds' build server inserted the SUNBURST backdoor into signed Orion updates in 2020, how it was found, why code signing and review could not catch it, and which build controls would have.
- [Codecov Bash Uploader compromise: 2021 case study (CWE-494, CWE-506, A03:2025, A08:2025, CAPEC-439)](https://softwaresecurity.com/downloads/case-study-codecov.md): How a credential leaked through Codecov's Docker image process let an attacker change the Bash Uploader that many CI pipelines downloaded and ran, which sent their environment variables, and the secrets in them, to the attacker for two months in 2021.
- [3CX supply-chain attack case study: CVE-2023-29059 (CWE-506, A03:2025, A08:2025, CAPEC-511, CAPEC-444, CAPEC-206)](https://softwaresecurity.com/downloads/case-study-3cx.md): How a trojanized trading application on one employee's personal computer led to 3CX's build servers and to signed, malicious 3CX DesktopApp releases in 2023: the first cascading software supply-chain compromise Mandiant had seen, how EDR caught it, and the controls that would have stopped it.
- [event-stream and ua-parser-js: npm takeover case study (CWE-506, CWE-829, CWE-1357, A03:2025, A08:2025, CAPEC-538)](https://softwaresecurity.com/downloads/case-study-event-stream.md): Two ways attackers took over popular npm packages: event-stream (2018), handed to a stranger who added a targeted, encrypted payload through a new dependency, and ua-parser-js (2021), whose maintainer's account was hijacked to publish versions that installed malware for four hours. Timelines, detection and the controls that stop both.
- [polyfill.io supply chain attack: 2024 case study (CWE-829, CWE-494, A03:2025, A08:2025)](https://softwaresecurity.com/downloads/case-study-polyfill-io.md): How the sale of the polyfill.io domain and project in February 2024 turned a script tag on more than 100,000 websites into a channel for malicious redirects by June, why Subresource Integrity could not have protected it, and the controls that would have.
- [Dependency confusion: prevention and hardening (CWE-427, CWE-494, CWE-829, CWE-1104, CWE-1357, A03:2025, A08:2025, LLM04:2026, V15.2.4, V15.1.2, CAPEC-471, CAPEC-538)](https://softwaresecurity.com/downloads/dependency-confusion.md): Pin every internal package name to its real source, verify installed bytes against a lockfile, and delay or gate install scripts so a public look-alike cannot replace a private dependency.
- [GitHub Actions hardening: a security guide (CWE-94, CWE-95, CWE-116, CWE-829, CWE-275, CWE-349, A08:2025, A03:2025, A05:2025, V1.2.5, V13.3.1, V13.3.2, CAPEC-88, CAPEC-538)](https://softwaresecurity.com/downloads/github-actions-hardening.md): Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.
- [Source repository security: rulesets, signed commits, SLSA (CWE-284, CWE-1357, A03:2025, A08:2025, V15)](https://softwaresecurity.com/downloads/source-repository-protection.md): Configure the controls every repository that ships software needs: protected branches and tags, required review with CODEOWNERS, signed commits, secret push protection and account security, mapped to the SLSA Source track, the OpenSSF OSPS Baseline and Scorecard.
- [Developer workstation security: extensions, scripts, agents (CWE-506, CWE-829, CWE-522, A03:2025, A08:2025)](https://softwaresecurity.com/downloads/developer-workstation-security.md): Attackers reach the software supply chain through developers' editors, package installs and AI agents. Allow-list extensions, stop install scripts and brand-new versions, keep long-lived secrets off laptops, and lock down repository files that run code when a project opens.
- [Open source license compliance: SPDX, obligations, SBOMs](https://softwaresecurity.com/downloads/open-source-license-compliance.md): Know which licenses you ship, read SPDX license expressions correctly, meet the obligations of common licenses for the way you distribute, and enforce a license policy in CI from the SBOM.
- [OSPS Baseline for maintainers: levels, controls, evidence](https://softwaresecurity.com/downloads/osps-baseline-maintainers.md): Walk through the eight control families and three maturity levels of OSPS Baseline v2026.08.28, meet each Level 1 requirement on a GitHub repository, and keep evidence a consumer can check.
- [S2C2F: practices, maturity levels and an adoption plan](https://softwaresecurity.com/downloads/s2c2f-consumer-adoption.md): Assess how your organization takes in open source against the Secure Supply Chain Consumption Framework's 25 requirements, then reach each maturity level in turn with evidence an assessor can check.
- [Staged rollout and rollback for security updates](https://softwaresecurity.com/downloads/staged-rollout-rollback.md): Ship security fixes, detection content and configuration quickly without taking the fleet down: rollout rings and canaries, content validation, kill switches and rollback that works on a broken host.

## Runtime, cloud & APIs

Control exposure, contain failures, and defend applications in their operating environment.

- [Terraform security review: plans, OPA policy and state (CWE-732, CWE-312, A02:2025, V13.2.2, V13.3.1, V13.3.2)](https://softwaresecurity.com/downloads/iac-review.md): Inspect the effective permissions, exposure, sensitive state, and recovery implications of a proposed infrastructure change.
- [API rate limiting and resource limits: 429 and deadlines (CWE-770, CWE-400, A06:2025, API4:2023, V15.1.3, V15.2.2)](https://softwaresecurity.com/downloads/api-resource-limits.md): Protect availability and operating cost with limits on input, per-request work, concurrency, queues, and downstream spending.
- [Security logging: events, log injection and redaction (CWE-117, CWE-532, CWE-778, A09:2025, V16.2.1, V16.2.5, V16.3.2, V16.4.1, V16.4.3)](https://softwaresecurity.com/downloads/security-logging.md): Record meaningful decisions with consistent structure, protect the resulting evidence, and prove that important events reach an operational owner.
- [Kubernetes pod security: securityContext, PSA and RBAC (CWE-250, A02:2025)](https://softwaresecurity.com/downloads/kubernetes-workload-security.md): Review pod settings, service accounts and effective permissions together before treating a namespace as an isolation boundary.
- [Kubernetes NetworkPolicy default deny and admission policy (A02:2025, A08:2025)](https://softwaresecurity.com/downloads/container-network-admission.md): Verify allowed traffic and rejected deployments in the cluster instead of treating policy files as evidence of isolation.
- [Cloud IAM role trust: GitHub OIDC for AWS, GCP and Azure (CWE-863, CWE-284, A02:2025, A01:2025)](https://softwaresecurity.com/downloads/cloud-iam-trust.md): Distinguish who can obtain a cloud identity from what that identity can do, then test the effective access path.
- [Terraform drift detection and policy as code with OPA (A02:2025)](https://softwaresecurity.com/downloads/iac-policy-drift.md): Connect source configuration, the proposed plan and deployed resources so a safe review does not become stale after deployment.
- [Subdomain takeover: find and prevent dangling DNS (A02:2025, V3.3.3, V3.4.2, V10.4.1, WSTG-CONF-10)](https://softwaresecurity.com/downloads/subdomain-takeover.md): A DNS record that outlives its cloud resource lets whoever claims the name serve content on your domain. Bind records to resources in IaC, remove the record first, verify domains and scan for dangling records.
- [API inventory and gateway bypass: trusted headers (CWE-290, CWE-348, CWE-306, A01:2025, A07:2025, API9:2023, API2:2023, API8:2023, V4.1.3)](https://softwaresecurity.com/downloads/api-gateway-inventory.md): Connect documented routes, deployed listeners and backend trust so retired or direct paths do not bypass the intended controls.
- [GraphQL, WebSocket and gRPC security: limits and authz (CWE-770, CWE-1385, CWE-307, API4:2023, API2:2023, V4.3.1, V4.3.2, V4.4.1, V4.4.2)](https://softwaresecurity.com/downloads/protocol-api-security.md): Carry authorization and resource budgets past the initial HTTP request into resolvers, messages and long-lived streams.
- [Idempotent background jobs: retries, DLQs and limits (CWE-770, A10:2025, API4:2023, API10:2023, V15.2.2, V16.5.2)](https://softwaresecurity.com/downloads/bounded-background-work.md): Keep queues, workers and paid dependencies within a defined budget when clients retry, cancel or disappear.
- [Service mesh mTLS and authorization: Istio and Lambda (CWE-863, A01:2025, A07:2025, API5:2023, API2:2023, V12.3.3, V12.3.5, V8.2.1)](https://softwaresecurity.com/downloads/workload-mtls-serverless.md): Use service identities, mutual TLS and function permissions without mistaking an encrypted connection for complete authorization.
- [Kubernetes and cloud threat detection: audit logs to alerts (CWE-778, A09:2025, V16)](https://softwaresecurity.com/downloads/runtime-detection-response.md): Collect evidence that answers a concrete security question and rehearse the response without destroying the facts needed to investigate.
- [WAF tuning with OWASP CRS: exclusions, paranoia, bots (A07:2025, API6:2023, API2:2023, V2.4.1, V6.3.1)](https://softwaresecurity.com/downloads/edge-waf-bot-defense.md): Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.
- [HTTP request smuggling: prevent desync between proxies (CWE-444, A06:2025, API8:2023, V4.2.1, V4.2.2, V4.2.3, CAPEC-33)](https://softwaresecurity.com/downloads/http-request-desynchronization.md): Trace framing disagreements, reject ambiguous requests and verify what reaches the origin with a real loopback proxy project.
- [Web cache poisoning and cache deception: prevent leaks (CWE-524, A01:2025, A02:2025, API8:2023, V14.2.2, V14.2.5, CAPEC-141)](https://softwaresecurity.com/downloads/cache-poisoning-deception.md): Define lookup and storage policy, trace cache/origin interpretation differences and verify both public reuse and private isolation.
- [AWS, Azure and Google Cloud security baseline in Terraform (CWE-1188, CWE-732, CWE-918, CWE-798, CWE-778, A02:2025, A01:2025, A09:2025, A07:2025, V13.2, V13.3, V16.4, CAPEC-664, CAPEC-560)](https://softwaresecurity.com/downloads/cloud-provider-baselines.md): Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.
- [Runtime threat detection: Falco, Tetragon, GuardDuty (CWE-778, A09:2025, V16)](https://softwaresecurity.com/downloads/runtime-threat-detection.md): Watch process, file and network activity inside containers with an eBPF sensor or a managed cloud agent, write and test rules for the attacks you expect, tune them with narrow exceptions and contain a compromised pod without destroying evidence.
- [EKS, AKS and GKE hardening: managed Kubernetes security (CWE-250, CWE-269, CWE-1188, CWE-284, A02:2025, A01:2025, V13)](https://softwaresecurity.com/downloads/managed-kubernetes-hardening.md): Know what your provider secures and what you still own, then lock down API access, cloud identity, nodes, pod privileges and admission with settings that are generally available in Kubernetes 1.37, checked against the CIS and NSA/CISA baselines.
- [Layer 7 DDoS defense: Slowloris, HTTP/2 floods, limits (CWE-400, CWE-770, API4:2023, CAPEC-469, CAPEC-488)](https://softwaresecurity.com/downloads/l7-ddos-resilience.md): Bound every phase of an HTTP request, patch for the HTTP/2 attack classes, rate limit at the edge and the origin, and shed load deliberately, with nginx, Envoy and Node.js settings tested against slow clients and bursts.
- [CSPM, CWPP, CIEM, CNAPP, DSPM and ASPM explained (CWE-1188, CWE-732, CWE-250, A02:2025, A01:2025)](https://softwaresecurity.com/downloads/cloud-security-posture.md): What CSPM, CWPP, CIEM, CNAPP, DSPM and ASPM each find and miss, how they overlap, how to evaluate one on your own accounts, and how zero trust as defined in NIST SP 800-207 uses what they measure.
- [Container image hardening: Dockerfile, signing, runtime (CWE-250, CWE-538, CWE-494, CWE-1395, A02:2025, A03:2025, A08:2025, V13, V15)](https://softwaresecurity.com/downloads/container-image-hardening.md): Build minimal, non-root images pinned by digest, keep secrets out of every layer, then scan, sign and verify the exact digest before it runs with dropped privileges.
- [Harden images against CIS and STIG with OpenSCAP (CWE-1188, A02:2025)](https://softwaresecurity.com/downloads/image-hardening-benchmarks.md): Hold each image your team ships (container base images, golden VM images, Kubernetes node images) to a published benchmark through a pinned SCAP Security Guide profile, scan every build with OpenSCAP, and fail the build on any failure that a deviation register does not explain with an owner, an approver and an expiry.
- [ingress-nginx CVE-2025-1974 case study: admission webhook (CWE-653, CWE-306, CWE-94, A02:2025, A05:2025)](https://softwaresecurity.com/downloads/case-study-ingress-nginx.md): How an admission webhook open to the whole Pod network made ingress-nginx's configuration-injection bugs a 9.8 cluster-takeover risk in 2025, and what its 2026 retirement means.
- [CircleCI 2023 breach case study: a stolen session to secrets (CWE-294, CWE-522, CWE-798, A07:2025, A04:2025, V13.2.1, V13.3.1)](https://softwaresecurity.com/downloads/case-study-circleci-2023.md): How a session stolen from one engineer's laptop reached CircleCI's production systems and customers' stored secrets in 2023, and what platform operators and CI users should change.
- [Microsoft SAS token exposure case study (2023) (CWE-732, CWE-798, A02:2025, A01:2025, V13.3.2, V13.3.4)](https://softwaresecurity.com/downloads/case-study-microsoft-sas-token.md): How an over-permissive Azure Storage SAS token in a public repository for AI models exposed internal Microsoft data in 2023, and how to scope, scan for and revoke signed URLs.

## Identity & cryptography

Understand trust, protect sensitive data, and learn why cryptographic systems fail.

- [Secrets management: rotation and leaked-secret response (CWE-798, CWE-522, CWE-532, A04:2025, A09:2025, V11.5.1, V13.1.4, V13.3.1, V13.3.2, V13.3.4)](https://softwaresecurity.com/downloads/secret-handling.md): Follow one application credential from issuance through caching, rotation, revocation and restored backups, prove that its old value stops working, and respond correctly when a secret leaks.
- [ECB mode encryption: why it leaks and what to use instead (CWE-327, A04:2025, V11.3.1, V11.3.2, V11.3.3)](https://softwaresecurity.com/downloads/crypto-ecb.md): Derive exactly what ECB reveals and why a longer key cannot fix it, find where ECB enters real code, and replace it with an authenticated mode.
- [Padding oracle attacks: how CBC leaks and how to stop it (CWE-327, CWE-353, CWE-208, A04:2025, V11.2.5, V11.3.3, V11.3.5)](https://softwaresecurity.com/downloads/crypto-padding-oracle.md): Use a byte-level CBC example to see how a tiny validity signal becomes plaintext information, then design verification that checks more than the error message.
- [Hash collisions and signatures: MD5, SHA-1 and what to use (CWE-328, CWE-327, CWE-347, A04:2025, V11.4.1, V11.4.3)](https://softwaresecurity.com/downloads/crypto-hash-collisions.md): Distinguish collisions from preimages, follow a colliding pair through signing and verification, and retire MD5 and SHA-1 from the verifiers that still accept them.
- [Weak RSA keys: shared primes, ROCA and safe key generation (CWE-331, CWE-326, A04:2025, V11.6.1, V11.2.3, V11.5.1)](https://softwaresecurity.com/downloads/crypto-weak-rsa.md): Recover a toy RSA factor with a greatest common divisor, distinguish shared primes, structured primes, duplicate keys and key length, and check a fleet of real public keys.
- [RC4 keystream bias: why RC4 is banned from TLS (CWE-327, A04:2025, V11.3.2, V12.1.2)](https://softwaresecurity.com/downloads/crypto-rc4.md): Understand why fresh RC4 keys do not remove keystream bias and how repeated secret positions turn a small statistical effect into evidence.
- [64-bit block ciphers: the Sweet32 birthday bound explained (CWE-327, CWE-326, A04:2025, V11.3.2, V12.1.2)](https://softwaresecurity.com/downloads/crypto-sweet32-mechanism.md): Calculate the birthday effect for 64-bit blocks and derive the CBC relation that can turn a collision into a plaintext disclosure.
- [WEP: why RC4 key reuse broke Wi-Fi security (CWE-323, CWE-327, CWE-353, A04:2025, V11.3.3, V11.3.4)](https://softwaresecurity.com/downloads/icdp-case-wep-2001.md): Separate WEP’s repeated-keystream failure, weak-IV key recovery, and unkeyed integrity weakness through a concrete two-packet exercise.
- [Flame malware: MD5 collision and certificate forgery (CWE-328, CWE-295, A04:2025, A08:2025, V11.4.1, V11.4.3)](https://softwaresecurity.com/downloads/icdp-case-flame-2012.md): Follow how a weak digest and an overpowered certificate trust path enabled forged code-signing authority, without equating the event with RSA key theft.
- [Lucky Thirteen and POODLE: TLS CBC padding oracles (CWE-757, CWE-208, CWE-327, A04:2025, V12.1.1, V12.1.2, V11.2.5)](https://softwaresecurity.com/downloads/icdp-case-lucky13-poodle.md): Compare two CBC oracles by their signal, protocol rules, and attacker prerequisites instead of treating them as interchangeable padding bugs.
- [FREAK and Logjam: export-grade TLS downgrade attacks (CWE-757, CWE-326, A04:2025, V11.6.2, V12.1.1, V12.1.2)](https://softwaresecurity.com/downloads/icdp-case-freak-logjam-2015.md): Trace two export-grade downgrade paths and separate RSA factorization from finite-field Diffie–Hellman discrete logarithms.
- [DROWN attack: SSLv2, shared RSA keys and Bleichenbacher (CWE-327, A04:2025, V11.3.1, V12.1.1, V12.1.2)](https://softwaresecurity.com/downloads/icdp-case-drown-2016.md): Map an RSA key across services to see how an SSLv2 oracle could compromise TLS traffic on a different endpoint.
- [Sweet32 attack: recovering cookies from 3DES traffic (CWE-327, CWE-326, A04:2025, V12.1.2)](https://softwaresecurity.com/downloads/icdp-case-sweet32-2016.md): Read the 2016 Sweet32 demonstrations as evidence about traffic volume, repeated secrets, and session lifetime rather than treating a block-size threshold as an instant exploit.
- [ROCA vulnerability: weak RSA keys from Infineon chips (CWE-1240, CWE-326, A04:2025, V11.6.1)](https://softwaresecurity.com/downloads/icdp-case-roca-2017.md): Understand why mathematically structured RSA primes were factorable despite normal key lengths, then plan replacement around generation provenance.
- [Session management: cookie settings, timeouts, revocation (CWE-384, CWE-613, CWE-614, CWE-1004, CWE-1275, A07:2025, API2:2023, V7.2.3, V7.2.4, V7.3.1, V7.3.2, V7.4.1, V7.4.2, V7.5.1, V3.3.1, V3.3.3, CAPEC-60, CAPEC-61, CAPEC-593)](https://softwaresecurity.com/downloads/authentication-session-lifecycle.md): Model authentication as transitions in server authority, set session cookies and timeouts to current NIST and OWASP values, and verify fixation prevention, expiry, reauthentication, revocation and stolen-cookie defenses.
- [Password hashing: Argon2id, scrypt, bcrypt and PBKDF2 (CWE-916, CWE-759, CWE-760, CWE-257, CWE-521, A04:2025, A07:2025, API2:2023, V6.2.1, V6.2.8, V6.2.9, V6.2.12, V11.4.2, CAPEC-16, CAPEC-49, CAPEC-55)](https://softwaresecurity.com/downloads/password-storage.md): Choose Argon2id, scrypt, PBKDF2 or bcrypt with current minimum parameters, store a versioned hash, and upgrade old hashes after a successful login without overwriting a reset.
- [OAuth 2.0 and OIDC login: authorization code with PKCE (CWE-352, CWE-601, CWE-346, CWE-294, A07:2025, API2:2023, V10.1.1, V10.2.1, V10.2.2, V10.4.1, V10.4.5, V10.5.1, V10.5.2, V10.5.4)](https://softwaresecurity.com/downloads/oauth-oidc-login.md): Implement OAuth 2.0 and OpenID Connect login with the authorization code flow and PKCE, keep each transaction bound to its browser, and block redirect, mix-up, code-injection and token-theft attacks.
- [JWT validation: algorithms, keys and claims (CWE-347, CWE-290, CWE-918, A07:2025, A04:2025, API2:2023, V9.1.1, V9.1.2, V9.1.3, V9.2.1, V9.2.2, V9.2.3, CAPEC-475)](https://softwaresecurity.com/downloads/jwt-validation-rollover.md): Validate a JWT against a fixed algorithm, trusted keys and the expected issuer, audience and type, reject the known header attacks, and rotate signing keys without accepting arbitrary keys or breaking valid tokens.
- [Passkeys and WebAuthn: registration, sign-in and AAL rules (CWE-308, CWE-294, CWE-1390, A07:2025, API2:2023, V6.3.3, V6.4.3, V6.5.1, V6.6.1, V6.6.4, V6.7.2)](https://softwaresecurity.com/downloads/passkeys-mfa-lifecycle.md): Register, verify and replace passkeys with WebAuthn so phishing resistance survives the account’s whole lifecycle, and map passkeys and other MFA methods to the NIST SP 800-63B-4 assurance levels.
- [Password reset and account recovery: secure design (CWE-640, CWE-362, CWE-204, A07:2025, API2:2023, V6.3.7, V6.3.8, V6.4.3, V6.4.4, V7.4.3, V11.5.1, CAPEC-50)](https://softwaresecurity.com/downloads/account-recovery-linking.md): Treat password resets, support-desk recovery and account linking as new grants of authority: single-use high-entropy proofs, atomic consumption, session revocation, and stable identity rather than email matching.
- [AES-GCM safely: nonces, associated data and the 2^32 limit (CWE-323, CWE-327, CWE-353, A04:2025, V11.2.1, V11.3.2, V11.3.3, V11.3.4)](https://softwaresecurity.com/downloads/aead-record-design.md): Build an encrypted record whose tag binds ciphertext to the intended tenant, record, purpose and format, keep nonces unique within each key’s usage limit, and verify the design with actual AES-GCM.
- [Envelope encryption: rotate KMS keys without losing data (CWE-324, CWE-323, CWE-321, A04:2025, V11.1.1, V11.1.2, V11.3.3, V11.3.4, V13.3.1, V13.3.3)](https://softwaresecurity.com/downloads/envelope-encryption-rotation.md): Encrypt each record with its own data key, wrap that key in a KMS or HSM key, and keep wrapping-key rotation, data re-encryption, key deletion and restored backups as separate, tested operations.
- [TLS configuration and certificate renewal in 2026 (CWE-295, CWE-297, CWE-298, CWE-319, A04:2025, A07:2025, API8:2023, V12.1.1, V12.1.2, V12.2.2, V12.3.2, V12.3.4, V3.4.1, CAPEC-94)](https://softwaresecurity.com/downloads/tls-pki-operations.md): Configure a modern TLS profile with hybrid post-quantum key exchange, automate renewal for certificate lifetimes that fall to 47 days, and verify every termination point with a fresh handshake.
- [Workload identity federation: GitHub Actions OIDC trust (CWE-863, CWE-290, A07:2025, A01:2025, API2:2023, V13.2.1, V13.2.2, V13.3.1)](https://softwaresecurity.com/downloads/workload-identity-models.md): Trace how a running workload obtains a short-lived identity, write cloud trust policies that match immutable claims instead of names or wildcards, and keep the resulting credential limited by audience and authorization.
- [Authorization models: RBAC, ABAC, ReBAC and policy as code (CWE-863, CWE-862, CWE-639, A01:2025, API1:2023, API3:2023, API5:2023, V8.2.1, V8.2.2, V8.2.3, V8.3.1, V8.3.3, V8.4.1, CWE-284)](https://softwaresecurity.com/downloads/authorization-models.md): Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.
- [Data retention and deletion: minimize, expire and verify (CWE-359, CWE-532, V14.1.2, V14.2.6, V14.2.7, V11.7.2)](https://softwaresecurity.com/downloads/data-minimization-retention.md): Design collection and deletion around a data-flow graph that includes logs, derived tables, exports and restored backups, and use per-person keys so deletion can reach copies you cannot edit.
- [Tokenization vs pseudonymization vs encryption (CWE-359, CWE-328, V14.1.1, V14.2.4, V14.2.6)](https://softwaresecurity.com/downloads/tokenization-privacy-engineering.md): Choose between vault tokens, keyed pseudonyms, format-preserving encryption, aggregation and differential privacy by the joins, reversibility and leakage each allows, and test re-identification on the data you release.
- [Post-quantum cryptography migration: inventory and deadlines (CWE-327, CWE-326, A04:2025, V11.1.2, V11.1.3, V11.1.4, V11.2.2, V11.2.3)](https://softwaresecurity.com/downloads/crypto-inventory-pqc.md): Inventory public-key cryptography by operation, owner and lifetime, turn on hybrid ML-KEM key exchange where it is already available, and plan signature and archive migration against the NIST, NSA, NCSC and EU dates.
- [SAML assertion validation: signatures, audience and replay (CWE-347, CWE-290, CWE-294, CWE-611, A07:2025, A04:2025, API2:2023, V6.8.1, V6.8.2, V6.8.3)](https://softwaresecurity.com/downloads/saml-verification-boundaries.md): Bind a validated SAML assertion to its trusted issuer, the exact signed element, your service, the browser request and a replay record before creating a local session, and keep your SAML library ahead of its advisories.
- [SCIM deprovisioning: revoke sessions, tokens and jobs (CWE-613, CWE-863, A01:2025, A07:2025, V7.4.2, V8.3.2, V8.4.1)](https://softwaresecurity.com/downloads/scim-provisioning-deprovisioning.md): Connect SCIM resource updates to current sessions, tokens, group-derived permissions and background jobs, with explicit tenant mapping, CAEP revocation events and a measurable revocation contract.
- [Cryptography cheat sheet: which algorithm for which job (CWE-327, CWE-326, CWE-328, CWE-916, CWE-338, CWE-323, CWE-347, CWE-757, A04:2025, V11.2, V11.3, V11.4, V11.5, V11.6, V12.1, CAPEC-97, CAPEC-20, CAPEC-55, CAPEC-463, CAPEC-620)](https://softwaresecurity.com/downloads/crypto-quick-reference.md): A sourced quick reference for October 2026: which algorithm and parameters to use for encryption, hashing, passwords, MACs, signatures, key agreement, key derivation, randomness and TLS, the matching APIs in Node.js, Python, Java, Go and .NET, and where post-quantum migration stands.
- [JWT attacks: prevention and correct verification (CWE-347, CWE-287, CWE-290, CWE-613, CWE-326, CWE-918, A07:2025, A04:2025, A01:2025, API2:2023, V9, V7, V10, CAPEC-475, CAPEC-196, CAPEC-593)](https://softwaresecurity.com/downloads/jwt-attacks.md): Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg "none", key-confusion, header-injection, weak-secret and replay attacks.
- [Leaked API key or secret: revoke, rotate and clean up (CWE-798, CWE-540, CWE-532, CWE-522, CWE-321, A07:2025, A04:2025, A02:2025, V13.3, V13.2, CAPEC-560, CAPEC-37, CAPEC-191)](https://softwaresecurity.com/downloads/leaked-secret-response.md): Revoke an exposed API key, token or private key at its issuer before anything else, end the sessions it minted, check the provider's logs, then remove every copy and replace it with a credential that expires on its own.
- [MFA and account takeover: TOTP, push, SMS and passkeys (CWE-307, CWE-308, CWE-294, CWE-204, CWE-208, CWE-521, CWE-640, A07:2025, API2:2023, V6.2, V6.3, V6.4, V6.5, V6.6, V2.4, CAPEC-600, CAPEC-565, CAPEC-49, CAPEC-94, CAPEC-575)](https://softwaresecurity.com/downloads/mfa-account-takeover.md): Rank MFA options by the attacks they stop, implement TOTP and push approvals correctly, and close the login, reset and recovery paths that attackers use instead of breaking the second factor.
- [OAuth/OIDC attacks: redirect, code injection, PKCE (CWE-601, CWE-352, CWE-346, CWE-294, CWE-287, A07:2025, A01:2025, API2:2023, V10, V3, V7, CAPEC-62, CAPEC-593)](https://softwaresecurity.com/downloads/oauth-oidc-attacks.md): Apply RFC 9700 and RFC 10017: exact redirect matching, PKCE with downgrade protection, state and iss binding, refresh-token rotation, sender-constrained tokens, and a backend-for-frontend so browser tokens cannot be stolen.
- [Kubernetes secrets: Vault, CSI, External Secrets, SOPS (CWE-798, CWE-522, CWE-312, CWE-732, A02:2025, A04:2025, V13.3.1, V13.3.2, V13.3.4, V13.2.1, CAPEC-37, CAPEC-560)](https://softwaresecurity.com/downloads/secrets-in-kubernetes-and-runtime.md): How a running workload should get its credentials: encrypt Kubernetes Secrets with a KMS v2 provider and lock down RBAC, mount from an external store with the Secrets Store CSI Driver, sync with External Secrets Operator, issue dynamic credentials with Vault and its Agent Injector, keep Git copies encrypted with SOPS, and make rotation reach the process.
- [LastPass breach (2022) case study: backups, keys, PBKDF2 (CWE-522, CWE-916, CWE-311, CWE-1104, A04:2025, A07:2025, A02:2025, V13.3.1, V13.3.2, V11.4.2, V14.2.4, CAPEC-568, CAPEC-55)](https://softwaresecurity.com/downloads/case-study-lastpass-2022.md): How an attacker went from a compromised developer laptop to a DevOps engineer's home computer, the keys to LastPass's cloud backups and a copy of customer vaults; why each vault's safety then rested on its master password and PBKDF2 iteration count; and what it teaches about backup keys, privileged endpoints, KDF upgrades and unencrypted metadata.
- [Okta 2023 breach: session tokens stolen from HAR files (CWE-522, CWE-532, CWE-294, CWE-613, CWE-778, A07:2025, A09:2025, A02:2025, V7.4.1, V7.4.2, V7.5.1, V16.2.1, CAPEC-593, CAPEC-60, CAPEC-560)](https://softwaresecurity.com/downloads/case-study-okta-har-2023.md): How a service account password saved to a personal browser profile let an attacker download customers' HAR files from Okta's support system, replay the session tokens inside them against five customers, and stay unseen for two weeks; and why HAR files are credentials, admin sessions need binding, and every exposed credential must be rotated.
- [Certificate expired outages: Ericsson, Teams, Equifax (CWE-298, CWE-324, CWE-295, CWE-778, A02:2025, A04:2025, A09:2025, V12.1.1, V12.2.2, V13.3.4)](https://softwaresecurity.com/downloads/case-study-certificate-expiry.md): How an expired certificate inside Ericsson's core-network software cut mobile data for millions in about 11 countries, how an expired authentication certificate took Microsoft Teams offline, how an expired inspection certificate left Equifax blind for 19 months, through its 2017 breach, and the inventory, automation and testing that prevent each.
- [Storm-0558 case study: forged tokens and a 2016 key (CWE-347, CWE-324, CWE-778, A07:2025, A04:2025, A09:2025, V9.1.3, V11.1.1, V13.3.4, V16.3.2, CAPEC-196)](https://softwaresecurity.com/downloads/case-study-storm-0558.md): How a stolen 2016 consumer signing key and a token validation gap let Storm-0558 read enterprise Exchange Online mail in 2023, and what the review board found about rotation, logging and culture.

## Governance & frameworks

Turn security expectations into an accountable, measurable engineering program.

- [Start an AppSec program: owners, triggers and metrics](https://softwaresecurity.com/downloads/minimal-appsec-program.md): Begin with ownership, a few risk-triggered activities, and evidence that findings are resolved; expand from demonstrated needs.
- [Run an AppSec program: owners, champions and SLAs](https://softwaresecurity.com/downloads/security-program-operations.md): Translate a security baseline into service ownership, change triggers, reusable patterns and evidence that work reaches deployment.
- [ASVS 5.0 verification: requirements, tests and evidence (CWE-78, A05:2025, V1.2.5)](https://softwaresecurity.com/downloads/asvs-verification-evidence.md): Scope edition-qualified requirements, connect them to implementation and tests, and separate a passing check from an unsupported assurance claim.
- [NIST SSDF (SP 800-218): apply it to one product](https://softwaresecurity.com/downloads/ssdf-product-lifecycle.md): Connect secure-development practices to an actual product’s work, artifacts and responsibilities instead of a questionnaire full of unsupported yes answers.
- [OWASP SAMM assessment: score maturity with evidence](https://softwaresecurity.com/downloads/samm-assessment.md): Use OWASP SAMM to distinguish isolated successes from repeatable practices and choose improvements the organization can sustain.
- [Security risk exceptions: approval, expiry and metrics](https://softwaresecurity.com/downloads/risk-exceptions-metrics.md): Keep temporary acceptance separate from remediation and measure outcomes using definitions that survive changing visibility.
- [Control mapping and crosswalks with NIST IR 8477](https://softwaresecurity.com/downloads/assurance-mapping.md): Record exactly how an implementation supports a requirement, which evidence is reusable and which obligations remain unresolved.
- [Supplier software assurance: SOC 2, SBOMs and updates (A03:2025)](https://softwaresecurity.com/downloads/supplier-assurance.md): Connect supplier claims to product scope, supported versions, release integrity and vulnerability handling before making a procurement decision.
- [Cyber Resilience Act for engineers: reporting and evidence](https://softwaresecurity.com/downloads/product-security-obligations.md): Determine the relevant actor, product, market and requirement before connecting CRA or payment-security expectations to implementation work.
- [ISO 27001, SOC 2, NIST CSF or FedRAMP: which to use](https://softwaresecurity.com/downloads/assurance-frameworks.md): Distinguish management systems, technical controls, risk outcomes, independent reports and government cloud requirements before reusing evidence.
- [Privacy and health data scope: GDPR, CCPA, HIPAA, FTC (V14)](https://softwaresecurity.com/downloads/privacy-regulatory-scope.md): Map data, actors and processing purposes to the relevant GDPR, California or HIPAA requirements and preserve uncertainty about applicability.
- [AppSec metrics and vulnerability SLAs: what to measure (V15)](https://softwaresecurity.com/downloads/appsec-metrics-and-slas.md): Set vulnerability SLAs by exploitation and exposure, route misses through expiring exceptions, and measure the program with cohort-based, censoring-aware metrics that resist gaming.
- [CRA reporting runbook: 24h, 72h and final report deadlines (A03:2025, A08:2025)](https://softwaresecurity.com/downloads/cra-reporting-runbook.md): Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform within 24 and 72 hours. Decide what is reportable, start the clock at the right moment, file through the platform and keep an evidence trail.
- [PCI DSS Requirement 6 (v4.0.1): practices and evidence (CWE-829, CWE-494, CWE-1395, A03:2025, A08:2025, V3.6, V15.1, V15.2)](https://softwaresecurity.com/downloads/pci-dss-requirement-6.md): Turn PCI DSS v4.0.1 Requirement 6 into engineering work: secure development, review, patching, web-attack protection, payment-page script control and change management, with the records an assessor samples and the parts that became mandatory on 31 March 2025.
- [Security champions program: charter, training and metrics](https://softwaresecurity.com/downloads/security-champions-program.md): Put a trained engineer with protected hours in every in-scope team, write the role into a one-page charter, route sensitive changes and findings through champions and AppSec, and judge the program by coverage and outcomes instead of attendance.
- [Vulnerability prioritization: CVSS 4.0, EPSS, KEV and SSVC (CWE-1395, A03:2025, V15)](https://softwaresecurity.com/downloads/vulnerability-prioritization.md): Rank vulnerabilities with CISA KEV, EPSS, CVSS 4.0 vectors and SSVC decision points, adjust for presence, reachability and asset value, and turn the result into due dates. Covers NVD's 2026 enrichment changes and CISA BOD 26-04.
- [CISA Secure by Design: principles, pledge and evidence (CWE-89, CWE-79, CWE-78, CWE-798, CWE-1392)](https://softwaresecurity.com/downloads/secure-by-design-principles.md): What CISA's Secure by Design guidance and pledge ask of software manufacturers as of October 2026, and how to turn each of the three principles, the seven pledge goals and the Product Security Bad Practices into engineering actions, metrics and evidence.
- [BSIMM vs SAMM vs SSDF: which one should you use?](https://softwaresecurity.com/downloads/choosing-bsimm-samm-ssdf.md): How BSIMM16, OWASP SAMM 2.2.0 and NIST SSDF 1.1 differ, what each measures and does not, a chooser by situation, and a verified SSDF-to-BSIMM16-and-SAMM crosswalk with a script that reports evidence gaps.
- [Developer security training program: roles, labs, metrics](https://softwaresecurity.com/downloads/developer-security-training-program.md): Build role-based, hands-on developer security training from this site's learning paths, labs and fix cards, meet PCI DSS 6.2.2, NIST SSDF PO.2.2 and ISO/IEC 27001 A.6.3 with real evidence, and measure the effect with repeat findings instead of completion rates.
- [AppSec careers: roles, skills by level and certifications](https://softwaresecurity.com/downloads/appsec-careers.md): The main application security role tracks (AppSec engineer, product security engineer, security champion, platform security engineer, security architect), the skills expected at each level, how to build a portfolio a hiring team can verify using this site's labs, projects and fix cards, and what common certifications do and do not show.
- [SOC 2 for engineering teams: CC6, CC7, CC8 evidence](https://softwaresecurity.com/downloads/soc2-for-engineering-teams.md): What a SOC 2 report covers, which Trust Services Criteria engineering owns (CC6 logical access, CC7 system operations, CC8 change management), the controls that meet them in a modern pipeline, and how to export a complete change population for a Type 2 period.
- [ISO 27001 secure development: Annex A 8.25 to 8.33](https://softwaresecurity.com/downloads/iso-27001-secure-development.md): How ISO/IEC 27001:2022 treats secure development, what the Annex A development controls (8.4, 8.8, 8.9 and 8.25 to 8.33) look like as engineering practice, and how to keep the Statement of Applicability and its evidence honest with checks in code.
- [NIST CSF 2.0 for product teams: GOVERN, GV.SC, evidence](https://softwaresecurity.com/downloads/nist-csf-2-for-product-teams.md): Find the CSF 2.0 outcomes a product team actually owns, including GOVERN and supply-chain risk management (GV.SC), write a current and target profile for one product, and check it against NIST's own catalog in CI.
- [GDPR privacy by design for engineers: Art. 25, 32, 35 (V14)](https://softwaresecurity.com/downloads/gdpr-privacy-by-design-engineering.md): Turn GDPR data protection by design and by default, security of processing and DPIA triggers into engineering work: a personal-data inventory checked in CI, defaults that collect and share less, a DPIA screen at design time, and access and erasure requests that reach every store.
- [NIS2 and DORA for software suppliers: scope and evidence](https://softwaresecurity.com/downloads/nis2-dora-for-software-suppliers.md): Work out whether NIS2 applies to your software company directly or only through customers, what Article 21 risk-management measures and DORA's ICT third-party rules ask of suppliers, and how to keep one assurance pack and register data sheet for both.
- [UK Software Security Code of Practice for engineers](https://softwaresecurity.com/downloads/uk-software-security-code-of-practice.md): What the UK government's voluntary Software Security Code of Practice (May 2025) asks of software vendors, each of its 14 principles mapped to engineering practice, NIST SSDF and the EU Cyber Resilience Act, and a CI check for the support-period principles.
- [IEC 62443-4-1, FDA 524B, ISO/SAE 21434: product lifecycles](https://softwaresecurity.com/downloads/regulated-product-security-lifecycle.md): What the secure development lifecycles for industrial, medical and automotive products require, the practices they share (threat modeling, SBOM, vulnerability handling and updates), and how to build that evidence once and package it for each instrument.
- [Reuse compliance evidence across SSDF, PCI, ISO and SOC 2](https://softwaresecurity.com/downloads/compliance-evidence-reuse.md): Keep one set of release-bound engineering evidence (SBOM, provenance, review records, scan results, ASVS results and vulnerability handling) and map it to several frameworks: a worked crosswalk, an evidence index checked in CI with a CSV export, and an OSCAL component definition.
- [CISA secure software attestation form: 2026 status, evidence](https://softwaresecurity.com/downloads/federal-software-attestation.md): Know what is and isn't required after OMB M-26-05, then answer an agency's request statement by statement, with the SSDF tasks the form maps and release evidence for each claim.

## AI security

Apply security boundaries to models, agents, retrieved content, and generated output.

- [Prompt injection: contain it with a tool gateway (CWE-1427, CWE-863, LLM01:2026, LLM03:2026, LLM08:2026, LLM10:2026, ASI01:2026, ASI02:2026, V8.3.1)](https://softwaresecurity.com/downloads/prompt-injection-boundaries.md): Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.
- [RAG access control: filter by tenant and ACL first (CWE-863, A01:2025, LLM09:2026, LLM02:2026, V8.2.2, V8.4.1, V14.2.2)](https://softwaresecurity.com/downloads/rag-tenant-isolation.md): Carry document permissions through ingestion, retrieval, caching and citations so a model never receives another tenant’s records.
- [AI agent tool authorization: approvals that run once (CWE-863, CWE-367, LLM03:2026, LLM01:2026, ASI02:2026, ASI03:2026, ASI09:2026, V8, V8.3.1, V8.3.2, V15.4.2)](https://softwaresecurity.com/downloads/agent-tool-authorization.md): Bind each proposed action to the user, resource and approved arguments before allowing a tool to cause a side effect.
- [LLM output handling: render and act on model text safely (CWE-79, CWE-89, CWE-78, A05:2025, LLM10:2026, ASI05:2026, V1, V3, V1.2.4, V1.2.5, V1.3.1, V3.2.2)](https://softwaresecurity.com/downloads/untrusted-model-output.md): Choose safe rendering and narrow operations so model text cannot become browser code, database syntax or an unrestricted command.
- [AI red teaming: evaluate LLM apps by real effects](https://softwaresecurity.com/downloads/ai-security-evaluation.md): Test the application’s actual security boundaries, preserve legitimate tasks and distinguish deterministic enforcement from variable model behavior.
- [AI red teaming method for LLM apps and agents (CWE-1427, LLM01:2026, LLM02:2026, LLM03:2026, LLM06:2026, LLM08:2026, LLM10:2026, ASI01:2026, ASI02:2026, ASI03:2026, ASI06:2026)](https://softwaresecurity.com/downloads/ai-red-teaming.md): A red-teaming method for LLM features and agents: scope the whole system, map attacks to OWASP and MITRE ATLAS identifiers, score trials from observed effects, report rates with confidence intervals and retest on every model or provider change.
- [Unbounded consumption: agent budgets, memory and recovery (CWE-770, API4:2023, LLM06:2026, LLM01:2026, ASI06:2026, V15.4.2)](https://softwaresecurity.com/downloads/ai-cost-memory-operations.md): Enforce budgets and stop conditions outside the model, and make retained context and side effects recoverable.
- [Model supply chain security: pin, verify and load safely (CWE-502, CWE-494, CWE-829, A03:2025, A08:2025, LLM04:2026, V1.5.2, V15.2.4, V15.2.5)](https://softwaresecurity.com/downloads/model-artifact-security.md): Verify provenance, constrain loading and preserve the relationship between model weights, configuration and runtime dependencies.
- [Data poisoning defense: lineage, slice gates and rebuilds (LLM05:2026)](https://softwaresecurity.com/downloads/training-data-poisoning.md): Track who can influence datasets, keep evaluation independent and investigate targeted behavior changes without relying on aggregate accuracy.
- [Membership inference and model privacy: measure the risk (CWE-359, LLM02:2026)](https://softwaresecurity.com/downloads/model-privacy-attacks.md): Define what an adversary can observe and measure privacy leakage without confusing a model’s output with proof about its training data.
- [MCP security: OAuth, tool poisoning and agent delegation (CWE-441, CWE-918, CWE-639, CWE-863, LLM01:2026, LLM03:2026, ASI03:2026, ASI07:2026, ASI01:2026, ASI02:2026, ASI04:2026, V10.2.2, V10.3.1, V10.3.3, V10.4.1, V8.2.2)](https://softwaresecurity.com/downloads/mcp-multiagent-security.md): Validate each connection and delegated action without treating a token for another service, a tool description, another agent or a state handle as authority.
- [Agent containment: kill switches, limits, rollback (CWE-770, LLM06:2026, ASI08:2026, ASI10:2026, V2.4.1, V8.3.2, V16.4.3, V16.5.2)](https://softwaresecurity.com/downloads/agent-failure-containment.md): Stop a looping, compromised or drifting agent from spreading harm: kill switches, budget and rate limits, circuit breakers, behavior monitoring, blast-radius limits, quarantine, rollback and incident response, all enforced outside the agent.
- [AI governance for engineers: NIST AI RMF, ISO 42001, AI Act](https://softwaresecurity.com/downloads/ai-governance-regulation.md): What the NIST AI RMF and its Generative AI Profile, ISO/IEC 42001 and the EU AI Act, as amended in 2026, ask of teams that build AI features, turned into engineering practices and one set of evidence. Not legal advice.
- [AI coding assistant security: agents, slopsquatting, MCP (CWE-1427, CWE-1357, CWE-829, CWE-250, A03:2025, A08:2025, LLM01:2026, LLM02:2026, LLM03:2026, LLM04:2026, LLM07:2026, LLM10:2026, ASI01:2026, ASI02:2026, ASI03:2026, ASI04:2026, ASI05:2026, ASI09:2026, V15)](https://softwaresecurity.com/downloads/ai-assisted-development.md): Treat generated code, suggested packages, repository text and MCP servers as untrusted inputs, and confine coding agents with OS-level isolation and short-lived, narrowly scoped credentials.
- [LLM misinformation: grounding, citations and claim-check-act (CWE-1426, LLM07:2026, LLM10:2026, LLM04:2026, ASI09:2026, ASI06:2026)](https://softwaresecurity.com/downloads/llm-misinformation.md): Stop plausible but wrong model output from driving decisions and actions: ground answers in sources, verify every citation, separate generation from execution with a claim-check-act pattern, gate consequential actions on a human, and evaluate factuality on your own domain.
- [Call an LLM API safely: keys, PII, retention, validation (CWE-798, CWE-522, CWE-532, CWE-359, CWE-770, A07:2025, A09:2025, LLM02:2026, LLM06:2026, LLM10:2026, V13.1.1, V1.3.6)](https://softwaresecurity.com/downloads/calling-llm-apis-safely.md): A code-first checklist for wiring up an OpenAI or Anthropic API call from a backend: keep keys server-side, redact PII before prompts and logs, choose provider retention settings deliberately, validate structured output and still treat it as untrusted, and set timeouts, retries and per-user cost caps.
- [Sandbox LLM-generated code and computer-use agents (CWE-653, CWE-94, CWE-250, CWE-770, LLM10:2026, LLM03:2026, ASI05:2026, ASI01:2026, ASI09:2026, V15.2.5, V15.2.2, V13.2.4)](https://softwaresecurity.com/downloads/agent-code-sandboxing.md): Run the code an agent writes, and agents that drive a browser or desktop, inside a boundary built for hostile code: a disposable runtime with no secrets and no default network, hard resource limits, and a person in front of every side effect.
- [LLM08:2026 Hidden Context Exposure and system prompt leaks (CWE-497, CWE-656, CWE-798, LLM08:2026, LLM02:2026, LLM01:2026, V13.3.1, V8.3.1)](https://softwaresecurity.com/downloads/hidden-context-exposure.md): OWASP LLM08:2026 Hidden Context Exposure, which replaced System Prompt Leakage: why system prompts, tool schemas and retrieved policy text get extracted, what must never be in them, and how to enforce rules where a leak changes nothing.
- [Agent memory poisoning: OWASP ASI06 defenses (CWE-501, CWE-349, CWE-1427, LLM01:2026, LLM09:2026, LLM05:2026, ASI06:2026, ASI01:2026, ASI08:2026, V8.2.2, V14.2.7)](https://softwaresecurity.com/downloads/agent-memory-poisoning.md): OWASP ASI06 Memory & Context Poisoning: how an instruction or false fact saved once in agent memory, conversation summaries or a retrieval store steers later sessions, users and agents, and the write, scope, provenance, expiry and recovery controls that contain it.
- [Moffatt v. Air Canada chatbot case study (LLM07:2026, ASI09:2026)](https://softwaresecurity.com/downloads/case-study-air-canada-chatbot.md): How an airline's website chatbot told a grieving customer they could claim a bereavement fare after travel, what the British Columbia Civil Resolution Tribunal decided in February 2024, and the grounding, testing and correction practices that keep an automated answer consistent with the policy it describes.
- [Nx s1ngularity case study: CI injection to AI-CLI malware (CWE-78, CWE-506, CWE-829, A03:2025, A08:2025, LLM03:2026, ASI04:2026, ASI05:2026)](https://softwaresecurity.com/downloads/case-study-nx-s1ngularity.md): How a pull-request-title injection in a GitHub Actions workflow on an outdated branch gave an attacker the Nx npm token in August 2025, how the malicious versions tried to turn developers' own AI command-line tools into file-search agents, and the workflow, publishing and agent controls that stop the same chain.
- [Amazon Q Developer extension compromise case study (CWE-506, CWE-522, A08:2025, A03:2025, LLM03:2026, ASI04:2026, ASI05:2026)](https://softwaresecurity.com/downloads/case-study-amazon-q-extension.md): How an over-scoped GitHub token, extracted from an AWS CodeBuild pull request build, let a threat actor commit code to the Amazon Q Developer extension for VS Code that shipped in version 1.84.0 in July 2025, why the injected code aimed at the Q Developer CLI failed, and the CI and AI-agent controls the incident argues for.

## Fix cards

Tested fixes for one weakness in one stack (Node.js, Python, Java, C#, Next.js, FastAPI, Django, Go, Rails and Laravel): the vulnerable code, the fix, a plausible fix that still fails and the regression tests that tell them apart, each with a project to download and run. The full text of every card is in llms-full.txt.

- [All fix cards by weakness and stack](https://softwaresecurity.com/fix/)
- [Fix CSRF in Node.js and Express (CWE-352)](https://softwaresecurity.com/fix/csrf/node-express/): Express has no built-in CSRF protection, so add one middleware before every route: let POST, PUT, PATCH and DELETE through only when Sec-Fetch-Site is same-origin (or none), fall back to an exact Origin match when the browser sends no Sec-Fetch-Site, and refuse the rest with 403.
- [Fix CSRF in Python and Flask (CWE-352)](https://softwaresecurity.com/fix/csrf/python-flask/): Register Flask-WTF's CSRFProtect(app). It requires the session's token on every POST, PUT, PATCH and DELETE: render {{ csrf_token() }} in a hidden csrf_token field, or send it from scripts in an X-CSRFToken header.
- [Fix CSRF in Java and Spring Boot (CWE-352)](https://softwaresecurity.com/fix/csrf/java-spring/): Keep Spring Security's CSRF protection on (it is the default) and never call csrf.disable() for browser-facing routes.
- [Fix CSRF in C# and ASP.NET Core (CWE-352)](https://softwaresecurity.com/fix/csrf/csharp-aspnetcore/): Call AddAntiforgery() and, after UseAuthentication() and UseAuthorization(), UseAntiforgery().
- [Fix CSRF in Python and Django (CWE-352)](https://softwaresecurity.com/fix/csrf/python-django/): Keep django.middleware.csrf.CsrfViewMiddleware in MIDDLEWARE and do not exempt views: it checks the Origin (or, over HTTPS, the Referer) against the site and CSRF_TRUSTED_ORIGINS, and the token.
- [Fix CSRF in Ruby on Rails (CWE-352)](https://softwaresecurity.com/fix/csrf/ruby-rails/): Keep the protection ActionController::Base already has (load_defaults 5.2 adds protect_from_forgery with: :exception): forms from form_with carry the token, fetch() sends csrf_meta_tags' token in X-CSRF-Token, and Rails also checks Origin.
- [Fix CSRF in PHP and Laravel (CWE-352)](https://softwaresecurity.com/fix/csrf/php-laravel/): Keep PreventRequestForgery, which Laravel puts in the web middleware group, on every state-changing route: it accepts a request that the browser marks Sec-Fetch-Site: same-origin, and otherwise requires the session's token in \_token or X-CSRF-TOKEN.
- [Fix missing object-level authorization (IDOR) in Node.js and Express (CWE-862, CWE-639, CWE-863)](https://softwaresecurity.com/fix/missing-authorization/node-express/): Take the user from your authentication middleware (req.user), never from the request, and put the same scope in every invoice query: tenant_id = $tenant AND (owner_id = $user OR $isBillingAdmin).
- [Fix missing object-level authorization (IDOR) in Python and Flask (CWE-862, CWE-639, CWE-863)](https://softwaresecurity.com/fix/missing-authorization/python-flask/): Load the signed-in user from Flask's signed session in a before_request hook, never from request data, and add the same scope to every invoice query: tenant_id = :tenant AND (owner_id = :user OR :is_billing_admin).
- [Fix missing object-level authorization (IDOR) in Java and Spring Boot (CWE-862, CWE-639, CWE-863)](https://softwaresecurity.com/fix/missing-authorization/java-spring/): Get the user from Spring Security with @AuthenticationPrincipal, never from request parameters, and scope every repository query with tenant_id = :tenant AND (owner_id = :user OR :isBillingAdmin).
- [Fix missing object-level authorization (IDOR) in C# and ASP.NET Core (CWE-862, CWE-639, CWE-863)](https://softwaresecurity.com/fix/missing-authorization/csharp-aspnetcore/): Read the user's ID, tenant and role from the ClaimsPrincipal your authentication scheme builds, never from the request, and scope every invoice query with tenant_id = $tenant AND (owner_id = $user OR $isBillingAdmin).
- [Fix missing object-level authorization (IDOR) in TypeScript and Next.js (CWE-862, CWE-639, CWE-863)](https://softwaresecurity.com/fix/missing-authorization/typescript-nextjs/): Get the user from your authentication inside each route handler and server action, never from the request, and put one scope in every invoice query: tenant_id = $tenant AND (owner_id = $user OR $isBillingAdmin).
- [Fix IDOR and missing authorization in Python and FastAPI (CWE-862, CWE-639, CWE-863)](https://softwaresecurity.com/fix/missing-authorization/python-fastapi/): Build the signed-in user in a dependency (current_user) from the authenticated session and the users table, never from request data, and put the same scope in every query's WHERE clause: same tenant, and the caller's own rows unless they are a billing admin.
- [Fix IDOR and missing authorization in Python and Django (CWE-862, CWE-639, CWE-863)](https://softwaresecurity.com/fix/missing-authorization/python-django/): Build one queryset that holds the rule, from request.user and its tenant and role, never from request data: Invoice.objects.filter(tenant=member.tenant), narrowed to owner=user for members.
- [Fix IDOR and missing authorization in Go and net/http (CWE-862, CWE-639, CWE-863)](https://softwaresecurity.com/fix/missing-authorization/go-nethttp/): Build the signed-in user in middleware from the verified session and the users table, never from request data, and put the same scope in every query's WHERE clause: tenant_id = :tenant AND (owner_id = :user OR :is_billing_admin).
- [Fix IDOR and missing authorization in Ruby on Rails (CWE-862, CWE-639, CWE-863)](https://softwaresecurity.com/fix/missing-authorization/ruby-rails/): Load records through a scope built from the signed-in user, never by ID alone: visible_invoices(current_user).find(params[:id]), where the scope applies the tenant to everyone and the owner to members.
- [Fix missing object-level authorization (IDOR) in PHP and Laravel (CWE-862, CWE-639, CWE-863)](https://softwaresecurity.com/fix/missing-authorization/php-laravel/): Build one query that holds the rule, from $request->user()'s tenant and role, never from request data: Invoice::where('tenant_id', $user->tenant_id), narrowed to owner_id for members.
- [Fix open redirects in Node.js and Express (CWE-601)](https://softwaresecurity.com/fix/open-redirect/node-express/): Resolve next against your own origin with new URL(next, site), the WHATWG parser browsers use, and redirect only if url.origin is in an exact allowlist and the URL carries no user name or password; otherwise redirect to a fixed page.
- [Fix open redirects in Python and Flask (CWE-601)](https://softwaresecurity.com/fix/open-redirect/python-flask/): Refuse backslashes, which browsers read as slashes and urllib.parse does not, and control characters; then split next with urlsplit: accept a path that starts with exactly one slash, or an https URL whose hostname is in an exact allowlist, with no port and no @.
- [Fix open redirects in Java and Spring Boot (CWE-601)](https://softwaresecurity.com/fix/open-redirect/java-spring/): Refuse backslashes and control characters, then parse next with java.net.URI: return "redirect:" + next only for a path that starts with exactly one slash, or an https URL whose host is in an exact allowlist with no port or user info; otherwise redirect to a fixed page.
- [Fix open redirects in C# and ASP.NET Core (CWE-601)](https://softwaresecurity.com/fix/open-redirect/csharp-aspnetcore/): Check Url.IsLocalUrl(returnUrl) and redirect with LocalRedirect(returnUrl): IsLocalUrl accepts "/" or "\~/" paths not followed by "/" or "\\" and free of control characters.
- [Fix open redirects in TypeScript and Next.js (CWE-601)](https://softwaresecurity.com/fix/open-redirect/typescript-nextjs/): Resolve next against your own origin with new URL(next, site), the WHATWG parser browsers use, and pass the result to redirect() only if url.origin is in an exact allowlist and the URL has no user name or password; otherwise redirect to a fixed page.
- [Fix open redirects in Python and FastAPI (CWE-601)](https://softwaresecurity.com/fix/open-redirect/python-fastapi/): Refuse backslashes and control characters, then split next with urlsplit: accept a path that starts with exactly one slash, or an https URL whose hostname is in an exact allowlist, with no port and no @.
- [Fix open redirects in Python and Django (CWE-601)](https://softwaresecurity.com/fix/open-redirect/python-django/): Prefer Django's LoginView, which checks next itself; add other hosts with success_url_allowed_hosts.
- [Fix open redirects in Go and net/http (CWE-601)](https://softwaresecurity.com/fix/open-redirect/go-nethttp/): Refuse a next value containing a backslash, a control character or a space, then url.Parse it: accept a path starting with exactly one slash, or a URL whose scheme and host exactly match an allowlisted origin, without user info; otherwise a fixed page.
- [Fix open redirects in Ruby on Rails (CWE-601)](https://softwaresecurity.com/fix/open-redirect/ruby-rails/): Keep Rails' own check on: redirect_to url_from(params[:next]) || account_path, with other trusted hosts in config.action_controller.allowed_redirect_hosts. url_from returns the value only for a path on this site or an allowed host, and redirect_to raises for anything else.
- [Fix open redirects in PHP and Laravel (CWE-601)](https://softwaresecurity.com/fix/open-redirect/php-laravel/): Treat next as untrusted: resolve it against the current URL with PHP 8.5's Uri\\WhatWg\\Url::parse(), the parser browsers use, and redirect()->away() to the serialized result only when its scheme is https and its host is on your allowlist.
- [Fix path traversal in Node.js and Express (CWE-22, CWE-23, CWE-36, CWE-59)](https://softwaresecurity.com/fix/path-traversal/node-express/): Check where the path lands, not what it looks like: resolve base with fs.realpath, resolve the request with realpath(path.resolve(base, name)), which collapses ../ and follows symlinks, and serve it only if it starts with base + path.sep.
- [Fix path traversal in Python and Flask (CWE-22, CWE-23, CWE-36, CWE-59)](https://softwaresecurity.com/fix/path-traversal/python-flask/): Resolve both paths and compare whole components: base = Path(base_dir).resolve(), target = (base / name).resolve(), and serve only if target.is_relative_to(base). resolve() collapses ../ and follows symlinks, and the check also catches absolute names, which replace base in the / operator.
- [Fix path traversal in Java and Spring Boot (CWE-22, CWE-23, CWE-36, CWE-59)](https://softwaresecurity.com/fix/path-traversal/java-spring/): Compare real Path objects: base = baseDir.toRealPath(), target = base.resolve(name).toRealPath(), and serve only if target.startsWith(base). toRealPath() collapses ../ and follows symlinks, and Path.startsWith compares whole name elements, so /srv/files-secret fails.
- [Fix path traversal in C# and ASP.NET Core (CWE-22, CWE-23, CWE-36, CWE-59)](https://softwaresecurity.com/fix/path-traversal/csharp-aspnetcore/): Use Path.GetFullPath(name, baseDir) and serve the result only if it starts with the base plus a trailing separator, compared with StringComparison.Ordinal.
- [Fix path traversal in TypeScript and Next.js (CWE-22, CWE-23, CWE-36, CWE-59)](https://softwaresecurity.com/fix/path-traversal/typescript-nextjs/): Check where the path lands, not what it looks like: resolve base with fs.realpath, resolve the request with realpath(path.resolve(base, name)), which collapses ../ and follows symlinks, and serve it only if it starts with base + path.sep.
- [Fix path traversal in Python and FastAPI (CWE-22, CWE-23, CWE-36, CWE-59)](https://softwaresecurity.com/fix/path-traversal/python-fastapi/): Resolve both paths and compare whole components before building the FileResponse: base = Path(base_dir).resolve(), target = (base / name).resolve(), and serve target only if target.is_relative_to(base). resolve() collapses ../ and follows symlinks, and the check also catches absolute names, which replace base in the / operator.
- [Fix path traversal in Python and Django (CWE-22, CWE-23, CWE-36, CWE-59)](https://softwaresecurity.com/fix/path-traversal/python-django/): Resolve both paths and compare whole components: base = Path(settings.FILES_ROOT).resolve(), target = (base / name).resolve(), and return FileResponse(target.open('rb')) only if target.is_relative_to(base). resolve() collapses ../ and follows symlinks; the check also catches absolute names.
- [Fix path traversal in Go and net/http (CWE-22, CWE-23, CWE-36, CWE-59)](https://softwaresecurity.com/fix/path-traversal/go-nethttp/): Open the base directory once with root, err := os.OpenRoot(base) and serve requested files through root.Open(name). os.Root (Go 1.24+) refuses names that leave the directory, whether by ../, an absolute path or a symlink, at the moment it opens the file. filepath.Join is not a check, and a strings.HasPrefix test on its result accepts files-secret and follows symlinks.
- [Fix path traversal in Ruby on Rails (CWE-22, CWE-23, CWE-36, CWE-59)](https://softwaresecurity.com/fix/path-traversal/ruby-rails/): Resolve the requested path with File.realpath(File.join(base, requested)), which collapses ../ and follows symlinks, and serve it only if it starts with the realpath of the base plus a separator.
- [Fix path traversal in PHP and Laravel (CWE-22, CWE-23, CWE-36, CWE-59)](https://softwaresecurity.com/fix/path-traversal/php-laravel/): Resolve both paths and compare whole components: $base = realpath($root), $target = realpath($base.'/'.$name), and serve response()->file($target) only if $target starts with $base.DIRECTORY_SEPARATOR. realpath() collapses ../ and follows symlinks, and returns false for missing files.
- [Fix SSRF in Node.js and Express (CWE-918)](https://softwaresecurity.com/fix/ssrf/node-express/): Attach the policy to the connection, not the hostname string.
- [Fix SSRF in Python and Flask (CWE-918)](https://softwaresecurity.com/fix/ssrf/python-flask/): Attach the policy to the connection, not the hostname string.
- [Fix SSRF in Java and Spring Boot (CWE-918)](https://softwaresecurity.com/fix/ssrf/java-spring/): Attach the policy to the connection, not the hostname string.
- [Fix SSRF in C# and ASP.NET Core (CWE-918)](https://softwaresecurity.com/fix/ssrf/csharp-aspnetcore/): Attach the policy to the connection, not the hostname string.
- [Fix SSRF in TypeScript and Next.js (CWE-918)](https://softwaresecurity.com/fix/ssrf/typescript-nextjs/): Attach the policy to the connection, not the hostname string.
- [Fix SSRF in Python and FastAPI (CWE-918)](https://softwaresecurity.com/fix/ssrf/python-fastapi/): Attach the policy to the connection, not the URL string or its Pydantic type.
- [Fix SSRF in Python and Django (CWE-918)](https://softwaresecurity.com/fix/ssrf/python-django/): Attach the policy to the connection, not the URL string. Allow only http/https and ports 80/443 and reject credentials; resolve the host (or read an IP literal in any notation) and reject loopback, private, link-local and IPv4-mapped addresses with ipaddress; connect to the vetted IP; re-validate every redirect; cap time and bytes.
- [Fix SSRF in Go and net/http (CWE-918)](https://softwaresecurity.com/fix/ssrf/go-nethttp/): Attach the policy to the connection, not the URL string. Give http.Transport a DialContext that resolves the host, rejects loopback, private, link-local and other non-public addresses with net/netip, and dials the vetted IP.
- [Fix server-side request forgery in Ruby on Rails (CWE-918)](https://softwaresecurity.com/fix/ssrf/ruby-rails/): Attach the policy to the connection, not the host name string.
- [Fix server-side request forgery in PHP and Laravel (CWE-918)](https://softwaresecurity.com/fix/ssrf/php-laravel/): Attach the policy to the connection, not the host string. Parse with Uri\\WhatWg\\Url, which reads any IPv4 notation as the address it names; allow only http and https on ports 80 and 443 without credentials; resolve names and refuse any address that fails FILTER_FLAG_GLOBAL_RANGE, plus multicast and NAT64; connect to the vetted address; vet every redirect; cap time and bytes.
- [Fix CORS misconfiguration in Node.js and Express (CWE-942, CWE-346)](https://softwaresecurity.com/fix/cors-misconfiguration/node-express/): Use the cors middleware with an origin function that checks an exact allowlist of full origins from configuration, and credentials: true.
- [Fix CORS misconfiguration in Python and Flask (CWE-942, CWE-346)](https://softwaresecurity.com/fix/cors-misconfiguration/python-flask/): Register flask-cors for the API routes with exact origins from configuration and supports_credentials=True.
- [Fix CORS misconfiguration in Java and Spring Boot (CWE-942, CWE-346)](https://softwaresecurity.com/fix/cors-misconfiguration/java-spring/): Declare a CorsConfigurationSource bean whose CorsConfiguration lists the front ends' exact origins from configuration with setAllowedOrigins and sets setAllowCredentials(true), and apply it with CorsFilter or http.cors().
- [Fix CORS misconfiguration in C# and ASP.NET Core (CWE-942, CWE-346)](https://softwaresecurity.com/fix/cors-misconfiguration/csharp-aspnetcore/): Add a named CORS policy with WithOrigins(allowedOrigins) from configuration and AllowCredentials(), call app.UseCors(), and require the policy on the API endpoints.
- [Fix XML external entity processing in Python and Flask (CWE-611, CWE-776)](https://softwaresecurity.com/fix/xxe/python-flask/): Parse untrusted XML with defusedxml, not lxml or the stdlib.
- [Fix XML external entity processing in Java and Spring Boot (CWE-611, CWE-776)](https://softwaresecurity.com/fix/xxe/java-spring/): Configure the XML parser to refuse the DTD: in Java set the Apache feature disallow-doctype-decl to true on the DocumentBuilderFactory, so any DOCTYPE is a fatal error and no external entity (CWE-611) or entity expansion (CWE-776) runs.
- [Fix XML external entity processing in C# and ASP.NET Core (CWE-611, CWE-776)](https://softwaresecurity.com/fix/xxe/csharp-aspnetcore/): On .NET, parse untrusted XML with XmlReaderSettings.DtdProcessing = Prohibit and XmlResolver = null (both the modern defaults), so any DOCTYPE throws before an external entity is read (CWE-611) or entities expand (CWE-776).
- [Fix insecure randomness for reset tokens in Node.js and Express (CWE-330, CWE-338)](https://softwaresecurity.com/fix/insecure-randomness/node-express/): Generate the token with a CSPRNG: crypto.randomBytes(32).toString('base64url') is 256 bits (prefer it over crypto.randomUUID, which carries only 122).
- [Fix insecure randomness for reset tokens in Python and Flask (CWE-330, CWE-338)](https://softwaresecurity.com/fix/insecure-randomness/python-flask/): Generate the token with the secrets module: secrets.token_urlsafe(32) is 256 bits from the OS CSPRNG.
- [Fix insecure randomness for reset tokens in Java and Spring Boot (CWE-330, CWE-338)](https://softwaresecurity.com/fix/insecure-randomness/java-spring/): Generate the token with java.security.SecureRandom: 32 bytes (256 bits) Base64url-encoded.
- [Fix insecure randomness for reset tokens in C# and ASP.NET Core (CWE-330, CWE-338)](https://softwaresecurity.com/fix/insecure-randomness/csharp-aspnetcore/): Generate the token with RandomNumberGenerator.GetBytes(32) (256 bits), Base64Url-encoded.
- [Fix insecure randomness for reset tokens in Go and net/http (CWE-330, CWE-338)](https://softwaresecurity.com/fix/insecure-randomness/go-nethttp/): Generate the token with crypto/rand: rand.Read into 32 bytes, encoded with base64.RawURLEncoding, is 256 bits from the OS CSPRNG (rand.Text() gives at least 128).
- [Fix weak password hashing in Node.js and Express (CWE-916, CWE-759, CWE-327)](https://softwaresecurity.com/fix/password-hashing/node-express/): Hash with Argon2id at or above OWASP's minimum: argon2.hash(password, { type: argon2.argon2id, memoryCost: 19456, timeCost: 2, parallelism: 1 }).
- [Fix weak password hashing in Python and Flask (CWE-916, CWE-759, CWE-327)](https://softwaresecurity.com/fix/password-hashing/python-flask/): Use argon2-cffi's PasswordHasher with explicit parameters at or above OWASP's minimum, PasswordHasher(time_cost=2, memory_cost=19456, parallelism=1), and store ph.hash(password).
- [Fix weak password hashing in Java and Spring Boot (CWE-916, CWE-759, CWE-327)](https://softwaresecurity.com/fix/password-hashing/java-spring/): Use Spring Security's DelegatingPasswordEncoder with an Argon2PasswordEncoder built from explicit parameters, new Argon2PasswordEncoder(16, 32, 1, 19456, 2), because defaultsForSpringSecurity_v5_8() is below OWASP's minimum.
- [Fix weak password hashing in C# and ASP.NET Core (CWE-916, CWE-759, CWE-327)](https://softwaresecurity.com/fix/password-hashing/csharp-aspnetcore/): Use ASP.NET Core Identity's PasswordHasher<TUser> (PBKDF2-HMAC-SHA512, 128-bit salt) with PasswordHasherOptions.IterationCount = 220_000; .NET 10's default of 100,000 is below OWASP's figure.
- [Fix weak password hashing in Python and FastAPI (CWE-916, CWE-759, CWE-327)](https://softwaresecurity.com/fix/password-hashing/python-fastapi/): Use argon2-cffi's PasswordHasher with explicit parameters at or above OWASP's minimum, PasswordHasher(time_cost=2, memory_cost=19456, parallelism=1), and store ph.hash(password) from a plain def path operation.
- [Fix weak password hashing in Python and Django (CWE-916, CWE-759, CWE-327)](https://softwaresecurity.com/fix/password-hashing/python-django/): Install argon2-cffi and list django.contrib.auth.hashers.Argon2PasswordHasher first in PASSWORD_HASHERS, keeping older hashers after it.
- [Fix weak password hashing in Go and net/http (CWE-916, CWE-759, CWE-327)](https://softwaresecurity.com/fix/password-hashing/go-nethttp/): Hash new passwords with argon2.IDKey from golang.org/x/crypto at or above OWASP's minimum (memory 19456 KiB, 2 passes, 1 lane) with a 16-byte salt from crypto/rand, and store a PHC string with the parameters.
- [Fix weak password hashing in PHP and Laravel (CWE-916, CWE-759, CWE-327)](https://softwaresecurity.com/fix/password-hashing/php-laravel/): Set HASH_DRIVER=argon2id and use Laravel's Hash facade: Hash::make() writes a salted Argon2id hash that records its parameters, Hash::check() verifies it in constant time, and Hash::needsRehash() after a correct password tells you to store a new hash.
- [Fix code injection in Node.js and Express (CWE-94, CWE-95)](https://softwaresecurity.com/fix/code-injection/node-express/): Do not turn a request string into code. eval, new Function and node:vm all run it, and node:vm is not a sandbox.
- [Fix code injection in Python and Flask (CWE-94, CWE-95)](https://softwaresecurity.com/fix/code-injection/python-flask/): Never evaluate user input as code. Parse the expression with ast.parse and walk the tree, allowing only numeric literals, the supplied variables and arithmetic operators; refuse everything else. eval(expr, {"\_\_builtins\_\_": {}}, vars) is not a sandbox: attribute access still reaches any object.
- [Fix code injection in Java and Spring Boot (CWE-94, CWE-95)](https://softwaresecurity.com/fix/code-injection/java-spring/): Do not evaluate request input as SpEL with a StandardEvaluationContext: it allows T(...) type references and method calls, so the formula runs code.
- [Fix code injection in C# and ASP.NET Core (CWE-94, CWE-95)](https://softwaresecurity.com/fix/code-injection/csharp-aspnetcore/): Do not run request input as code. Roslyn's CSharpScript executes the formula with the server's privileges, and a denylist of dangerous APIs cannot make it safe: it misses Environment.GetEnvironmentVariable and is never complete.
- [Fix code injection in Python and FastAPI (CWE-94, CWE-95)](https://softwaresecurity.com/fix/code-injection/python-fastapi/): Never evaluate user input as code. Parse the expression with ast.parse and walk the tree, allowing only numeric literals, the supplied variables and arithmetic operators; refuse everything else.
- [Fix cross-site scripting in Node.js and Express (CWE-79)](https://softwaresecurity.com/fix/xss/node-express/): Print every field through EJS's escaping tag <%= %>, which turns & < > " and ' into entities, and never through the raw tag <%- %>.
- [Fix cross-site scripting in Python and Flask (CWE-79)](https://softwaresecurity.com/fix/xss/python-flask/): Let Jinja autoescaping do the work: render {{ value }} with no |safe filter and no Markup() around user input, so & < > " and ' become entities in both text and quoted attributes.
- [Fix cross-site scripting in Java and Spring Boot (CWE-79)](https://softwaresecurity.com/fix/xss/java-spring/): Bind text with th:text and attributes with th:attr or th:title, which HTML-escape & < > " and ' — never th:utext for user data.
- [Fix cross-site scripting in C# and ASP.NET Core (CWE-79)](https://softwaresecurity.com/fix/xss/csharp-aspnetcore/): Let Razor's @ encode the output: @Model.Name and @Model.Bio HTML-encode & < > " ' and more, in text and in a quoted attribute.
- [Fix XSS in TypeScript and Next.js (CWE-79)](https://softwaresecurity.com/fix/xss/typescript-nextjs/): Render user text as React children and attributes, which React escapes, and keep it out of dangerouslySetInnerHTML; if a field must carry HTML, sanitize it with DOMPurify first.
- [Fix XSS in Python and Django (CWE-79)](https://softwaresecurity.com/fix/xss/python-django/): Let Django's autoescaping work: render {{ value }} without |safe, mark_safe() or {% autoescape off %}, so < > ' " and & become entities in text and quoted attributes.
- [Fix cross-site scripting in Go and net/http (CWE-79)](https://softwaresecurity.com/fix/xss/go-nethttp/): Render HTML with html/template, never text/template: it escapes each value for where it lands: text, attribute or URL.
- [Fix XSS in Ruby on Rails (CWE-79)](https://softwaresecurity.com/fix/xss/ruby-rails/): Let ERB escape: <%= @name %> and tag helpers such as image_tag(..., alt: @name) escape & < > " and ', unless the value is html_safe.
- [Fix cross-site scripting in PHP and Laravel (CWE-79)](https://softwaresecurity.com/fix/xss/php-laravel/): Print user data with Blade's {{ $value }}, which runs htmlspecialchars() with ENT_QUOTES, so < > & " and ' become entities in text and quoted attributes.
- [Fix CSV formula injection in Node.js and Express (CWE-1236)](https://softwaresecurity.com/fix/csv-formula-injection/node-express/): Spreadsheets run a cell that starts with =, +, -, @, tab or carriage return.
- [Fix CSV formula injection in Python and Flask (CWE-1236)](https://softwaresecurity.com/fix/csv-formula-injection/python-flask/): User text in a CSV is attacker-controlled. If a cell starts with = + - @, a tab, CR, LF or NUL, prefix it with an apostrophe so a spreadsheet treats it as text, then write it with csv.writer, which escapes commas, quotes and newlines.
- [Fix CSV formula injection in Java and Spring Boot (CWE-1236)](https://softwaresecurity.com/fix/csv-formula-injection/java-spring/): Spreadsheets run a cell that starts with =, +, -, @, tab or carriage return.
- [Fix CSV formula injection in C# and ASP.NET Core (CWE-1236)](https://softwaresecurity.com/fix/csv-formula-injection/csharp-aspnetcore/): Spreadsheets run a cell that starts with =, +, -, @, tab or carriage return.
- [Fix CSV formula injection in Python and Django (CWE-1236)](https://softwaresecurity.com/fix/csv-formula-injection/python-django/): User text in a CSV is attacker-controlled. If a cell starts with = + - @, a tab, CR, LF or NUL, prefix it with an apostrophe so a spreadsheet treats it as text, then write it with csv.writer, which escapes commas, quotes and newlines.
- [Fix CSV formula injection in Ruby on Rails (CWE-1236, CWE-74)](https://softwaresecurity.com/fix/csv-formula-injection/ruby-rails/): Before writing a user-controlled value to a cell, prefix it with a single quote when it begins with any formula trigger: =, +, -, @, tab (0x09) or carriage return (0x0D).
- [Fix LDAP filter injection in Python and Flask (CWE-90)](https://softwaresecurity.com/fix/ldap-injection/python-flask/): Escape every value that goes into an LDAP filter with ldap3.utils.conv.escape_filter_chars, which encodes the RFC 4515 metacharacters (\* ( ) \\ NUL) so they are matched as data, not parsed as syntax.
- [Fix LDAP filter injection in Java and Spring Boot (CWE-90)](https://softwaresecurity.com/fix/ldap-injection/java-spring/): Build the filter with Spring LDAP's LdapQueryBuilder (query().where("cn").is(name)), which puts every value through LdapEncoder.filterEncode (RFC 4515), so \* ( ) \\ and NUL are matched as data, not parsed as syntax.
- [Fix NoSQL operator injection in Node.js and Express (CWE-943)](https://softwaresecurity.com/fix/nosql-injection/node-express/): Never let a request value reach a MongoDB filter as an object: accept strings only (typeof value === 'string'), compare with { field: { $eq: value } }, and check secrets such as reset tokens in code with timingSafeEqual after looking the account up by email.
- [Fix NoSQL operator injection in Python and Flask (CWE-943)](https://softwaresecurity.com/fix/nosql-injection/python-flask/): Never let a request value reach a PyMongo filter as a dict: accept str only (isinstance(value, str)), compare with {"field": {"$eq": value}}, and check secrets such as reset tokens in code with hmac.compare_digest after looking the account up by email.
- [Fix OS command and argument injection in Node.js and Express (CWE-78, CWE-88)](https://softwaresecurity.com/fix/command-injection/node-express/): Run the program directly with its arguments as a list - execFileSync(tool, ['--', name]) - so no shell parses them, and put '--' before any user operand so a leading dash cannot pose as an option.
- [Fix OS command and argument injection in Python and Flask (CWE-78, CWE-88)](https://softwaresecurity.com/fix/command-injection/python-flask/): Pass a list to subprocess.run with the default shell=False - subprocess.run([tool, '--', name]) - so no shell parses the arguments, and put '--' before any user operand so a leading dash cannot pose as an option.
- [Fix OS command and argument injection in Java and Spring Boot (CWE-78, CWE-88)](https://softwaresecurity.com/fix/command-injection/java-spring/): Build the process from a List so ProcessBuilder runs it directly - new ProcessBuilder(List.of(tool, "--", name)) - and no shell parses the arguments; the "--" makes a leading-dash operand data, not an option.
- [Fix OS command and argument injection in C# and ASP.NET Core (CWE-78, CWE-88)](https://softwaresecurity.com/fix/command-injection/csharp-aspnetcore/): Start the process with ProcessStartInfo.ArgumentList and UseShellExecute = false - psi.ArgumentList.Add("--"); psi.ArgumentList.Add(name) - so no shell parses the arguments, and the '--' makes a leading-dash operand data, not an option.
- [Fix OS command injection in TypeScript and Next.js (CWE-78, CWE-88)](https://softwaresecurity.com/fix/command-injection/typescript-nextjs/): Run the program directly with its arguments as a list, execFileSync(tool, ['--', name]), so no shell parses them, and put '--' before any user operand so a leading dash cannot pose as an option.
- [Fix OS command and argument injection in Go and net/http (CWE-78, CWE-88)](https://softwaresecurity.com/fix/command-injection/go-nethttp/): Run the program itself with each argument as its own string: exec.CommandContext(ctx, tool, "--", name). os/exec never invokes a shell unless you call sh -c, so metacharacters stay characters, and "--" keeps a name that starts with a dash from posing as an option.
- [Fix server-side template injection in Node.js and Express (CWE-1336, CWE-94, CWE-95)](https://softwaresecurity.com/fix/template-injection/node-express/): Don't compile input as a template: ejs.render(userTemplate) runs any <%= ... %> as JavaScript.
- [Fix server-side template injection in Python and Flask (CWE-1336, CWE-94, CWE-95)](https://softwaresecurity.com/fix/template-injection/python-flask/): Pass input as data, never as template text: render_template_string('Hello {{ name }}', name=name), not render_template_string('Hello ' + name).
- [Fix server-side template (SpEL) injection in Java and Spring Boot (CWE-1336, CWE-94, CWE-95)](https://softwaresecurity.com/fix/template-injection/java-spring/): Evaluate user templates with a restricted context: SimpleEvaluationContext.forReadOnlyDataBinding() allows only property access on your data, so T(...) type references, constructors and reflection fail.
- [Fix server-side template injection in C# and ASP.NET Core (CWE-1336, CWE-94, CWE-95)](https://softwaresecurity.com/fix/template-injection/csharp-aspnetcore/): Don't run user input as code: CSharpScript.EvaluateAsync compiles the 'template' as C#.
- [Fix SQL injection in Node.js and Express (CWE-89)](https://softwaresecurity.com/fix/sql-injection/node-express/): Bind every value: put ? placeholders in the SQL and pass the values to node:sqlite, as in db.prepare(sql).all(name, status).
- [Fix SQL injection in Python and Flask (CWE-89)](https://softwaresecurity.com/fix/sql-injection/python-flask/): Keep values out of the SQL text: use ? placeholders and pass a tuple, as in db.execute(sql, (name, status)).
- [Fix SQL injection in Java and Spring Boot (CWE-89)](https://softwaresecurity.com/fix/sql-injection/java-spring/): Bind values with NamedParameterJdbcTemplate: write :name placeholders and pass a MapSqlParameterSource (or use JdbcTemplate with ? and arguments).
- [Fix SQL injection in C# and ASP.NET Core (CWE-89)](https://softwaresecurity.com/fix/sql-injection/csharp-aspnetcore/): Keep CommandText constant and bind values: write $name placeholders and call command.Parameters.AddWithValue("$name", name).
- [Fix SQL injection in TypeScript and Next.js (CWE-89)](https://softwaresecurity.com/fix/sql-injection/typescript-nextjs/): Bind every value: put ? placeholders in the SQL and pass the values to the driver, as in db.prepare(sql).all(name, status), inside the route handler's data layer.
- [Fix SQL injection in Python and FastAPI (CWE-89)](https://softwaresecurity.com/fix/sql-injection/python-fastapi/): Pass values as bound parameters: text("... WHERE c.name = :customer") with session.execute(sql, {"customer": customer}), or build the query with select() and column comparisons.
- [Fix SQL injection in Python and Django (CWE-89)](https://softwaresecurity.com/fix/sql-injection/python-django/): Let the ORM build the query: Order.objects.filter(customer\_\_name=name, status=status) sends both values as bound parameters.
- [Fix SQL injection in Go and net/http (CWE-89)](https://softwaresecurity.com/fix/sql-injection/go-nethttp/): Keep the SQL text constant and pass values as arguments: db.QueryContext(ctx, "... WHERE c.name = ?
- [Fix SQL injection in Ruby on Rails (CWE-89)](https://softwaresecurity.com/fix/sql-injection/ruby-rails/): Pass values to Active Record as hash conditions or placeholders: where(customers: { name: name }, status: status) or where("customers.name = ?", name).
- [Fix SQL injection in PHP and Laravel (CWE-89)](https://softwaresecurity.com/fix/sql-injection/php-laravel/): Let the query builder bind values: DB::table('orders as o')->where('c.name', $name)->where('o.status', $status) sends both as PDO parameters, and raw SQL takes ? placeholders with a bindings array.
- [Fix XPath injection in Python and Flask (CWE-643)](https://softwaresecurity.com/fix/xpath-injection/python-flask/): Bind the input as XPath variables, never splice it into the expression. lxml's doc.xpath("//employee[name=$n and role=$r]/title/text()", n=name, r=role) matches the values as data, so quotes and operators in them are literal.
- [Fix XPath injection in Java and Spring Boot (CWE-643, CWE-91)](https://softwaresecurity.com/fix/xpath-injection/java-spring/): Parameterize the XPath. Compile the query with $username and $password variables and supply their values through an XPathVariableResolver, so a value such as ' or '1'='1 is compared as a literal and can never become query structure.
- [Fix XPath injection in C# and ASP.NET Core (CWE-643, CWE-91)](https://softwaresecurity.com/fix/xpath-injection/csharp-aspnetcore/): Parameterize the query: compile the XPath with $username and $password variables and supply them through a custom XsltContext (ResolveVariable returning an IXsltContextVariable), attached with XPathExpression.SetContext.
- [Fix clickjacking in Node.js and Express (CWE-1021)](https://softwaresecurity.com/fix/clickjacking/node-express/): Send a framing policy on sensitive pages. Content-Security-Policy: frame-ancestors 'none' (or 'self' and named partners) is what modern browsers honor; add X-Frame-Options: DENY for old ones.
- [Fix clickjacking in Python and Flask (CWE-1021)](https://softwaresecurity.com/fix/clickjacking/python-flask/): Refuse framing in an HTTP response header, not in the page. Send Content-Security-Policy: frame-ancestors 'none' (which modern browsers honor over X-Frame-Options) plus X-Frame-Options: DENY for older browsers, on every page except one you mean to be embedded.
- [Fix clickjacking in Next.js (CWE-1021)](https://softwaresecurity.com/fix/clickjacking/typescript-nextjs/): Send a framing policy on sensitive pages, in middleware so every matched response carries it.
- [Fix clickjacking in Python and Django (CWE-1021)](https://softwaresecurity.com/fix/clickjacking/python-django/): Keep Django's XFrameOptionsMiddleware (X-Frame-Options defaults to DENY) and add a CSP with ContentSecurityPolicyMiddleware and SECURE_CSP = {"frame-ancestors": [CSP.NONE]}, which browsers honor over X-Frame-Options.
- [Fix ReDoS in Node.js and Express (CWE-1333)](https://softwaresecurity.com/fix/regex-dos/node-express/): A validation regex with a nested quantifier backtracks catastrophically: a 40-character string pins a CPU for minutes and, on Node's single event loop, blocks every request.
- [Fix ReDoS in Python and Flask (CWE-1333)](https://softwaresecurity.com/fix/regex-dos/python-flask/): A validation regex with a nested quantifier backtracks catastrophically on CPython's re: a 30-character string runs for tens of seconds and, while it holds the GIL, freezes the whole process.
- [Fix ReDoS in Java and Spring Boot (CWE-1333)](https://softwaresecurity.com/fix/regex-dos/java-spring/): On JDK 9+ java.util.regex memoizes to defuse many catastrophic patterns - but a backreference turns that off, so a nested quantifier backtracks exponentially again, and the engine has no timeout.
- [Fix ReDoS in C# and ASP.NET Core (CWE-1333)](https://softwaresecurity.com/fix/regex-dos/csharp-aspnetcore/): A validation regex with a nested quantifier backtracks catastrophically on the default engine: a 30-character string pins the request thread.
- [Fix unbounded resource consumption in Node.js and Express (CWE-770, CWE-400)](https://softwaresecurity.com/fix/resource-limits/node-express/): Bound every resource a request can consume: cap the body size as it is read (express.json's limit), cap the work one request asks for (a maximum item count), and rate-limit callers keyed on the connection address, not a header the client sets.
- [Fix unbounded resource consumption in C# and ASP.NET Core (CWE-770, CWE-400)](https://softwaresecurity.com/fix/resource-limits/csharp-aspnetcore/): Bound every resource a request can consume: read the body with a byte cap (413 over it), cap the batch size (400 over it), and add the rate limiter (AddRateLimiter, a fixed window) keyed on the connection address, not a client header.
- [Fix missing resource limits in Python and FastAPI (CWE-770, CWE-400)](https://softwaresecurity.com/fix/resource-limits/python-fastapi/): Bound every resource the client controls. Cap the request body while you read it -- count the stream and return 413 as soon as it exceeds the limit, never trusting Content-Length -- and bound pagination with Query(limit, ge=1, le=100) so an out-of-range page size is a 422.
- [Fix missing resource limits in Go and net/http (CWE-770, CWE-400)](https://softwaresecurity.com/fix/resource-limits/go-nethttp/): Cap the body with r.Body = http.MaxBytesReader(w, r.Body, limit): it counts bytes as they are read and stops at the limit whatever the client declares, so a chunked or lying request is bounded too.
- [Fix unrestricted file upload in Node.js and Express (CWE-434, CWE-646, CWE-73, CWE-770)](https://softwaresecurity.com/fix/file-upload/node-express/): Decide the type from the bytes, and never let the client pick the name.
- [Fix unrestricted file upload in Python and Flask (CWE-434, CWE-646, CWE-73, CWE-770)](https://softwaresecurity.com/fix/file-upload/python-flask/): Decide the type from the bytes, and never let the client pick the name.
- [Fix unrestricted file upload in Java and Spring Boot (CWE-434, CWE-646, CWE-73, CWE-770)](https://softwaresecurity.com/fix/file-upload/java-spring/): Decide the type from the bytes, and never let the client pick the name.
- [Fix unrestricted file upload in C# and ASP.NET Core (CWE-434, CWE-646, CWE-73, CWE-770)](https://softwaresecurity.com/fix/file-upload/csharp-aspnetcore/): Decide the type from the bytes, and never let the client pick the name.
- [Fix unrestricted file upload in Next.js (CWE-434, CWE-646, CWE-73, CWE-770)](https://softwaresecurity.com/fix/file-upload/typescript-nextjs/): Decide the type from the bytes, not from file.type or the name.
- [Fix unrestricted file upload in Python and FastAPI (CWE-434, CWE-646, CWE-73, CWE-770)](https://softwaresecurity.com/fix/file-upload/python-fastapi/): Decide the type from the bytes and never let the client pick the name.
- [Fix unrestricted file upload in Python and Django (CWE-434, CWE-646, CWE-73, CWE-770)](https://softwaresecurity.com/fix/file-upload/python-django/): Decide the type from the bytes and never let the client pick the name.
- [Fix unrestricted file upload in Go and net/http (CWE-434, CWE-646, CWE-73, CWE-770)](https://softwaresecurity.com/fix/file-upload/go-nethttp/): Decide the type from the bytes, and never serve uploads from the web root.
- [Fix unrestricted file upload in Ruby on Rails (CWE-434, CWE-646, CWE-73, CWE-770)](https://softwaresecurity.com/fix/file-upload/ruby-rails/): Decide the type from the bytes, and never serve uploads from the web root.
- [Fix unrestricted file upload in PHP and Laravel (CWE-434, CWE-646, CWE-73, CWE-770)](https://softwaresecurity.com/fix/file-upload/php-laravel/): Validate with max:512, mimes:png,jpg,jpeg (the type guessed from the contents) and extensions:png,jpg,jpeg (the client's name), require getClientMimeType() to equal getMimeType(), store() on a private disk so hashName() picks the name, and serve with Storage::download() plus X-Content-Type-Options: nosniff.
- [Fix hard-coded secrets in Node.js and Express (CWE-798, CWE-260)](https://softwaresecurity.com/fix/hardcoded-secrets/node-express/): Read the key from process.env at startup, where the deployment puts it from your secret store, and throw if it is missing or blank so the app never starts without it.
- [Fix hard-coded secrets in Python and Flask (CWE-798, CWE-261)](https://softwaresecurity.com/fix/hardcoded-secrets/python-flask/): Read the key from os.environ when the app is created, where the deployment puts it from your secret store, and raise if it is missing or blank so the app never starts without it.
- [Fix hard-coded secrets in Java and Spring Boot (CWE-798, CWE-260)](https://softwaresecurity.com/fix/hardcoded-secrets/java-spring/): Bind the key from the Spring Environment with @ConfigurationProperties and check it in the record's constructor, so a missing or blank value stops the app at startup.
- [Fix hard-coded secrets in C# and ASP.NET Core (CWE-798, CWE-260)](https://softwaresecurity.com/fix/hardcoded-secrets/csharp-aspnetcore/): Bind the key with AddOptions<T>().BindConfiguration("Forecast"), mark it [Required] and call ValidateDataAnnotations() and ValidateOnStart() so a missing or blank key stops the app at startup.
- [Fix TLS certificate validation in Node.js and Express (CWE-295, CWE-297, CWE-296)](https://softwaresecurity.com/fix/tls-certificate-validation/node-express/): Never turn verification off. Give the partner client an https.Agent whose ca is the partner's private CA bundle, set rejectUnauthorized: true explicitly so NODE_TLS_REJECT_UNAUTHORIZED=0 cannot flip it, and keep the default checkServerIdentity.
- [Fix TLS certificate validation in Python and Flask (CWE-295, CWE-297, CWE-296)](https://softwaresecurity.com/fix/tls-certificate-validation/python-flask/): Never pass verify=False. Pass verify= the path of the partner's private CA bundle on every request: requests then checks the chain against that CA alone, the dates and the host name, and a per-request value cannot be replaced by REQUESTS_CA_BUNDLE.
- [Fix TLS certificate validation in Java and Spring Boot (CWE-295, CWE-297, CWE-296)](https://softwaresecurity.com/fix/tls-certificate-validation/java-spring/): Never install a TrustManager or HostnameVerifier that accepts everything.
- [Fix TLS certificate validation in C# and ASP.NET Core (CWE-295, CWE-297, CWE-296)](https://softwaresecurity.com/fix/tls-certificate-validation/csharp-aspnetcore/): Never return true from a certificate validation callback. Leave validation to SslStream and change only the trust anchor: set SocketsHttpHandler.SslOptions.CertificateChainPolicy to CustomRootTrust with the partner's CA in CustomTrustStore, and RevocationMode NoCheck if the private CA has no CRL.
- [Fix TLS certificate validation in Go and net/http (CWE-295, CWE-297, CWE-296)](https://softwaresecurity.com/fix/tls-certificate-validation/go-nethttp/): Leave verification on and change only the trust anchor: put the partner's CA in x509.NewCertPool(), set it as tls.Config.RootCAs with MinVersion tls.VersionTLS12, and keep InsecureSkipVerify false and ServerName empty so crypto/tls checks the chain, the dates and the host name.
- [Fix JWT validation in Node.js and Express (CWE-347, CWE-287)](https://softwaresecurity.com/fix/jwt-validation/node-express/): Verify every bearer token with jose's jwtVerify(): pass the issuer's public key from configuration, algorithms: ['RS256'], issuer and audience, requiredClaims: ['exp', 'sub'] and a small clockTolerance.
- [Fix JWT validation in Python and Flask (CWE-347, CWE-287)](https://softwaresecurity.com/fix/jwt-validation/python-flask/): Verify every bearer token with PyJWT's jwt.decode(token, key, algorithms=["RS256"], issuer=..., audience=..., leeway=30, options={"require": ["exp", "iss", "aud", "sub"]}), with the key from configuration.
- [Fix JWT validation in Java and Spring Boot (CWE-347, CWE-287)](https://softwaresecurity.com/fix/jwt-validation/java-spring/): Build the JwtDecoder bean with NimbusJwtDecoder.withPublicKey(key).signatureAlgorithm(RS256) (or withIssuerLocation for rotating keys) and set its validators: JwtValidators.createDefaultWithValidators(timestamps, new JwtIssuerValidator(issuer), new JwtAudienceValidator(audience)), with a JwtTimestampValidator that requires exp.
- [Fix JWT validation in C# and ASP.NET Core (CWE-347, CWE-287)](https://softwaresecurity.com/fix/jwt-validation/csharp-aspnetcore/): Configure JwtBearer's TokenValidationParameters with the issuer's signing key from configuration (or options.Authority), ValidAlgorithms = [RS256], ValidIssuer, ValidAudience and a ClockSkew of seconds, leaving ValidateIssuer, ValidateAudience, ValidateLifetime, RequireExpirationTime and RequireSignedTokens true.
- [Fix JWT validation in TypeScript and Next.js (CWE-347, CWE-287)](https://softwaresecurity.com/fix/jwt-validation/typescript-nextjs/): Verify the bearer token inside the route handler with jose's jwtVerify(): the issuer's public key from configuration, algorithms: ['RS256'], issuer and audience, requiredClaims: ['exp', 'sub'] and a small clockTolerance.
- [Fix JWT validation in Python and FastAPI (CWE-347, CWE-287)](https://softwaresecurity.com/fix/jwt-validation/python-fastapi/): Put verification in one dependency that every protected route declares: HTTPBearer() reads the token, then jwt.decode(token, key, algorithms=["RS256"], issuer=..., audience=..., leeway=30, options={"require": ["exp", "iss", "aud", "sub"]}) with the key from configuration, and any PyJWTError becomes 401.
- [Fix JWT validation in Go and net/http (CWE-347, CWE-287)](https://softwaresecurity.com/fix/jwt-validation/go-nethttp/): Verify with jwt.ParseWithClaims, a keyfunc that returns the issuer's public key from configuration, and options: jwt.WithValidMethods([]string{"RS256"}), jwt.WithIssuer, jwt.WithAudience, jwt.WithExpirationRequired and jwt.WithLeeway(30\*time.Second).
- [Fix missing authentication for a critical function in Node.js and Express (CWE-306, CWE-287)](https://softwaresecurity.com/fix/missing-authentication/node-express/): Verify a credential on the server before any critical route runs.
- [Fix missing authentication in Python and Flask (CWE-306)](https://softwaresecurity.com/fix/missing-authentication/python-flask/): Authenticate the operator, do not trust the network or a client-supplied header.
- [Fix missing authentication for a critical function in Java and Spring Boot (CWE-306, CWE-287)](https://softwaresecurity.com/fix/missing-authentication/java-spring/): Verify a credential on the server before any critical route runs.
- [Fix missing authentication for a critical function in C# and ASP.NET Core (CWE-306, CWE-287)](https://softwaresecurity.com/fix/missing-authentication/csharp-aspnetcore/): Verify a credential on the server in your authentication handler, then require it on every protected endpoint.
- [Fix missing authentication for a critical function in Next.js (CWE-306, CWE-287)](https://softwaresecurity.com/fix/missing-authentication/typescript-nextjs/): Verify a credential on the server in every protected route handler.
- [Fix missing authentication in Python and FastAPI (CWE-306)](https://softwaresecurity.com/fix/missing-authentication/python-fastapi/): Put an authentication dependency on every protected path operation.
- [Fix missing authentication in Python and Django (CWE-306)](https://softwaresecurity.com/fix/missing-authentication/python-django/): Authenticate the operator, do not trust the network or a client header.
- [Fix missing authentication in Go and net/http (CWE-306, CWE-287, CWE-288, CWE-290)](https://softwaresecurity.com/fix/missing-authentication/go-nethttp/): Make every critical route go through one authentication step that verifies a credential the server issued: here a Bearer token whose HMAC-SHA256 is checked with hmac.Equal.
- [Fix missing authentication in Ruby on Rails (CWE-306, CWE-287, CWE-288, CWE-290)](https://softwaresecurity.com/fix/missing-authentication/ruby-rails/): Keep the before_action :authenticate in ApplicationController so every action needs it, and skip_before_action only on the public health route.
- [Fix missing authentication in PHP and Laravel (CWE-306, CWE-287, CWE-288, CWE-290)](https://softwaresecurity.com/fix/missing-authentication/php-laravel/): Put every critical route behind one middleware that verifies a server-issued credential: here a Bearer token whose HMAC-SHA256 is checked with hash_equals.
- [Fix session fixation and session cookies in Node.js and Express (CWE-384, CWE-613, CWE-614, CWE-1004, CWE-1275)](https://softwaresecurity.com/fix/session-cookies/node-express/): In the sign-in handler, call req.session.regenerate(), then store the user and save, so no session ID from before sign-in survives.
- [Fix session fixation and session cookies in Python and Flask (CWE-384, CWE-613, CWE-614, CWE-1004, CWE-1275)](https://softwaresecurity.com/fix/session-cookies/python-flask/): With server-side sessions (Flask-Session), call app.session_interface.regenerate(session) after storing the user at sign-in; session.clear() keeps the same ID.
- [Fix session fixation and session cookies in Java and Spring Boot (CWE-384, CWE-613, CWE-614, CWE-1004, CWE-1275)](https://softwaresecurity.com/fix/session-cookies/java-spring/): Let Spring Security sign users in (formLogin or another built-in mechanism) and keep sessionFixation at changeSessionId, the default; a custom login endpoint must invoke the SessionAuthenticationStrategy itself.
- [Fix session fixation and session cookies in C# and ASP.NET Core (CWE-384, CWE-613, CWE-614, CWE-1004, CWE-1275)](https://softwaresecurity.com/fix/session-cookies/csharp-aspnetcore/): Keep the signed-in user in an authentication cookie, not in ISession, which cannot change its ID: SignInAsync issues a new ticket at sign-in.
- [Fix session fixation and cookies in Ruby on Rails (CWE-384, CWE-613, CWE-614, CWE-1004, CWE-1275)](https://softwaresecurity.com/fix/session-cookies/ruby-rails/): Call reset_session at sign-in, not session.clear: only reset_session issues a new session ID.
- [Fix session fixation and session cookies in PHP and Laravel (CWE-384, CWE-613, CWE-614, CWE-1004, CWE-1275)](https://softwaresecurity.com/fix/session-cookies/php-laravel/): Sign users in with Auth::attempt() or Auth::login(), which give the session a new ID, or call $request->session()->regenerate(true) in your own sign-in.
- [Fix insecure deserialization in Node.js and Express (CWE-502)](https://softwaresecurity.com/fix/deserialization/node-express/): Treat the token as data: JSON.parse it and rebuild only an allowlisted type - map $type to one known class, never the class the payload names.
- [Fix insecure deserialization in Python and Flask (CWE-502)](https://softwaresecurity.com/fix/deserialization/python-flask/): Do not rebuild objects from the token. Decode it as JSON and copy only the fields you expect into a fixed shape; pickle.loads runs code chosen by the bytes.
- [Fix insecure deserialization in Java and Spring Boot (CWE-502)](https://softwaresecurity.com/fix/deserialization/java-spring/): Do not deserialize untrusted bytes with ObjectInputStream: its readObject runs code chosen by the payload.
- [Fix insecure deserialization in C# and ASP.NET Core (CWE-502)](https://softwaresecurity.com/fix/deserialization/csharp-aspnetcore/): Do not let the payload choose the type. With Newtonsoft.Json keep TypeNameHandling at None and bind to a concrete class; a SerializationBinder blocklist is not enough and even quiets the analyzer.
- [Fix insecure deserialization in Python and FastAPI (CWE-502)](https://softwaresecurity.com/fix/deserialization/python-fastapi/): Do not rebuild objects from client data. Parse the token as JSON with a Pydantic model (Profile.model_validate_json(raw)), which keeps only declared fields of declared types; pickle.loads runs code chosen by the bytes.
- [Fix insecure deserialization in Ruby on Rails (CWE-502)](https://softwaresecurity.com/fix/deserialization/ruby-rails/): Do not rebuild objects from the token: Base64-decode it and JSON.parse the bytes, then copy only the fields you expect into a fixed shape; Marshal.load runs code chosen by the bytes.
- [Fix insecure deserialization in PHP and Laravel (CWE-502)](https://softwaresecurity.com/fix/deserialization/php-laravel/): Do not rebuild objects from the token: base64-decode it and json_decode the bytes, then copy only the fields you expect; unserialize instantiates whatever class the string names and runs its \_\_wakeup.
- [Fix mass assignment (over-posting) in Node.js and Express (CWE-915)](https://softwaresecurity.com/fix/mass-assignment/node-express/): Never pass req.body to Object.assign, a spread or an ORM create or update on a stored record.
- [Fix mass assignment (over-posting) in Python and Flask (CWE-915)](https://softwaresecurity.com/fix/mass-assignment/python-flask/): Never copy request.get_json() onto a record with dict.update(), a setattr loop or Model(\*\*data).
- [Fix mass assignment (over-posting) in Java and Spring Boot (CWE-915)](https://softwaresecurity.com/fix/mass-assignment/java-spring/): Bind @RequestBody to a record that declares only the fields users may edit (here ProfileUpdate(displayName, bio)), never to the entity, and copy those fields onto the entity yourself.
- [Fix mass assignment (over-posting) in C# and ASP.NET Core (CWE-915)](https://softwaresecurity.com/fix/mass-assignment/csharp-aspnetcore/): Bind the body to an input model record that declares only the fields users may edit (here ProfileUpdate(DisplayName, Bio)), never to the entity, and copy those fields onto the entity yourself.
- [Fix mass assignment in TypeScript and Next.js (CWE-915)](https://softwaresecurity.com/fix/mass-assignment/typescript-nextjs/): Never pass await request.json() or Object.fromEntries(formData) to Object.assign, a spread or an ORM create or update.
- [Fix mass assignment in Python and FastAPI (CWE-915)](https://softwaresecurity.com/fix/mass-assignment/python-fastapi/): Give each write route its own Pydantic body model that declares only the fields that caller may change (here displayName and bio), never the model that describes the whole stored user, and copy model_dump(exclude_none=True) onto the record. extra="forbid" turns any other key into a 422.
- [Fix mass assignment in Python and Django (CWE-915)](https://softwaresecurity.com/fix/mass-assignment/python-django/): Give every ModelForm an explicit allowlist, fields = ["display_name", "bio"]: it binds only those fields and ignores the rest of the request.
- [Fix mass assignment in Go and net/http (CWE-915)](https://softwaresecurity.com/fix/mass-assignment/go-nethttp/): Decode the body into an input struct that declares only the fields users may edit (here ProfileUpdate with DisplayName and Bio), never into the stored struct, call DisallowUnknownFields, and copy each field across yourself. encoding/json matches keys to fields case-insensitively, so a blocklist that refuses "role" by its exact name lets "Role" through.
- [Fix mass assignment in Ruby on Rails (CWE-915)](https://softwaresecurity.com/fix/mass-assignment/ruby-rails/): Pass only an allowlist to the model: user.update(params.permit(:display_name, :bio)), or params.expect(user: [:display_name, :bio]) for a nested body.
- [Fix mass assignment (over-posting) in PHP and Laravel (CWE-915)](https://softwaresecurity.com/fix/mass-assignment/php-laravel/): Give each model an allowlist, #[Fillable(['display_name', 'bio'])] (or $fillable), and pass only validated input: $profile->update($request->validate([...rules for the editable fields...])). validate() returns just the keys it has rules for.
- [Fix CRLF and log injection in Node.js and Express (CWE-117, CWE-93, CWE-113)](https://softwaresecurity.com/fix/crlf-log-injection/node-express/): Log with a structured logger such as pino, so every field is JSON-encoded and a CR, LF or escape character in a value can never end the record.
- [Fix CRLF and log injection in Python and Flask (CWE-117, CWE-93, CWE-113)](https://softwaresecurity.com/fix/crlf-log-injection/python-flask/): Log events as structured data: pass request values to the logger as fields and format each record as one JSON object, so CR, LF and escape characters are encoded and cannot end it.
- [Fix CRLF and log injection in Java and Spring Boot (CWE-117, CWE-93, CWE-113)](https://softwaresecurity.com/fix/crlf-log-injection/java-spring/): Encode request values before they reach a log line, turning every control character into a visible escape, or use Spring Boot's structured JSON logging; never delete only LF.

## Workflows

- [Fix a finding](https://softwaresecurity.com/workflows/fix-a-finding/): Move from a scanner alert to a tested, durable fix.
- [Secure a feature](https://softwaresecurity.com/workflows/secure-a-feature/): Make security part of the implementation, from the first decision.
- [Review a design](https://softwaresecurity.com/workflows/review-a-design/): Trace data, challenge assumptions, and make risk decisions explicit.
- [Test an application](https://softwaresecurity.com/workflows/test-an-application/): Build a focused test plan around trust boundaries and real behavior.
- [Respond to a vulnerability](https://softwaresecurity.com/workflows/respond-to-a-vulnerability/): Understand exposure, contain risk, and verify the recovery.
- [Build an AppSec program](https://softwaresecurity.com/workflows/build-an-appsec-program/): Connect ownership, engineering practices, and evidence of improvement.

## Optional

- [Glossary](https://softwaresecurity.com/glossary/): Definitions of 271 security terms, each on its own page with the guides that cover it
- [Guide inventory as JSON](https://softwaresecurity.com/downloads/coverage.json): Every guide with its domain, platforms, guided practice, browser labs and local projects
- [Coverage map as JSON](https://softwaresecurity.com/downloads/requirements.json): Security outcomes mapped to guides, labs and projects, with ASVS and WSTG references
- [Learning paths](https://softwaresecurity.com/learn/): Sequences of guides and labs with objectives and a capstone case
- [Browser labs](https://softwaresecurity.com/labs/): Repair vulnerable code and run its tests
- [SBOM checker](https://softwaresecurity.com/tools/sbom-checker/): Inspects CycloneDX and SPDX JSON in the browser
- [JWT inspector](https://softwaresecurity.com/tools/jwt-inspector/): Decodes compact JWS and JWE headers and claims
- [CSP evaluator](https://softwaresecurity.com/tools/csp-evaluator/): Parses policies as CSP Level 3 does, including duplicates and multiple policies
- [Security headers analyzer](https://softwaresecurity.com/tools/security-headers/): Reads HTTP/1.1 and HTTP/2 header blocks pasted from curl or developer tools
- [CVSS v4.0 calculator](https://softwaresecurity.com/tools/cvss-calculator/): Scores CVSS v4.0 Base, Threat and Environmental metrics (CVSS-B, BT, BE and BTE)
- [ReDoS checker](https://softwaresecurity.com/tools/redos-checker/): Parses JavaScript regex syntax, flags included, and reports where each risky shape is
- [security.txt validator](https://softwaresecurity.com/tools/security-txt/): Checks the required Contact and Expires fields, and Expires is under a year ahead
- [OSV dependency lookup](https://softwaresecurity.com/tools/osv-lookup/): Reads npm, PyPI, Go, RubyGems and Packagist lockfiles and CycloneDX or SPDX SBOMs locally
- [GitHub Actions workflow analyzer](https://softwaresecurity.com/tools/actions-analyzer/): Parses workflow YAML locally and reports each finding with its line
- [ASVS 5.0 checklist export](https://softwaresecurity.com/tools/asvs-checklist/): Filters the 345 ASVS 5.0.0 requirements by level and chapter
- [Reuse terms](https://softwaresecurity.com/license/): Licenses, suggested attribution and crawler policy
- [Content API documentation](https://softwaresecurity.com/api/): Every guide as versioned JSON, with the index, article documents and their JSON Schema
- [Case studies](https://softwaresecurity.com/case-studies/): Real incidents and attacks with the year, category and key lesson of each
- [Tags](https://softwaresecurity.com/tags/): The guides by tag, lifecycle stage (design to response) and role
- [Team training plans](https://softwaresecurity.com/learn/teams/): Six- and twelve-week plans with facilitator notes