{"version":4,"types":["Case study","Fix card","Guide","Identifier","Lab","Learning path","Project","Recipe","Reference","Tool","Topic","Workflow","Glossary"],"domains":["appsec","supply-chain","runtime","identity-crypto","governance","ai-emerging",""],"typeLists":{"Lab":{"tags":["Learning","Exercise"]},"Learning path":{"tags":["Learning","Training"],"aliases":["capstone","capstone workbook"]},"Project":{"tags":["Local project"]},"Workflow":{"aliases":["work product","template","checklist"]},"Glossary":{"tags":["Definition"]}},"bases":["/domains/appsec/vulnerability-response/","/domains/appsec/authorization/","/domains/appsec/secure-coding/","/domains/appsec/platform-security/","/fix/","/fix/clickjacking/","/fix/file-upload/","/fix/stack/","/domains/appsec/secure-features/","/domains/appsec/threat-modeling/","/domains/appsec/browser-security/","/domains/appsec/business-logic/","/domains/appsec/code-review/","/domains/appsec/testing/","/domains/appsec/smart-contracts/","/domains/appsec/input-handling/","/","/owasp-top-10/","/masvs/","/cwe/","/owasp-top-10/2025/","/owasp-api-top-10/2023/","/asvs/5.0/","/masvs/2.1/","/labs/","/learn/","/labs/#","/tools/","/domains/","/workflows/","/domains/supply-chain/dependencies/","/domains/supply-chain/ci-cd/","/domains/supply-chain/builds/","/domains/supply-chain/sbom/","/domains/supply-chain/provenance/","/domains/supply-chain/vex/","/domains/supply-chain/releases/","/owasp-cicd-top-10/","/owasp-cicd-top-10/2022/","/domains/runtime/containers/","/domains/runtime/cloud-posture/","/domains/runtime/api-security/","/domains/runtime/detection/","/domains/runtime/availability/","/domains/runtime/service-security/","/domains/runtime/edge-defense/","/owasp-api-top-10/","/owasp-kubernetes-top-10/","/owasp-kubernetes-top-10/2025/","/domains/identity-crypto/encryption/","/domains/identity-crypto/key-management-pki/","/domains/identity-crypto/secrets/","/domains/identity-crypto/authentication/","/fix/missing-authentication/","/domains/identity-crypto/identity/","/domains/identity-crypto/privacy/","/frameworks/","/asvs/","/domains/ai-emerging/llm-security/","/domains/ai-emerging/agent-security/","/domains/ai-emerging/assurance/","/domains/ai-emerging/ml-security/","/domains/ai-emerging/governance/","/owasp-llm-top-10/","/owasp-agentic-top-10/","/owasp-llm-top-10/2026/","/owasp-agentic-top-10/2026/","/glossary/","/tools/#"],"shardSize":20,"summaries":{"hash":"afa487504285e258","count":56},"groups":{"Coverage":"/search-data/02c3d3b8339aee3e.json"},"toolStacks":{"gosec":["go-nethttp"],"bandit":["python-flask","python-fastapi","python-django"],"brakeman":["ruby-rails"],"psalm":["php-laravel"],"spotbugs":["java-spring"],"findsecbugs":["java-spring"],"roslyn":["csharp-aspnetcore"],"netanalyzers":["csharp-aspnetcore"],"eslint":["node-express"],"govulncheck":["go-nethttp"],"recheck":["node-express"],"regexploit":["python-flask"]},"stacks":[["node-express","Node.js and Express",["nodejs","node","express","javascript","js","ejs"]],["python-flask","Python and Flask",["python","flask","jinja","jinja2"]],["java-spring","Java and Spring Boot",["java","spring","springboot","thymeleaf"]],["csharp-aspnetcore","C# and ASP.NET Core",["csharp","dotnet","asp","aspnet","aspnetcore","razor"]],["typescript-nextjs","TypeScript and Next.js",["nextjs","next","typescript","ts","tsx","react"],["nextjs"]],["python-fastapi","Python and FastAPI",["fastapi","pydantic","starlette"]],["python-django","Python and Django",["django","drf"]],["go-nethttp","Go and net/http",["go","golang","nethttp"],["golang"]],["ruby-rails","Ruby on Rails",["ruby","rails","ror","erb","activerecord"]],["php-laravel","PHP and Laravel",["php","laravel","blade","eloquent"]]],"fix":[[6,"Fix CSRF",[0,1,2,3,6,8,9]],[7,"Fix missing object-level authorization (IDOR)",[0,1,2,3,4,[5,"Fix IDOR and missing authorization"],[6,"Fix IDOR and missing authorization"],[7,"Fix IDOR and missing authorization"],[8,"Fix IDOR and missing authorization"],9]],[8,"Fix open redirects",[0,1,2,3,4,5,6,7,8,9]],[9,"Fix path traversal",[0,1,2,3,4,5,6,7,8,9]],[10,"Fix SSRF",[0,1,2,3,4,5,6,7,[8,"Fix server-side request forgery"],[9,"Fix server-side request forgery"]]],[11,"Fix CORS misconfiguration",[0,1,2,3]],[12,"Fix XML external entity processing",[1,2,3]],[13,"Fix code injection",[0,1,2,3,5]],[14,"Fix cross-site scripting",[0,1,2,3,[4,"Fix XSS"],[6,"Fix XSS"],7,[8,"Fix XSS"],9]],[15,"Fix CSV formula injection",[0,1,2,3,6,8]],[16,"Fix LDAP filter injection",[1,2]],[17,"Fix NoSQL operator injection",[0,1]],[18,"Fix OS command and argument injection",[0,1,2,3,[4,"Fix OS command injection"],7]],[19,"Fix server-side template injection",[0,1,[2,"Fix server-side template (SpEL) injection"],3]],[20,"Fix SQL injection",[0,1,2,3,4,5,6,7,8,9]],[21,"Fix XPath injection",[1,2,3]],[22,"Fix clickjacking",[0,1,6]],[24,"Fix ReDoS",[0,1,2,3]],[25,"Fix unbounded resource consumption",[0,3,[5,"Fix missing resource limits"],[7,"Fix missing resource limits"]]],[26,"Fix unrestricted file upload",[0,1,2,3,5,6,7,8,9]],[28,"Fix insecure deserialization",[0,1,2,3,5,8,9]],[29,"Fix mass assignment (over-posting)",[0,1,2,3,[4,"Fix mass assignment"],[5,"Fix mass assignment"],[6,"Fix mass assignment"],[7,"Fix mass assignment"],[8,"Fix mass assignment"],9]],[30,"Fix CRLF and log injection",[0,1,2]],[481,"Fix insecure randomness for reset tokens",[0,1,2,3,7]],[482,"Fix weak password hashing",[0,1,2,3,5,6,7,9]],[483,"Fix hard-coded secrets",[0,1,2,3]],[484,"Fix TLS certificate validation",[0,1,2,3,7]],[485,"Fix JWT validation",[0,1,2,3,4,5,7]],[486,"Fix missing authentication",[[0,"Fix missing authentication for a critical function"],1,[2,"Fix missing authentication for a critical function"],[3,"Fix missing authentication for a critical function"],5,6,7,8,9]],[488,"Fix session fixation and session cookies",[0,1,2,3,[8,"Fix session fixation and cookies"],9]]],"columns":{"key":[1,1,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,"object-authorization","secure-uploads","webhook-verification","multitenant-threat-model","dependency-response","mobile-native-boundaries",1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,"smart-contract-invariants",1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,"threat-model-mobile-banking","threat-model-llm-agent","smart-contract-defi-attacks",0,0,"masvs-2-1-0",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,"asvs-5-0-0-v1","asvs-5-0-0-v2","asvs-5-0-0-v3","asvs-5-0-0-v5","asvs-5-0-0-v8","asvs-5-0-0-v15","asvs-5-0-0-v17","masvs-2-1-0-masvs-storage-1","masvs-2-1-0-masvs-storage-2","masvs-2-1-0-masvs-crypto-1","masvs-2-1-0-masvs-crypto-2","masvs-2-1-0-masvs-auth-1","masvs-2-1-0-masvs-auth-2","masvs-2-1-0-masvs-auth-3","masvs-2-1-0-masvs-network-1","masvs-2-1-0-masvs-network-2","masvs-2-1-0-masvs-platform-1","masvs-2-1-0-masvs-platform-2","masvs-2-1-0-masvs-platform-3","masvs-2-1-0-masvs-code-1","masvs-2-1-0-masvs-code-2","masvs-2-1-0-masvs-code-3","masvs-2-1-0-masvs-code-4","masvs-2-1-0-masvs-resilience-1","masvs-2-1-0-masvs-resilience-2","masvs-2-1-0-masvs-resilience-3","masvs-2-1-0-masvs-resilience-4","masvs-2-1-0-masvs-privacy-1","masvs-2-1-0-masvs-privacy-2","masvs-2-1-0-masvs-privacy-3","masvs-2-1-0-masvs-privacy-4",1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,"sql-injection-python",1,1,1,"csp-evaluator-tool","security-headers-tool","redos-checker-tool","security-txt-tool",0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,"ci-build-integrity","sbom-generation","sbom-formats-identifiers","sbom-release-diff","dependency-risk-triage",1,"slsa-provenance","ci-untrusted-workflows",1,"vex-decisions","reproducible-builds","dependency-project-health","trusted-publishing-updates",1,1,1,1,1,"osps-baseline-maintainers","s2c2f-consumer-adoption",1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,1,1,1,"sbom-tool","osv-lookup-tool","actions-analyzer-tool",1,1,1,1,"iac-review","api-resource-limits","security-logging",1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,"asvs-5-0-0-v4","asvs-5-0-0-v16",0,0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,"icdp-case-wep-2001","icdp-case-flame-2012","icdp-case-lucky13-poodle","icdp-case-freak-logjam-2015","icdp-case-drown-2016","icdp-case-sweet32-2016","icdp-case-roca-2017",1,1,1,1,0,0,0,0,0,0,0,0,"secret-handling","authentication-session-lifecycle",1,1,1,1,1,"aead-record-design",1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0,"asvs-5-0-0-v6","asvs-5-0-0-v7","asvs-5-0-0-v9","asvs-5-0-0-v10","asvs-5-0-0-v11","asvs-5-0-0-v12","asvs-5-0-0-v13","asvs-5-0-0-v14",0,1,1,1,1,1,1,1,1,1,1,1,1,1,"crypto-ecb","crypto-padding-oracle","crypto-hash-collisions","crypto-weak-rsa","crypto-rc4","crypto-sweet32-mechanism",1,"jwt-inspector-tool",1,"minimal-appsec-program","security-program-operations",1,1,1,"risk-exceptions-metrics","assurance-mapping","supplier-assurance",1,"assurance-frameworks","privacy-regulatory-scope",1,1,1,1,1,"secure-by-design-principles","choosing-bsimm-samm-ssdf","developer-security-training-program",1,1,1,1,1,1,1,1,1,"federal-software-attestation","asvs-5-0-0",1,1,"cvss-calculator-tool","asvs-checklist-tool","governance",0,1,1,1,1,1,1,"agent-tool-authorization",1,1,1,"ai-cost-memory-operations",1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,"team-training",0,0,"content-api"],"slug":["case-study-log4shell","case-study-moveit","case-study-first-american","case-study-citrix-bleed","case-study-spring4shell","case-study-crowdstrike-channel-file-291","csrf","missing-authorization","open-redirect","path-traversal","ssrf","cors-misconfiguration","xxe","code-injection","xss","csv-formula-injection","ldap-injection","nosql-injection","command-injection","template-injection","sql-injection","xpath-injection","clickjacking","typescript-nextjs","regex-dos","resource-limits","file-upload","typescript-nextjs","deserialization","mass-assignment","crlf-log-injection","node-express","python-flask","java-spring","csharp-aspnetcore","typescript-nextjs","python-fastapi","python-django","go-nethttp","ruby-rails","php-laravel","versions","object-level-authorization","secure-file-uploads","verify-webhook-deliveries","multitenant-design-review","dependency-vulnerability-response","mobile-native-trust-boundaries","xss-output-encoding","ssrf-egress-boundaries","secure-error-handling","information-disclosure-misconfiguration","coordinated-disclosure","csrf-origin-defense","cors-csp-browser-boundaries","rich-text-dom-security","function-property-authorization","transaction-races","injection-parser-boundaries","os-command-injection","code-template-injection","archive-path-safety","untrusted-document-conversion","webrtc-security","security-code-review","sast-dast-workflow","parser-fuzzing","framework-security-patterns","android-ios-security","electron-native-security","embedded-update-security","security-invariants","bounded-json-xml-parsing","prototype-pollution-boundaries","android-secure-coding","business-logic-flaws","crlf-header-log-injection","devsecops-pipeline","appsec-tool-categories-and-evaluation","dom-xss-postmessage","ios-secure-coding","memory-safety-c-cpp","nosql-ldap-xpath-injection","open-redirect","redos-input-validation","rust-unsafe-ffi","security-headers","threat-modeling-methods","vdp-bug-bounty-pentest","security-requirements-definition-of-done","psirt-operating-model","security-advisories-csaf-vex","product-incident-response","file-inclusion","insecure-temp-files","third-party-api-consumption","mobile-banking-threat-model","llm-agent-threat-model","defi-attack-patterns","cwe","2025","2.1","79","89","352","862","787","22","416","125","78","94","120","434","476","121","502","122","20","200","306","918","77","639","23","36","59","73","74","88","90","91","93","95","98","113","116","117","119","129","130","180","190","204","208","209","213","215","235","257","260","261","269","275","285","287","288","290","294","295","296","297","298","307","308","311","312","319","321","323","324","326","328","330","331","338","345","346","348","349","353","359","362","367","377","379","384","409","427","436","441","460","472","489","497","501","521","522","527","532","538","540","548","601","602","611","613","614","617","636","640","643","646","653","656","657","665","668","674","682","732","749","757","758","759","760","762","776","777","798","799","837","839","841","912","915","917","922","926","927","939","940","942","943","1004","1021","1104","1188","1236","1240","1265","1275","1277","1284","1287","1321","1329","1333","1336","1385","1390","1392","1395","1426","1427","a01","a02","a03","a05","a06","a10","api1","api3","api5","api6","api7","api10","v1","v2","v3","v5","v8","v15","v17","masvs-storage-1","masvs-storage-2","masvs-crypto-1","masvs-crypto-2","masvs-auth-1","masvs-auth-2","masvs-auth-3","masvs-network-1","masvs-network-2","masvs-platform-1","masvs-platform-2","masvs-platform-3","masvs-code-1","masvs-code-2","masvs-code-3","masvs-code-4","masvs-resilience-1","masvs-resilience-2","masvs-resilience-3","masvs-resilience-4","masvs-privacy-1","masvs-privacy-2","masvs-privacy-3","masvs-privacy-4","csrf","archive-paths","checkout-race","authorization","webhooks","ssrf-url-policy","cors-policy","csp-policy","html-sanitizer","coupon-limits","sql-injection-sqlite","path-traversal-python","ssrf-validation-python","safe-redirect","file-upload","command-injection","mass-assignment","heartbeat-bounds","template-injection-jinja","xxe-lxml","pickle-deserialization","developer-foundations","appsec-practitioner","browser-api-defense","project-express-api","project-checkout-sqlite","project-archive-extraction","project-bounded-data-parsing","project-native-memory-safety","project-prototype-pollution","project-security-pipeline","project-ios-platform-boundaries","project-android-platform-boundaries","project-electron-ipc-bridge","project-firmware-ab-recovery","project-document-conversion-sandbox","sql-injection-python-sqlite3","abuse-case-library","threat-pattern-library","secure-design-patterns","csp-evaluator","security-headers","redos-checker","security-txt","rules","appsec","fix-a-finding","secure-a-feature","review-a-design","test-an-application","respond-to-a-vulnerability","case-study-shai-hulud","case-study-tj-actions","case-study-xz-utils","case-study-solarwinds","case-study-codecov","case-study-3cx","case-study-event-stream","case-study-polyfill-io","build-integrity","generate-release-inventory","formats-and-identifiers","release-diff-and-distribution","evidence-based-triage","artifact-signature-policy","read-and-verify-slsa","untrusted-workflow-boundaries","package-attack-response","producer-and-consumer-decisions","reproducibility-and-hermeticity","project-health-and-intake","trusted-publishing-and-updates","dependency-confusion","github-actions-hardening","source-repository-protection","developer-workstation-security","open-source-license-compliance","osps-baseline-for-maintainers","s2c2f-adoption","staged-rollout-rollback","2022","494","506","829","1357","a08","cicd-sec-1","cicd-sec-2","cicd-sec-3","cicd-sec-4","cicd-sec-5","cicd-sec-6","cicd-sec-7","cicd-sec-8","cicd-sec-9","cicd-sec-10","sbom-inventory","artifact-policy","actions-injection","supply-chain-assurance","project-release-verification","sbom-checker","osv-lookup","actions-analyzer","supply-chain","case-study-ingress-nginx","case-study-circleci-2023","case-study-microsoft-sas-token","iac-security","resource-consumption-limits","security-event-logging","kubernetes-workload-security","container-network-admission","cloud-iam-trust","iac-policy-drift","subdomain-takeover","api-gateway-inventory","protocol-api-security","bounded-background-work","workload-mtls-serverless","runtime-detection-response","edge-waf-bot-defense","http-request-desynchronization","cache-poisoning-deception","cloud-provider-baselines","runtime-threat-detection","managed-kubernetes-hardening","l7-ddos-resilience","cloud-security-posture","container-image-hardening","image-hardening-benchmarks","2023","2025","770","250","400","444","524","778","a09","api4","api8","api9","v4","v16","k01","k02","k04","k05","k06","k07","k08","k09","k10","kubernetes-policy","network-policy","iam-trust-policy","runtime-defense","project-proxy-cache-boundaries","project-kubernetes-enforcement","project-image-benchmark-gate","runtime","wep-rc4-key-reuse","flame-md5-certificate-forgery","lucky13-poodle","freak-logjam-export-grade-keys","drown","sweet32","roca-infineon-weak-keys","case-study-lastpass-2022","case-study-okta-har-2023","case-study-certificate-expiry","case-study-storm-0558","insecure-randomness","password-hashing","hardcoded-secrets","tls-certificate-validation","jwt-validation","missing-authentication","typescript-nextjs","session-cookies","secrets-lifecycle","session-lifecycle","password-storage","oauth-oidc-login","jwt-validation-rollover","passkeys-mfa-lifecycle","account-recovery-linking","authenticated-record-design","envelope-encryption-rotation","tls-pki-operations","workload-identity-models","authorization-models","data-minimization-retention","tokenization-privacy-engineering","crypto-inventory-pqc","saml-verification-boundaries","scim-provisioning-deprovisioning","jwt-attacks","mfa-account-takeover","oauth-oidc-attacks","secrets-in-kubernetes-and-runtime","863","284","327","347","916","a04","a07","api2","v6","v7","v9","v10","v11","v12","v13","v14","k03","token-validation","recovery","nonces","jwt-verification","oauth-redirect-pkce","insecure-randomness","password-hashing-argon2","cryptography-foundations","identity-lifecycle","project-encrypted-records","project-token-lifecycle","project-identity-lifecycle","leaked-secret-response","ecb-mode-leakage","padding-oracle-attacks","hash-collisions-and-signatures","weak-rsa-key-generation","rc4-keystream-bias","64-bit-block-ciphers-sweet32","crypto-quick-reference","jwt-inspector","identity-crypto","appsec-program","program-operations","asvs-verification-evidence","ssdf-product-lifecycle","samm-assessment","risk-exceptions-and-metrics","control-mapping-and-evidence","supplier-software-assurance","product-security-obligations","choosing-assurance-frameworks","privacy-and-health-data-scope","appsec-metrics-and-slas","cra-reporting-runbook","pci-dss-requirement-6","security-champions-program","vulnerability-prioritization","secure-by-design","bsimm-samm-ssdf","developer-security-training","appsec-careers","soc2-for-engineering-teams","iso-27001-secure-development","nist-csf-2-for-product-teams","gdpr-privacy-by-design-engineering","nis2-dora-for-software-suppliers","uk-software-security-code-of-practice","regulated-product-security-lifecycle","compliance-evidence-reuse","secure-software-attestation-form","5.0","release-evidence","security-program-assurance","cvss-calculator","asvs-checklist","frameworks","standards","build-an-appsec-program","case-study-air-canada-chatbot","case-study-nx-s1ngularity","case-study-amazon-q-extension","prompt-injection-boundaries","rag-tenant-isolation","tool-authorization","untrusted-model-output","ai-security-evaluation","ai-red-teaming","cost-memory-operations","model-artifact-security","training-data-poisoning","model-privacy-attacks","mcp-multiagent-security","agent-failure-containment","ai-governance-regulation","ai-assisted-development","llm-misinformation","agent-code-sandboxing","hidden-context-exposure","agent-memory-poisoning","2026","2026","llm01","llm02","llm03","llm04","llm05","llm06","llm07","llm08","llm09","llm10","asi01","asi02","asi03","asi04","asi05","asi06","asi07","asi08","asi09","asi10","rag-isolation","agent-tool-gateway","output-rendering","ai-application-defense","project-agent-tool-boundaries","project-ai-eval-regression","project-agent-code-sandbox","calling-llm-apis-safely","ai-emerging","abac","abuse-case","access-token","acme","addresssanitizer","admission-controller","aead","aes-gcm","agent-goal-hijack","ai-agent","ai-rmf","allowlist","api","argon2","argument-injection","aspm","asvs","attack-surface","attack-tree","attestation","audit-log","authentication","authorization","bcrypt","bearer-token","bfla","bola","bsimm","buffer-overflow","bug-bounty","business-logic-flaw","cache-poisoning","canonicalization","capec","cbc","certificate","certificate-authority","certificate-transparency","chacha20-poly1305","ciem","clickjacking","cna","cnapp","code-injection","code-signing","command-injection","compensating-control","computer-use","confused-deputy","cors","cpe","cra","credential-stuffing","crl","crlf-injection","csaf","csirt","csp","cspm","csprng","csrf","cvd","cve","cvss","cwe","cwpp","cyclonedx","dangling-dns","dast","data-flow","data-minimization","data-poisoning","defense-in-depth","dek","denial-of-service","dependency","dependency-confusion","devsecops","differential-privacy","digital-signature","dom-based-xss","dora","dpop","dspm","dsse","ecb","ecdhe","ecdsa","eddsa","embedding","encryption","envelope-encryption","epss","eu-ai-act","excessive-agency","expression-language-injection","fail-closed","fedramp","fido2","fine-tuning","forward-secrecy","fuzzing","gdpr","guardrail","hash-function","hidden-context-exposure","hkdf","hmac","hsm","hsts","httponly","iac","iam","iast","id-token","idempotency-key","identity-provider","idor","imds","in-toto","incident-response","indirect-prompt-injection","information-disclosure","input-validation","insecure-deserialization","integer-overflow","integrity","iso-27001","iv","jailbreak","jwks","jwt","kdf","kek","kev","key-rotation","kms","ldap-injection","least-privilege","linddun","llm","lockfile","log-injection","mac","mass-assignment","masvs","mcp","membership-inference","memory-poisoning","memory-safety","mfa","mitre-atlas","mitre-attack","ml-dsa","ml-kem","model-extraction","model-inversion","mtls","nis2","nonce","nosql-injection","null-pointer-dereference","nvd","oauth","ocsp","oidc","open-redirect","origin","osps-baseline","osv","out-of-bounds-read","output-encoding","padding-oracle","parameter-binding","passkey","path-traversal","pbkdf2","pci-dss","penetration-test","pepper","pkce","pki","post-quantum-cryptography","prompt-injection","prototype-pollution","provenance","pseudonymization","psirt","purl","race-condition","rag","rasp","rate-limiting","rbac","rebac","redos","reentrancy","refresh-token","replay-attack","reproducible-build","request-smuggling","risk-acceptance","rsa","s2c2f","safetensors","salt","same-origin-policy","samesite","saml","samm","sandbox","sarif","sast","sbom","sca","scim","scrypt","secret","secret-scanning","security-champion","security-misconfiguration","service-account","session","session-fixation","session-hijacking","siem","sigstore","slsa","soc-2","spdx","spiffe","sql-injection","ssdf","sso","ssrf","ssti","ssvc","stride","subdomain-takeover","subresource-integrity","supply-chain","system-prompt","threat-model","timing-attack","tls","tokenization","tool-calling","tool-poisoning","totp","trust-boundary","trusted-publishing","trusted-types","tuf","turn","typosquatting","use-after-free","vdp","vector-database","vex","waf","webauthn","webhook","webrtc","workload-identity","xss","xxe","zero-trust","sas","ingress-controller","staged-rollout","data-binding","library","workflows","labs","learn","glossary","templates","coverage","teams","case-studies","tags","api"],"title":["Case study: Log4Shell (CVE-2021-44228)","Case study: MOVEit Transfer mass exploitation (CVE-2023-34362)","Case study: First American's EaglePro document exposure (2019)","Case study: Citrix Bleed (CVE-2023-4966)","Case study: Spring4Shell (CVE-2022-22965)","Case study: CrowdStrike Channel File 291 (July 2024)","Cross-site request forgery (CSRF) fixes for every stack","Missing object-level authorization (IDOR and BOLA) fixes for every stack","Open redirect fixes for every stack","Path traversal fixes for every stack","Server-side request forgery (SSRF) fixes for every stack","CORS misconfiguration on credentialed APIs fixes for every stack","XML external entity (XXE) processing fixes for every stack","Code injection fixes for every stack","Cross-site scripting (XSS) fixes for every stack","CSV formula injection fixes for every stack","LDAP filter injection fixes for every stack","NoSQL operator injection fixes for every stack","OS command and argument injection fixes for every stack","Server-side template injection fixes for every stack","SQL injection fixes for every stack","XPath injection fixes for every stack","Clickjacking fixes for every stack","Fix clickjacking in Next.js","Regular-expression denial of service (ReDoS) fixes for every stack","Unbounded resource consumption fixes for every stack","Unrestricted file upload fixes for every stack","Fix unrestricted file upload in Next.js","Insecure deserialization fixes for every stack","Mass assignment (over-posting) fixes for every stack","CRLF injection in logs and response headers fixes for every stack","Express fix cards and security baseline","Flask fix cards and security baseline","Spring Boot fix cards and security baseline","ASP.NET Core fix cards and security baseline","Next.js fix cards and security baseline","FastAPI fix cards and security baseline","Django fix cards and security baseline","net/http fix cards and security baseline","Rails fix cards and security baseline","Laravel fix cards and security baseline","Supported versions for the fix cards","Enforce authorization for every object action","Design a safer file-upload pipeline","Verify webhook deliveries before acting","Review tenant boundaries before implementation","Respond to an exploited or malicious dependency","Review trust boundaries in mobile and native clients","Prevent XSS at the output boundary","Constrain server-side fetches to their intended destinations","Handle failures without leaking internals or weakening controls","Ship without debug modes, verbose errors or exposed files","Run coordinated vulnerability disclosure from report to advisory","Protect cookie-authenticated actions against CSRF","Configure CORS and CSP around the browser capabilities you need","Render rich text without granting it application privileges","Authorize functions and fields as well as objects","Preserve business invariants under concurrent requests","Keep untrusted values out of executable syntax","Run external programs without command or argument injection","Keep untrusted input out of eval, expression languages and templates","Extract archives without escaping the destination","Convert untrusted office documents and PDFs in an isolated parser","Secure WebRTC signaling, TURN relays and media servers","Review a code change through its trust boundaries","Combine static and dynamic tests around a verified finding","Fuzz a parser and turn crashes into lasting regressions","Preserve framework security controls across the request lifecycle","Review mobile storage, links and platform permissions","Constrain desktop IPC and privileged helpers","Design firmware updates that can recover safely","Test smart contracts through state invariants","Parse bounded JSON and XML into an explicit application schema","Keep untrusted object keys out of prototype and authority paths","Harden an Android app's storage, network and entry points","Prevent business-logic flaws with server-side invariants","Prevent CRLF header injection, log forging and CSV formula injection","Place each security control in the pipeline and decide what it blocks","Choose and evaluate application security testing tools","Prevent DOM XSS, postMessage abuse and client-side injection","Harden an iOS app's storage, network and entry points","Find, fix and contain memory-safety bugs in C and C++","Prevent NoSQL, LDAP, XPath and expression-language injection","Redirect users only to destinations you control","Validate input safely and prevent regex denial of service","Audit unsafe Rust, FFI boundaries and crate dependencies","Configure HTTP security headers from a tested baseline","Choose a threat modeling method and turn its findings into tests","Start with a VDP, then add bug bounties and penetration tests","Write testable security requirements and a security Definition of Done","Set up a PSIRT: services, intake, triage, SLAs and the CNA role","Publish security advisories with CSAF, VEX, CVE records and OSV","Respond to product security incidents: plan, tabletop and postmortem","Prevent file inclusion: LFI, RFI, dynamic imports and template names","Create temporary files safely: mkstemp, O_EXCL and private directories","Consume third-party APIs safely (OWASP API10:2023)","Worked threat model: a mobile banking app","Worked threat model: an LLM agent with tools","DeFi attack patterns: oracles, flash loans, proxies and signatures","CWE Top 25 and weakness index","OWASP Top 10:2025","OWASP MASVS 2.1 controls",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,"OWASP A01:2025 Broken Access Control","OWASP A02:2025 Security Misconfiguration",1,"OWASP A05:2025 Injection","OWASP A06:2025 Insecure Design",1,1,1,1,1,1,1,"ASVS 5.0 V1 Encoding and Sanitization","ASVS 5.0 V2 Validation and Business Logic","ASVS 5.0 V3 Web Frontend Security","ASVS 5.0 V5 File Handling","ASVS 5.0 V8 Authorization","ASVS 5.0 V15 Secure Coding and Architecture","ASVS 5.0 V17 WebRTC",1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,"CSRF lab: Protect an account change from a forged request","Path traversal lab: Keep archive entries inside their extraction directory","Race condition lab: Repair a balance check that races","IDOR lab: Repair an invoice authorization bug","Webhook signature and replay lab: Repair a webhook handler that pays twice","SSRF lab: Guard an outbound fetch against SSRF","CORS policy lab: Grant CORS to the right origins only","CSP builder lab: Build a strict Content-Security-Policy","HTML sanitization lab: Configure a sanitizer for user comments","Business logic lab: Price an order without trusting the client","SQL injection lab: Separate SQL structure from data with sqlite3","Path traversal lab: Serve an uploaded file without path traversal","SSRF validation lab: Validate a fetch URL with ipaddress","Open redirect lab: Return users to this site only","File upload lab: Accept avatars without publishing pages","OS command injection lab: Run git without a shell","Mass assignment lab: Update only the fields users may edit","Buffer over-read lab: Stop a heartbeat over-read","SSTI lab: Render a welcome banner without template injection","XXE lab: Parse an uploaded invoice without resolving external entities","Pickle deserialization lab: Load a session token without pickle","Developer foundations","AppSec in practice","Browser and API boundaries","Secure a real HTTP API","Make a checkout transaction atomic","Keep extracted files inside their boundary","Parse bounded JSON and XML invoices safely","Repair a native parser using sanitizer evidence","Stop prototype pollution at merge and authorization boundaries","Repair a security pipeline for GitHub Actions and GitLab CI","Keep an iOS app's storage, links and web bridge in bounds","Repair an Android app's links, components, network policy and storage","Stop untrusted pages from using an Electron bridge","Recover from failed firmware updates with A/B slots","Convert untrusted documents in a locked-down container","Fix SQL injection in Python sqlite3","Abuse case library: tests and controls by feature","Threat pattern library for threat modeling","Secure design patterns: a catalogue for insecure-design (A06)","CSP evaluator","Security headers analyzer","ReDoS checker","security.txt validator","Scanner rules on the fix cards","Application security","Fix a finding","Secure a feature","Review a design","Test an application","Respond to a vulnerability","Case study: the Shai-Hulud npm worm (2025-2026)","Case study: the tj-actions/changed-files compromise (CVE-2025-30066)","Case study: the xz Utils backdoor (CVE-2024-3094)","Case study: the SolarWinds Orion build compromise (SUNBURST)","Case study: the Codecov Bash Uploader compromise (2021)","Case study: the 3CX DesktopApp supply-chain attack (CVE-2023-29059)","Case study: event-stream and ua-parser-js, two npm package takeovers","Case study: the polyfill.io CDN takeover (2024)","Protect the path from pull request to release","Generate an SBOM for the software you actually release","Choose SBOM formats and identify components accurately","Review SBOM changes between releases","Triage new dependency vulnerability findings","Verify artifact signatures against an explicit trust policy","Read SLSA provenance and verify the claim you need","Keep untrusted CI work outside the release boundary","Investigate a suspected malicious package safely","Use VEX without losing vulnerability evidence","Investigate build differences and improve reproducibility","Review dependency health without treating a score as a guarantee","Protect package publication and the update channel","Stop dependency confusion and typosquatting at install time","Harden GitHub Actions against workflow and supply-chain attacks","Protect the source repository: rulesets, reviews and signed commits","Secure the developer workstation: extensions, package managers, secrets and AI agents","Open source license compliance: SPDX expressions, obligations and SBOM checks","Meet the OpenSSF OSPS Baseline as a maintainer: the levels, every Level 1 control on GitHub, and the evidence","Adopt the OpenSSF S2C2F as a consumer: the eight practices, the four maturity levels and a staged plan with evidence","Staged rollout and rollback for security-critical updates","OWASP Top 10 CI/CD Security Risks",0,0,0,0,1,1,1,1,1,1,1,1,1,1,1,"SBOM completeness lab: Find the dependencies missing from a release SBOM","Signed artifact provenance lab: Reject a release from the wrong producer","Actions injection lab: Flag GitHub Actions expression injection","From source to trusted release","Build and verify a signed software release","SBOM inspection tool","OSV dependency lookup","GitHub Actions workflow analyzer","Software supply chain","Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025)","Case study: the CircleCI security incident (January 2023)","Case study: Microsoft AI researchers' over-permissive SAS token (2023)","Review infrastructure changes as access changes","Bound API work, not just request counts","Create security logs someone can investigate","Run Kubernetes workloads with only the privileges they need","Prove network and admission policies enforce the intended boundary","Review cloud permissions and role trust together","Test infrastructure policy and detect security-relevant drift","Prevent subdomain takeover from dangling DNS records","Maintain an API inventory and prevent gateway bypass","Apply security limits to GraphQL, WebSocket and gRPC operations","Bound background jobs and make retries safe","Authenticate workloads and authorize their service actions","Turn runtime events into a tested investigation and containment path","Operate edge rules without hiding application defects","Keep HTTP request boundaries consistent across intermediaries","Prevent shared-cache poisoning and private-response deception","Apply a security baseline across AWS, Azure and Google Cloud","Detect container and host threats at runtime with eBPF sensors and cloud services","Harden managed Kubernetes on EKS, AKS and GKE","Keep HTTP services up under application-layer DDoS","Choose cloud security posture tools and apply zero trust","Harden container images from Dockerfile to admission","Harden the images you ship against CIS, STIG and SCAP benchmarks","OWASP API Security Top 10 2023","OWASP Kubernetes Top 10 2025",0,0,0,0,0,0,1,1,"OWASP API8:2023 Security Misconfiguration",1,"ASVS 5.0 V4 API and Web Service","ASVS 5.0 V16 Security Logging and Error Handling",1,1,1,1,1,1,1,1,1,"Privileged container lab: Reject a privileged workload before deployment","NetworkPolicy lab: Lock down a shop namespace","IAM trust policy lab: Evaluate a role trust policy against the confused deputy","Runtime and cloud defense","Repair a real proxy and shared cache","Verify Kubernetes admission and network boundaries","Gate an image build on a CIS scan and a deviation register","Runtime, cloud & APIs","WEP: RC4 key reuse and weak IVs","Flame: MD5 certificate forgery","Lucky Thirteen and POODLE: two different oracles","FREAK and Logjam: export-grade key exchange","DROWN: one RSA key across incompatible protocols","Sweet32: the cost of a small block size","ROCA: structured RSA key generation","Case study: the LastPass breach (2022)","Case study: the Okta support-system breach and session tokens in HAR files (2023)","Case study: certificate expiry outages at Ericsson (2018) and Microsoft Teams (2020), and Equifax's blind spot","Case study: Storm-0558 and the forged Microsoft tokens (2023)","Insecure randomness for security tokens fixes for every stack","Weak password hashing fixes for every stack","Hard-coded secrets fixes for every stack","Improper TLS certificate validation fixes for every stack","JWT validation in APIs (bearer tokens) fixes for every stack","Missing authentication for a critical function fixes for every stack","Fix missing authentication for a critical function in Next.js","Session fixation and session cookies fixes for every stack","Secrets management: storage, rotation and leaked-secret response","Session management: cookies, timeouts, rotation and revocation","Password storage: hashing parameters and rehash on login","OAuth 2.0 and OpenID Connect login: authorization code with PKCE","JWT validation: algorithms, keys, claims and key rollover","Passkeys and MFA: WebAuthn enrollment, sign-in and replacement","Account recovery: password resets, help-desk resets and account linking","AEAD records: AES-GCM nonces, associated data and key limits","Envelope encryption and key rotation: data keys, KMS keys and backups","Operate TLS and certificates: configuration, renewal and verification","Workload identity federation: short-lived, scoped identities for services and CI","Authorization models: RBAC, ABAC, ReBAC and policy as code you can test","Data minimization and retention: collect less and prove that deletion works","Tokenization, pseudonymization and privacy transformations: choose deliberately","Post-quantum migration: cryptographic inventory, hybrid TLS and deadlines","SAML single sign-on: verify signed assertions without losing the identity boundary","SCIM deprovisioning: make account disablement remove every usable authority","Defend JWTs against forgery, confusion and replay","Stop account takeover with the right MFA and login defenses","Defend OAuth and OIDC against redirect and token attacks","Secrets at runtime: Vault, Kubernetes Secrets, CSI driver, External Secrets and SOPS",0,0,0,0,0,"OWASP A04:2025 Cryptographic Failures","OWASP A07:2025 Authentication Failures","OWASP API2:2023 Broken Authentication","ASVS 5.0 V6 Authentication","ASVS 5.0 V7 Session Management","ASVS 5.0 V9 Self-contained Tokens","ASVS 5.0 V10 OAuth and OIDC","ASVS 5.0 V11 Cryptography","ASVS 5.0 V12 Secure Communication","ASVS 5.0 V13 Configuration","ASVS 5.0 V14 Data Protection",1,"JWT validation lab: Validate the purpose and audience of a token","Password reset token lab: Make a recovery credential single-use","AES-GCM nonce reuse lab: Fix a nonce allocator that breaks after restart","JWT verification lab: Verify a JWT before trusting it","OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE","Insecure randomness lab: Generate unguessable API keys","Password hashing lab: Verify and upgrade an Argon2 password hash on login","Cryptography without shortcuts","Identity through the whole lifecycle","Bind ciphertext to the correct record","Verify tokens through rotation and revocation","Prove deprovisioning reaches sessions and queued work","Contain a leaked secret, then investigate and clean up","ECB mode: why it leaks patterns and what to use instead","Padding oracle attacks","Hash collisions and digital signatures: MD5, SHA-1 and what to use","Weak RSA key generation: shared primes, ROCA and safe keys","RC4 keystream bias","64-bit block ciphers and the Sweet32 mechanism","Choose cryptographic algorithms and parameters by job","JWT inspector","Identity & cryptography","Start a minimal AppSec program with owners, triggers and metrics","Run an AppSec program: owners, finding states, deadlines and champions","ASVS 5.0 verification records: requirement, test and evidence another engineer can repeat","Apply NIST SSDF (SP 800-218) to one product: practices, evidence and attestation in 2026","Run an OWASP SAMM assessment with evidence and a practical roadmap","Approve, expire and measure security exceptions without hiding risk","Control mapping between frameworks: state the relationship without overstating equivalence","Supplier software assurance: check SOC 2 reports, SBOMs and signed updates against your use","Cyber Resilience Act and payment pages: turn product-security obligations into an engineering evidence plan","ISO 27001, SOC 2, NIST CSF or FedRAMP: choose the framework by the question it answers","GDPR, CCPA, HIPAA or the FTC rule: scope privacy and health-data obligations before choosing controls","Set remediation SLAs and measure AppSec outcomes","Build a runbook for CRA vulnerability and incident reporting","Map PCI DSS Requirement 6 to engineering practice and evidence","Run a security champions program with protected time and outcome metrics","Prioritize vulnerabilities by exploitation, exposure and impact","Apply CISA Secure by Design: principles, pledge goals and evidence","BSIMM vs SAMM vs SSDF: what each is for and which to use","Run a developer security training program that changes code","Build an application security career: roles, skills, portfolio and certifications","SOC 2 for engineering teams: CC6, CC7 and CC8 controls and the evidence auditors test","ISO 27001 secure development: Annex A 8.25 to 8.33 as engineering practice and evidence","NIST CSF 2.0 for product teams: the outcomes you own and the evidence for them","GDPR privacy by design for engineers: Articles 25, 32 and 35 in code","NIS2 and DORA for software suppliers: what reaches you and the evidence to keep","UK Software Security Code of Practice: the 14 principles as engineering practice","Regulated product security lifecycles: IEC 62443-4-1, FDA 524B, ISO/SAE 21434 and UN R155/R156","Compliance evidence reuse: one evidence set for SSDF, PCI DSS, ISO 27001, SOC 2 and the CRA","Answer a US federal secure software attestation request in 2026: the CISA form, its SSDF mapping and the evidence behind each statement","OWASP ASVS 5.0 chapters","Release evidence lab: Keep stale test evidence out of a release decision","Build an evidence-driven security program","CVSS v4.0 calculator","ASVS 5.0 checklist export","Governance & frameworks","Security standards and identifiers","Build an AppSec program","Case study: Moffatt v. Air Canada, a chatbot that misstated the refund policy (2022-2024)","Case study: the Nx s1ngularity compromise and its AI-assisted payload (2025)","Case study: the Amazon Q Developer extension compromise (2025)","Contain prompt injection at the application boundary","Keep retrieval inside the user’s data boundary","Authorize agent tools outside the model","Keep generated output out of executable contexts","Build evaluations around prohibited outcomes","Red-team LLM applications and agents by their effects","Bound agent spending, memory and recovery","Treat model releases as executable supply-chain inputs","Protect training and retrieval data from targeted poisoning","Assess extraction, membership and inference risks","Constrain MCP and multi-agent trust boundaries","Contain cascading failures and rogue agents","Turn NIST AI RMF, ISO/IEC 42001 and EU AI Act duties into engineering evidence","Secure AI-assisted development with coding assistants and agents","Contain LLM misinformation (OWASP LLM07:2026)","Sandbox model-generated code and computer-use agents","Keep secrets and controls out of hidden context (OWASP LLM08:2026)","Defend agent memory and context against poisoning (OWASP ASI06)","OWASP Top 10 for LLM Applications 2026","OWASP Top 10 for Agentic Applications 2026",1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,"RAG access control lab: Stop a retriever from returning another tenant’s documents","Excessive agency lab: Bind an agent’s action to the approved arguments","XSS lab: Render a model’s answer as text instead of active markup","Secure an AI application","Enforce retrieval and tool boundaries across crashes","Gate model and provider changes on a versioned red-team corpus","Run model-generated Python in a locked-down container","Call a hosted LLM API safely","AI security","ABAC","Abuse case","Access token","ACME","AddressSanitizer","Admission controller","AEAD","AES-GCM","Agent goal hijack","AI agent","AI RMF","Allowlist","API","Argon2","Argument injection","ASPM","ASVS","Attack surface","Attack tree","Attestation","Audit log","Authentication","Authorization","bcrypt","Bearer token","BFLA","BOLA","BSIMM","Buffer overflow","Bug bounty","Business logic flaw","Cache poisoning","Canonicalization","CAPEC","CBC","Certificate","Certificate authority","Certificate Transparency","ChaCha20-Poly1305","CIEM","Clickjacking","CNA","CNAPP","Code injection","Code signing","Command injection","Compensating control","Computer use","Confused deputy","CORS","CPE","CRA","Credential stuffing","CRL","CRLF injection","CSAF","CSIRT","CSP","CSPM","CSPRNG","CSRF","CVD","CVE","CVSS","CWE","CWPP","CycloneDX","Dangling DNS","DAST","Data flow","Data minimization","Data poisoning","Defense in depth","DEK","Denial of service","Dependency","Dependency confusion","DevSecOps","Differential privacy","Digital signature","DOM-based XSS","DORA","DPoP","DSPM","DSSE","ECB","ECDHE","ECDSA","EdDSA","Embedding","Encryption","Envelope encryption","EPSS","EU AI Act","Excessive agency","Expression language injection","Fail closed","FedRAMP","FIDO2","Fine-tuning","Forward secrecy","Fuzzing","GDPR","Guardrail","Hash function","Hidden context exposure","HKDF","HMAC","HSM","HSTS","HttpOnly","IaC","IAM","IAST","ID token","Idempotency key","Identity provider","IDOR","IMDS","in-toto","Incident response","Indirect prompt injection","Information disclosure","Input validation","Insecure deserialization","Integer overflow","Integrity","ISO/IEC 27001","IV","Jailbreak","JWKS","JWT","KDF","KEK","KEV","Key rotation","KMS","LDAP injection","Least privilege","LINDDUN","LLM","Lockfile","Log injection","MAC","Mass assignment","MASVS","MCP","Membership inference","Memory poisoning","Memory safety","MFA","MITRE ATLAS","MITRE ATT&CK","ML-DSA","ML-KEM","Model extraction","Model inversion","mTLS","NIS2","Nonce","NoSQL injection","NULL pointer dereference","NVD","OAuth","OCSP","OIDC","Open redirect","Origin","OSPS Baseline","OSV","Out-of-bounds read","Output encoding","Padding oracle","Parameter binding","Passkey","Path traversal","PBKDF2","PCI DSS","Penetration test","Pepper","PKCE","PKI","Post-quantum cryptography","Prompt injection","Prototype pollution","Provenance","Pseudonymization","PSIRT","purl","Race condition","RAG","RASP","Rate limiting","RBAC","ReBAC","ReDoS","Reentrancy","Refresh token","Replay attack","Reproducible build","Request smuggling","Risk acceptance","RSA","S2C2F","Safetensors","Salt","Same-origin policy","SameSite","SAML","SAMM","Sandbox","SARIF","SAST","SBOM","SCA","SCIM","scrypt","Secret","Secret scanning","Security champion","Security misconfiguration","Service account","Session","Session fixation","Session hijacking","SIEM","Sigstore","SLSA","SOC 2","SPDX","SPIFFE","SQL injection","SSDF","SSO","SSRF","SSTI","SSVC","STRIDE","Subdomain takeover","Subresource Integrity","Supply chain","System prompt","Threat model","Timing attack","TLS","Tokenization","Tool calling","Tool poisoning","TOTP","Trust boundary","Trusted publishing","Trusted Types","TUF","TURN","Typosquatting","Use-after-free","VDP","Vector database","VEX","WAF","WebAuthn","Webhook","WebRTC","Workload identity","XSS","XXE","Zero trust","SAS","Ingress controller","Staged rollout","Data binding","Guides and resources","Practitioner workflows","Labs and projects","Learning paths","Security glossary","Templates and capstone workbooks","Coverage map","Team training plans","Case studies","Tags","Content API"],"type":[0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,5,5,5,6,6,6,6,6,6,6,6,6,6,6,6,7,8,8,8,9,9,9,9,10,10,11,11,11,11,11,0,0,0,0,0,0,0,0,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,4,4,4,5,6,9,9,9,10,0,0,0,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,4,4,4,5,6,6,6,10,0,0,0,0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,4,4,4,4,4,4,4,5,5,6,6,6,7,8,8,8,8,8,8,8,9,10,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,3,4,5,9,9,10,10,11,0,0,0,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,4,4,4,5,6,6,6,7,10,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,10,10,10,10,10,10,10,10,10,10,10],"domain":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6],"tags":[["Log4Shell","Log4j","JNDI injection","Transitive dependencies","SBOM","Vulnerability response","Remote code execution"],["MOVEit","MOVEit Transfer","SQL injection","Cl0p","Managed file transfer","Web shell","Mass exploitation"],["IDOR","BOLA","Broken access control","Penetration testing","Remediation SLA","Risk acceptance","Data breach","Incident review"],["Citrix Bleed","CVE-2023-4966","Memory safety","Out-of-bounds read","Session hijacking","MFA bypass","Vulnerability response","Mass exploitation"],["Spring4Shell","CVE-2022-22965","Spring","Mass assignment","Data binding","Remote code execution","Vulnerability response","Dependency management"],["CrowdStrike","Content updates","Staged rollout","Rollback","Out-of-bounds read","Kernel drivers","Outages","Incident review"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],[],["Fix cards"],["Fix cards"],["Fix cards"],[],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards","Security baseline","Express"],["Fix cards","Security baseline","Flask"],["Fix cards","Security baseline","Spring Boot"],["Fix cards","Security baseline","ASP.NET Core"],["Fix cards","Security baseline","Next.js"],["Fix cards","Security baseline","FastAPI"],["Fix cards","Security baseline","Django"],["Fix cards","Security baseline","net/http"],["Fix cards","Security baseline","Rails"],["Fix cards","Security baseline","Laravel"],["Fix cards","Supported versions","End of life"],["Authorization","API security","BOLA","IDOR","Test an application"],["File upload","Input validation","Secure a feature","Web"],["Webhooks","HMAC","Replay","Secure a feature","API security"],["Threat modeling","Multitenancy","Architecture","Review a design"],["Dependencies","Incident response","Vulnerability response","Respond to a vulnerability","React2Shell","CISA KEV"],["Mobile","Native","Deep links","Trust boundaries","Review a design"],["XSS","Output encoding","HTML","DOM","Trusted Types","Fix a finding"],["SSRF","Egress","URL validation","Cloud metadata","Secure a feature"],["Error handling","Information disclosure","Reliability","Fix a finding"],["Security misconfiguration","Information disclosure","Debug mode","Error handling","Secure defaults","Deployment","Framework configuration"],["Vulnerability disclosure","VDP","PSIRT","security.txt","CVE","Respond to a vulnerability"],["CSRF","Cookies","Origin","SameSite","Fetch Metadata","Secure a feature"],["CORS","CSP","Trusted Types","Browser security","Headers"],["XSS","HTML sanitization","Rich text","DOM","Trusted Types","postMessage"],["Authorization","Mass assignment","BFLA","BOPLA","API security","Fix a finding"],["Race conditions","Transactions","Idempotency","Business logic","PostgreSQL"],["Command injection","XXE","Deserialization","NoSQL injection","LDAP injection","SSTI"],["Command injection","Argument injection","Injection","Subprocess","Shell","Input validation"],["Code injection","Template injection","SSTI","Expression language injection","Injection","Sandboxing","Eval"],["Path traversal","Zip Slip","Archives","Symlinks","File upload"],["Document conversion","File upload","Archives","Zip bomb","XXE","Resource limits","PDF","Memory safety","Sandboxing"],["WebRTC","TURN","Signaling","DTLS-SRTP","WebSocket","Resource limits","Privacy"],["Code review","Pull requests","Authorization","AI-assisted coding","Secure SDLC"],["SAST","DAST","IAST","Semgrep","OWASP ZAP","Triage"],["Fuzzing","Sanitizers","Parsers","Memory safety","libFuzzer","Go"],["Frameworks","Secure defaults","Middleware","Deployment","Django","Spring Security"],["MASVS","Android","iOS","Deep links","Local storage","Review a design"],["Electron","IPC","contextBridge","Sandbox","Desktop","Privilege separation"],["Secure boot","Firmware","OTA updates","MCUboot","Anti-rollback","Recovery"],["Smart-contract security","Reentrancy","Solidity","Invariant testing"],["Deserialization","XML","XXE","CWE-611","CWE-502","Input validation","Duplicate keys","Parser limits"],["JavaScript","Prototype pollution","CWE-1321","Input validation","Authorization"],["Android","Kotlin","Android Keystore","Network Security Configuration","Intents and PendingIntents","WebView","App Links","OWASP MASVS"],["Business logic","Price tampering","Workflow bypass","Password reset poisoning","Anti-automation","Invariants","Property-based testing"],["CRLF injection","HTTP response splitting","Header injection","Log injection","Log forging","CSV injection","Formula injection","nginx"],["DevSecOps","CI/CD","GitHub Actions","SAST","Software composition analysis","DAST","Fuzzing","Admission control"],["SAST","DAST","IAST","SCA","Secrets scanning","IaC scanning","Container scanning","API security testing","ASPM","OWASP Benchmark","Tool evaluation","False positives"],["DOM XSS","Trusted Types","postMessage","DOM clobbering","Client-side template injection","DOMPurify","JavaScript frameworks"],["iOS","Swift","Keychain","App Transport Security","Universal links","WKWebView","App Attest","OWASP MASVS"],["Memory safety","C and C++","Buffer overflow","Use after free","Compiler hardening","Sanitizers","Fuzzing","Memory-safe languages"],["NoSQL injection","MongoDB","LDAP injection","XPath injection","Expression language injection","SpEL","OGNL","Input validation"],["Open redirect","CWE-601","URL validation","OAuth","Phishing","SSRF"],["ReDoS","Regular expressions","Input validation","RE2","Catastrophic backtracking","HTTP parameter pollution","Schema validation","Unicode normalization"],["Rust","Unsafe code","FFI","Miri","Integer overflow","Panics","RustSec","Supply chain"],["HTTP security headers","HSTS","Content Security Policy","Clickjacking","Cookies","Cross-origin isolation","Framework configuration"],["Threat modeling","STRIDE","Attack trees","LINDDUN","PASTA","Data-flow diagrams","Secure design"],["Vulnerability disclosure","VDP","Bug bounty","Penetration testing","security.txt","Safe harbor","ISO/IEC 29147"],["Security requirements","Definition of done","Acceptance criteria","OWASP ASVS","Abuse cases","Traceability"],["PSIRT","Vulnerability handling","CVE Numbering Authority","Coordinated disclosure","FIRST PSIRT Services Framework","Vulnerability response"],["CSAF","Security advisory","CVE records","CVE","OSV","Vulnerability disclosure"],["Incident response","Postmortem","Tabletop exercise","Incident response plan","Product security","NIST SP 800-61"],["File inclusion","Local file inclusion","Remote file inclusion","LFI","RFI","Dynamic import","Template include","Path traversal","PHP"],["Temporary files","Insecure temp file","Temp file race","Symlink attack","TOCTOU","mkstemp","O_EXCL","O_TMPFILE","PrivateTmp"],["Unsafe consumption of APIs","Third-party API","API10:2023","Timeouts","Redirects","TLS verification","Trust boundary","Webhooks","Response validation"],["Threat model","Mobile banking","STRIDE","MASVS","Device binding","App attestation","Certificate pinning","Worked example"],["Threat model","LLM agent","Prompt injection","Excessive agency","Data exfiltration","MCP","Worked example","Agentic security"],["Smart-contract security","Oracle manipulation","Flash loan","Upgradeable proxy","Storage collision","EIP-712","Signature replay","OWASP Smart Contract Top 10"],["CWE","Standards"],["OWASP Top 10:2025","Standards"],["OWASP MASVS 2.1.0","Standards"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["OWASP Top 10:2025"],["OWASP Top 10:2025"],["OWASP Top 10:2025"],["OWASP Top 10:2025"],["OWASP Top 10:2025"],["OWASP Top 10:2025"],["OWASP API Security Top 10 2023"],["OWASP API Security Top 10 2023"],["OWASP API Security Top 10 2023"],["OWASP API Security Top 10 2023"],["OWASP API Security Top 10 2023"],["OWASP API Security Top 10 2023"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["OWASP MASVS 2.1.0"],["JavaScript","CSRF","XSRF","cross-site request forgery","session riding"],["JavaScript","path traversal","directory traversal","Zip Slip","archive extraction"],["JavaScript","race condition","TOCTOU","time-of-check to time-of-use","double spending"],["JavaScript","IDOR","BOLA","broken object level authorization","broken access control"],["JavaScript","webhook verification","HMAC","replay attack","idempotency"],["JavaScript","SSRF","server-side request forgery","URL validation","egress filtering","DNS rebinding"],["JavaScript","CORS","cross-origin resource sharing","Access-Control-Allow-Origin","origin reflection"],["JavaScript","CSP","Content-Security-Policy","strict-dynamic","nonce","clickjacking"],["JavaScript","HTML sanitization","DOMPurify","rich text","stored XSS","allowlist"],["JavaScript","business logic","price tampering","coupon stacking","parameter tampering","limit overrun"],["Python","SQL injection","SQLi","parameterized query","prepared statement","sqlite3"],["Python","path traversal","directory traversal","LFI","symlink escape","os.path.realpath"],["Python","SSRF","server-side request forgery","URL validation","ipaddress","egress filtering"],["JavaScript","open redirect","unvalidated redirect","returnUrl","next parameter","URL redirection"],["JavaScript","file upload","unrestricted file upload","avatar upload","magic bytes","file signature","SVG XSS","Content-Disposition"],["JavaScript","OS command injection","argument injection","option injection","shell injection","child_process"],["JavaScript","mass assignment","over-posting","autobinding","object injection","BOPLA"],["JavaScript","Heartbleed","buffer over-read","out-of-bounds read","length field trust","memory safety"],["Python","SSTI","server-side template injection","template injection"],["Python","XXE","XML external entity","external entity injection","lxml","resolve_entities"],["Python","insecure deserialization","pickle","unpickling","object injection"],["Software developers"],["Application security engineers"],["Web and API developers"],["Node.js 22+ · npm"],["Python 3.11+ · standard library"],["Python 3.11+ · standard library"],["Python 3.13+ · Expat 2.6.0+ · standard library"],["Clang + Python 3.11+"],["Node.js 22+ · no dependencies"],["Node.js 22+ · no dependencies · GitHub Actions and GitLab CI YAML"],["Swift 6 · Xcode 16+ · iOS Simulator"],["Kotlin · Android Gradle Plugin 9.4 · Robolectric 4.17 · Docker"],["Node.js 22.12+ · npm · Electron 44"],["Node.js 22+ · no dependencies"],["Python 3.11+ offline · Docker for the live tests"],["Python","sqlite3","SQL injection","Prepared statements","Fix a finding","CWE-89"],["Abuse cases","Misuse cases","Security testing","Business logic","CAPEC","Security requirements"],["Threat patterns","Threat modeling","STRIDE","Data-flow diagram","CAPEC","Secure design"],["Secure design patterns","Insecure design","Choke point","Capability token","Parse don't validate","Safe by default","Tenant scoping","Deny by default"],["CSP","Content Security Policy","XSS","Nonce"],["HTTP headers","HSTS","Cookies","Clickjacking"],["ReDoS","Regular expressions","Catastrophic backtracking","Input validation"],["security.txt","RFC 9116","Vulnerability disclosure","Security contact"],["Fix cards","Scanner rules","SAST","SARIF"],["Secure coding","Threat modeling","Security testing","Vulnerability response"],["CWE","Remediation"],["Design","Implementation"],["Architecture","Threat modeling"],["Verification","Test plans"],["Triage","Response"],["npm","Supply chain attack","Worm","Shai-Hulud","Trusted publishing","Install scripts","Token theft","Incident response"],["GitHub Actions","CI/CD","Supply chain attack","CVE-2025-30066","CVE-2025-30154","SHA pinning","Secrets in logs","Incident response"],["xz Utils","liblzma","Supply chain","Backdoor","Reproducible builds","Maintainer trust","Social engineering"],["SolarWinds","SUNBURST","SUNSPOT","Orion","Build compromise","Code signing","Supply chain"],["Codecov","Bash Uploader","CI secrets","curl pipe bash","Download integrity","Supply chain"],["3CX","X_TRADER","Cascading supply chain attack","Build compromise","Code signing","EDR"],["event-stream","ua-parser-js","flatmap-stream","npm","Maintainer takeover","Account takeover","Install scripts"],["polyfill.io","Third-party JavaScript","CDN","Subresource Integrity","Content Security Policy","Domain takeover"],["CI/CD","Build integrity","GitHub Actions","Provenance","SHA pinning"],["SBOM","CycloneDX","SPDX","Syft","CISA minimum elements","Release inventory"],["SPDX","CycloneDX","purl","CPE","Component identity","SBOM conversion"],["SBOM","CycloneDX","Release management","Inventory diff","Distribution"],["SCA","Dependency triage","Dependabot","npm audit","OSV-Scanner","Reachability","Transitive dependencies"],["Sigstore","cosign","Signing","Trust policy","Artifact integrity","Admission control"],["SLSA","in-toto","Provenance","Build integrity","slsa-verifier"],["CI/CD","GitHub Actions","Script injection","workflow_run","Cache poisoning","Runner isolation"],["Malicious packages","Dependency confusion","Typosquatting","Install scripts","Incident response","Package analysis"],["VEX","OpenVEX","CSAF","CycloneDX","Vulnerability status","Trivy"],["Reproducibility","SOURCE_DATE_EPOCH","diffoscope","Hermetic builds","Build inputs","Artifact comparison"],["OpenSSF Scorecard","deps.dev","OSS intake","Maintenance","Provenance","License review"],["Trusted publishing","OIDC","npm","PyPI","TUF","Release recovery"],["Dependency confusion","Typosquatting","Slopsquatting","npm","pip","Package source mapping","Lockfiles","CWE-427"],["GitHub Actions","CI/CD","Script injection","pull_request_target","OIDC","GITHUB_TOKEN","SHA pinning","Self-hosted runners"],["Branch protection","Rulesets","CODEOWNERS","Signed commits","Push protection","SLSA Source track","OSPS Baseline","OpenSSF Scorecard"],["Developer workstation","VS Code extension security","Open VSX","GlassWorm","Install scripts","Workspace Trust","Dev containers","AI coding agents"],["License compliance","Open source licenses","License expressions","Copyleft","Third-party notices","SBOM"],["OSPS Baseline","OpenSSF Scorecard","Security Insights","Branch protection","Rulesets","Secure SDLC","Maintainer trust"],["S2C2F","OSS intake","Dependencies","Lockfiles","Package source mapping","Supplier risk","SCA"],["Staged rollout","Canary releases","Rollback","Content updates","Kill switches","Release management","Anti-rollback","Secure SDLC"],["OWASP Top 10 CI/CD Security Risks","Standards"],["CWE"],["CWE"],["CWE"],["CWE"],["OWASP Top 10:2025"],["OWASP Top 10 CI/CD Security Risks"],["OWASP Top 10 CI/CD Security Risks"],["OWASP Top 10 CI/CD Security Risks"],["OWASP Top 10 CI/CD Security Risks"],["OWASP Top 10 CI/CD Security Risks"],["OWASP Top 10 CI/CD Security Risks"],["OWASP Top 10 CI/CD Security Risks"],["OWASP Top 10 CI/CD Security Risks"],["OWASP Top 10 CI/CD Security Risks"],["OWASP Top 10 CI/CD Security Risks"],["JavaScript","SBOM","software bill of materials","dependency inventory","bundled dependency"],["JavaScript","provenance","signature verification","SLSA","artifact integrity"],["JavaScript","expression injection","script injection","GitHub Actions","untrusted workflow input","pwn request"],["Build engineers and product security teams"],["Node.js 22+ · no dependencies"],["SBOM","Software bill materials","CycloneDX","SPDX","Inventory"],["OSV","Dependencies","Lockfile","SCA","CISA KEV","EPSS"],["GitHub Actions","CI/CD","Workflow security","zizmor","pull_request_target"],["SBOMs","Dependency risk","Build integrity","Provenance"],["ingress-nginx","CVE-2025-1974","Kubernetes","Admission control","Configuration injection","Secrets","Network policy","Vulnerability response"],["CircleCI","CI/CD","Session hijacking","Production access","Secrets management","OIDC","Data breach","Incident response"],["Azure","SAS tokens","Signed URLs","Secret scanning","Leaked secrets","AI research data","Cloud storage","Least privilege"],["Infrastructure as code","Terraform","OPA","Policy as code","Cloud IAM","Secrets in state"],["API security","Rate limiting","Resource limits","HTTP 429","Availability","Denial of service"],["Security logging","Audit logs","Log injection","Redaction","OCSF","Incident response"],["Kubernetes","Pod Security Standards","Pod Security Admission","securityContext","RBAC","Service accounts"],["NetworkPolicy","Default deny","Egress","Admission","ValidatingAdmissionPolicy","Kubernetes"],["Cloud IAM","Workload identity federation","GitHub OIDC","Trust policies","Least privilege","Terraform"],["IaC","Policy as code","OPA","Drift detection","Terraform","Exceptions"],["Subdomain takeover","Dangling DNS","DNS","Infrastructure as code","Cloud security baseline","Asset inventory","Certificate Transparency"],["API inventory","API gateway","Trusted proxies","X-Forwarded-For","API retirement","API security"],["GraphQL","WebSocket","gRPC","API security","Resource limits","CSWSH"],["Queues","Idempotency","Retries","Dead-letter queues","Backpressure","Cancellation"],["mTLS","Istio","SPIFFE","Service mesh","AWS Lambda","Authorization"],["Detection engineering","Incident response","Kubernetes audit","CloudTrail","Sigma","Audit logs"],["WAF","OWASP CRS","ModSecurity","Bot defense","Credential stuffing","Rule exclusions"],["Request smuggling","HTTP desync","CWE-444","Content-Length","Transfer-Encoding","HTTP/2","nginx"],["Cache poisoning","Cache deception","CWE-524","Cache-Control","Vary","nginx","Tenant isolation"],["Cloud security baseline","AWS","Azure","Google Cloud","IMDSv2","Workload identity","Terraform","Audit logging"],["Runtime security","Falco","Tetragon","Tracee","eBPF","GuardDuty Runtime Monitoring","Defender for Containers","Container Threat Detection","Detection engineering","Incident response"],["Kubernetes","EKS","AKS","GKE","Shared responsibility","CIS Benchmark","NSA/CISA Kubernetes Hardening Guidance","Pod Security Admission","User namespaces","AppArmor","seccomp","ValidatingAdmissionPolicy"],["DDoS","Application-layer DDoS","Slowloris","HTTP flood","HTTP/2 Rapid Reset","Rate limiting","Load shedding","nginx","Envoy","Node.js"],["CSPM","CWPP","CIEM","CNAPP","DSPM","ASPM","Cloud security posture management","Zero trust","NIST SP 800-207","Prowler","Tool evaluation"],["Containers","Dockerfile","Distroless","BuildKit secrets","Image scanning","SBOM","Sigstore","Admission control"],["CIS Benchmark","DISA STIG","OpenSCAP","SCAP Security Guide","Hardening baseline","Containers","Image scanning","Risk acceptance","Exceptions"],["OWASP API Security Top 10 2023","Standards"],["OWASP Kubernetes Top 10 2025","Standards"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["OWASP Top 10:2025"],["OWASP API Security Top 10 2023"],["OWASP API Security Top 10 2023"],["OWASP API Security Top 10 2023"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP Kubernetes Top 10 2025"],["OWASP Kubernetes Top 10 2025"],["OWASP Kubernetes Top 10 2025"],["OWASP Kubernetes Top 10 2025"],["OWASP Kubernetes Top 10 2025"],["OWASP Kubernetes Top 10 2025"],["OWASP Kubernetes Top 10 2025"],["OWASP Kubernetes Top 10 2025"],["OWASP Kubernetes Top 10 2025"],["JavaScript","privileged container","Pod Security","Kubernetes admission","least privilege"],["JavaScript","NetworkPolicy","default deny","network segmentation","lateral movement","microsegmentation"],["Python","IAM trust policy","confused deputy","sts:AssumeRole","ExternalId","aws:SourceArn","cross-account access"],["Platform and cloud security engineers"],["Node.js 22+ · loopback servers · no dependencies"],["Node.js 22+ offline · kind/Docker/kubectl for live cluster"],["OpenSCAP 1.4.4 and SSG 0.1.82 in Docker"],["API limits","Cloud and IaC","Containers and Kubernetes","Detection"],["WEP","RC4","Wireless security","Nonce reuse","Integrity"],["PKI","MD5","Code signing","Certificate validation","Collisions"],["TLS","Padding oracles","Timing attacks","Protocol downgrade","SSL 3.0"],["TLS","Diffie–Hellman","RSA","Protocol downgrade","Export-grade cryptography"],["TLS","SSLv2","Key reuse","Bleichenbacher","Padding oracles"],["Sweet32","TLS","3DES","Block ciphers","Traffic limits"],["RSA","Key generation","Hardware security","TPM","PKI"],["LastPass","Data breach","Password managers","PBKDF2","Backup security","Privileged access","Secrets management"],["Okta","HAR files","Session hijacking","Session tokens","Support systems","Service accounts","Incident response"],["Certificate expiry","Outages","PKI","TLS","Certificate management","Monitoring","Incident review"],["Storm-0558","Token forgery","Signing keys","Key rotation","JWT validation","Audit logging","Security culture","Incident review"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],["Fix cards"],[],["Fix cards"],["Secrets management","Credential rotation","Leaked secrets","Secret scanning","API keys","Incident response"],["Sessions","Session cookies","Session timeouts","Authentication","Secure a feature"],["Password hashing","Argon2id","bcrypt","scrypt","PBKDF2","NIST SP 800-63B-4","Authentication"],["OAuth 2.0","OpenID Connect","PKCE","Federated login","Single sign-on"],["JWT","JWKS","Token validation","Key rollover","OAuth access tokens"],["Passkeys","WebAuthn","FIDO2","MFA","Phishing-resistant authentication"],["Account recovery","Password reset","Account linking","Help desk","Social engineering"],["Authenticated encryption","AEAD","AES-GCM","Nonces","Associated data","XChaCha20-Poly1305","ChaCha20-Poly1305"],["Envelope encryption","Key rotation","KMS","Data keys","Crypto-shredding","Encryption at rest"],["TLS","PKI","Certificates","ACME","HSTS","Post-quantum TLS"],["Workload identity","OIDC federation","GitHub Actions","SPIFFE","CI/CD"],["Authorization","RBAC","ABAC","ReBAC","BOLA","Policy as code"],["Data minimization","Data retention","Deletion","Crypto-shredding","Backups"],["Tokenization","Pseudonymization","Format-preserving encryption","Differential privacy","Data pipelines"],["Post-quantum cryptography","ML-KEM","Cryptographic inventory","Hybrid TLS","Crypto agility"],["SAML 2.0","Single sign-on","XML signature","Signature wrapping","Replay"],["SCIM 2.0","Provisioning","Deprovisioning","Shared Signals and CAEP","Revocation"],["JWT","JWS","JWE","Token validation","Algorithm confusion","API","Web"],["Multi-factor authentication","Account takeover","TOTP","Passkeys","MFA fatigue","Credential stuffing","NIST SP 800-63B-4","User enumeration"],["OAuth 2.0","OpenID Connect","PKCE","DPoP","Refresh tokens","Backend-for-frontend","Federated login"],["Secrets management","Kubernetes Secrets","HashiCorp Vault","Vault Agent Injector","Secrets Store CSI Driver","External Secrets Operator","SOPS","etcd encryption","Credential rotation"],["CWE"],["CWE"],["CWE"],["CWE"],["CWE"],["OWASP Top 10:2025"],["OWASP Top 10:2025"],["OWASP API Security Top 10 2023"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP ASVS 5.0.0"],["OWASP Kubernetes Top 10 2025"],["JavaScript","JWT","JSON Web Token","audience confusion","token validation"],["JavaScript","password reset","account recovery","single-use token","race condition"],["JavaScript","nonce reuse","IV reuse","AES-GCM","keystream reuse"],["JavaScript","JWT","JWS","alg none","algorithm confusion","signature verification"],["JavaScript","redirect_uri validation","PKCE","code_verifier","authorization code interception","PKCE downgrade"],["JavaScript","weak random","Math.random","CSPRNG","modulo bias","predictable token","insufficient entropy"],["Python","password hashing","Argon2","Argon2id","password storage","rehash on login"],["Software security specialists"],["Identity and application engineers"],["Node.js 22+ · no dependencies"],["Node.js 22+ · npm"],["Python 3.11+ · standard library"],["Leaked secrets","Incident response","Credential rotation","Secret scanning","Git history","Cloud IAM","Short-lived credentials"],["ECB","Block cipher modes","AES","AES-GCM","Java"],["Padding oracle","CBC","Side channels","Authenticated encryption","Encrypt-then-MAC"],["Hash functions","Digital signatures","MD5","SHA-1","Collisions","PKI"],["RSA","Key generation","Entropy","ROCA","PKI"],["RC4","Stream ciphers","TLS","Kerberos","Legacy systems"],["Sweet32","3DES","Blowfish","Block ciphers","Birthday bound"],["Cryptography","AEAD","Password hashing","Digital signatures","Key derivation","Randomness","TLS","Post-quantum cryptography"],["JWT","JWS","Token","Signature","RFC 8725"],["Authentication","Encryption and keys","Secrets","Privacy engineering"],["AppSec program","Secure SDLC","Security metrics","Build an AppSec program"],["AppSec program","Ownership","Security champions","Secure SDLC"],["ASVS 5.0.0","Verification","Test evidence","Requirements"],["NIST SSDF","SP 800-218","Lifecycle evidence","Software attestation"],["OWASP SAMM","Maturity","Roadmap","Evidence"],["Risk acceptance","Exceptions","Metrics","Remediation"],["Control mapping","NIST IR 8477","NIST OLIR","Evidence"],["Supplier risk","Procurement","SBOM","Assurance evidence"],["Cyber Resilience Act","Vulnerability reporting","PCI DSS","Product security"],["ISO 27001","SOC 2","NIST CSF","NIST 800-53","FedRAMP"],["Privacy","GDPR","CCPA","HIPAA","Health data"],["AppSec metrics","Remediation SLA","Vulnerability management","OWASP SAMM","NIST SSDF","BSIMM","Dashboards"],["Cyber Resilience Act","Vulnerability reporting","Incident reporting","ENISA Single Reporting Platform","CSIRT","Runbook","Product security"],["PCI DSS","Requirement 6","Secure SDLC","Payment page security","E-skimming","Change management","Compliance evidence"],["Security champions","AppSec program","Security culture","Training","OWASP SAMM","BSIMM","CODEOWNERS"],["CVSS 4.0","EPSS","CISA KEV","SSVC","NVD","Reachability","Remediation SLA","Vulnerability management"],["Secure by Design","Secure by default","CISA","Secure by Design pledge","Memory safety","Product security"],["BSIMM","OWASP SAMM","NIST SSDF","Maturity models","Benchmarking","Secure development"],["Developer training","Security training","Secure coding","PCI DSS 6.2.2","Security metrics","Learning paths"],["AppSec career","Security engineering","Certifications","Security architect","Product security","Interview preparation"],["SOC 2","Trust Services Criteria","Change management","Access reviews","Audit evidence","SOC 2 Type 2"],["ISO 27001","ISO/IEC 27002","Annex A","Secure coding","Statement of Applicability","ISMS"],["NIST CSF 2.0","Cybersecurity Framework","GOVERN function","Supply chain risk management","Organizational Profile","OSCAL"],["GDPR","Privacy by design","Data protection by default","DPIA","Data subject rights","Right to erasure","Pseudonymization"],["NIS2","DORA","Digital Operational Resilience Act","Supply chain security","ICT third-party risk","Register of information","EU regulation"],["UK Software Security Code of Practice","UK code of practice","DSIT","NCSC","Secure by design","End of support","Vulnerability disclosure"],["IEC 62443-4-1","FDA 524B","Medical device cybersecurity","ISO/SAE 21434","UN R155","UN R156","Product security lifecycle"],["Compliance evidence","Crosswalk","Evidence reuse","OSCAL","SBOM","Build provenance","Control mapping"],["Software attestation","NIST SSDF","SP 800-218","Procurement","Supplier risk","Compliance evidence","Lifecycle evidence"],["OWASP ASVS 5.0.0","Standards"],["JavaScript","release evidence","test evidence","ASVS verification","release gate"],["Security leads and assurance specialists"],["CVSS","CVSS 4.0","Severity","Vulnerability scoring"],["ASVS","ASVS 5.0","Checklist","Verification","OWASP"],["AppSec programs","Verification standards","Evidence","Risk decisions"],["Standards","Frameworks","Identifiers","ASVS","WSTG","SSDF","SLSA"],["Strategy","Measurement"],["Misinformation","Overreliance","Grounding","Chatbots","Customer support","Incident response"],["Supply chain attack","GitHub Actions","pull_request_target","Trusted publishing","Coding agents","AI agents","Install scripts","Token theft"],["Supply chain attack","CI/CD","Token theft","Coding agents","AI agents","Code review"],["LLM security","Prompt injection","Indirect prompt injection","AI agents"],["RAG security","Vector databases","Multi-tenancy","Access control"],["AI agents","Tool authorization","Excessive agency","Human approval"],["LLM security","Output handling","XSS","Markdown rendering"],["AI evaluation","AI red teaming","LLM security","AI governance"],["AI red teaming","AI evaluation","LLM security","Prompt injection","Agentic security","Excessive agency","Unbounded consumption","Test evidence"],["AI agents","Unbounded consumption","Cost controls","Agent memory"],["AI supply chain","Model loading","Safetensors","Model signing"],["Data poisoning","AI supply chain","Model evaluation","Data lineage"],["Model privacy","Membership inference","Training data extraction","Differential privacy"],["MCP security","AI agents","OAuth","Tool poisoning","Multi-agent systems"],["AI agents","Cascading failures","Rogue agents","Multi-agent systems","Incident response","Circuit breakers"],["AI governance","EU AI Act","NIST AI RMF","NIST AI 600-1","ISO/IEC 42001","EU regulation"],["AI coding assistants","Coding agents","Slopsquatting","Prompt injection","MCP","Sandboxing","Secrets"],["LLM misinformation","Misinformation","Hallucination","Overreliance","Grounding","Citations","Factuality evaluation","LLM07:2026"],["AI agents","Sandboxing","Computer use agents","Containers","Human approval","Remote code execution","Egress"],["LLM security","System prompt leakage","Hidden context exposure","Prompt injection","Secrets","Tool authorization"],["Agent memory","AI agents","Memory poisoning","Context poisoning","RAG security","Prompt injection","Data poisoning"],["OWASP Top 10 for LLM Applications 2026","Standards"],["OWASP Top 10 for Agentic Applications 2026","Standards"],["OWASP Top 10 for LLM Applications 2026"],["OWASP Top 10 for LLM Applications 2026"],["OWASP Top 10 for LLM Applications 2026"],["OWASP Top 10 for LLM Applications 2026"],["OWASP Top 10 for LLM Applications 2026"],["OWASP Top 10 for LLM Applications 2026"],["OWASP Top 10 for LLM Applications 2026"],["OWASP Top 10 for LLM Applications 2026"],["OWASP Top 10 for LLM Applications 2026"],["OWASP Top 10 for LLM Applications 2026"],["OWASP Top 10 for Agentic Applications 2026"],["OWASP Top 10 for Agentic Applications 2026"],["OWASP Top 10 for Agentic Applications 2026"],["OWASP Top 10 for Agentic Applications 2026"],["OWASP Top 10 for Agentic Applications 2026"],["OWASP Top 10 for Agentic Applications 2026"],["OWASP Top 10 for Agentic Applications 2026"],["OWASP Top 10 for Agentic Applications 2026"],["OWASP Top 10 for Agentic Applications 2026"],["OWASP Top 10 for Agentic Applications 2026"],["JavaScript","RAG","retrieval-augmented generation","tenant isolation","vector search"],["JavaScript","excessive agency","tool misuse","confused deputy","agent authorization"],["JavaScript","XSS","cross-site scripting","output encoding","HTML injection"],["AI application and security engineers"],["Python 3.11+ · standard library"],["Python 3.11+ · standard library"],["Python 3.11+ offline · Docker for the live tests"],["LLM API","OpenAI API","Anthropic API","API key security","PII redaction","Zero data retention","Structured outputs","Cost caps"],["Prompt injection","Agent permissions","Data boundaries","Red teaming"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["Library","Guides","Platforms"],["Workflows","Templates"],["Labs","Workshops","Projects"],["Learning","Training"],["Glossary","Definitions"],["Templates","Capstone workbooks","Work products","Checklists","Worksheets"],["Coverage","Roadmap"],["Training plan","Curriculum","Team training","Facilitator guide","Learning"],["Case study","Incidents","Breaches","Lessons learned"],["Tags","Lifecycle","Roles","Topics"],["API","JSON","Machine-readable","Agents","SARIF"]],"aliases":[[],[],["EaglePro"],["NetScaler","CitrixBleed"],["Spring4Shell","SpringShell"],["CrowdStrike"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["nextjs"],[],[],[],["nextjs"],[],[],[],[],[],[],[],["nextjs"],[],[],["golang"],[],[],[],["BOLA","IDOR"],[],[],[],[],[],["XSS","escaping"],["SSRF"],[],["Actuator"],[],["CSRF","Origin","SameSite"],[],["sanitization"],["BFLA","BOPLA"],["TOCTOU"],[],["BatBadBut","subprocess"],["SSTI","eval","SpEL","OGNL"],[],["LibreOffice","Ghostscript","Dangerzone"],["WebRTC","TURN","coturn","signaling","STUN"],[],["SAST","DAST","IAST"],[],["Django","Spring","middleware"],[],[],[],[],[],[],[],[],[],[],["SAST","DAST","IAST","SCA","ASPM"],[],[],[],[],[],[],[],[],[],[],[],["PSIRT"],["CSAF","OSV"],["postmortem"],["LFI","RFI"],["mkstemp","O_EXCL","O_TMPFILE","mkdtemp","TOCTOU","PrivateTmp"],["upstream","API10"],[],[],[],["CWE"],[],["MASVS"],["Cross-site scripting (XSS)","XSS"],["SQL injection","SQLi"],["Cross-site request forgery (CSRF)","CSRF","XSRF"],["Missing authorization"],["Out-of-bounds write"],["Path traversal"],["Use after free","UAF"],["Out-of-bounds read"],["OS command injection"],["Code injection","SSTI"],["Classic buffer overflow","strcpy"],["Unrestricted file upload"],["NULL pointer dereference","NullPointerException"],["Stack-based buffer overflow"],["Deserialization of untrusted data","deserialization","pickle"],["Heap-based buffer overflow"],["Improper input validation"],["Sensitive information exposure"],["Missing authentication for a critical function"],["Server-side request forgery (SSRF)","SSRF"],["Command injection"],["Insecure direct object reference (IDOR)","IDOR","BOLA"],["Relative path traversal"],["Absolute path traversal"],["Link following"],["External control of file name or path"],["Injection"],["Argument injection"],["LDAP injection"],["XML injection (aka blind XPath injection)"],["CRLF injection"],["Eval injection"],["PHP remote file inclusion","RFI"],["HTTP request/response splitting"],["Improper encoding or escaping of output"],["Log injection"],["Improper restriction of operations within the bounds of a memory buffer"],["Improper validation of array index"],["Improper handling of length parameter inconsistency"],["Incorrect behavior order: validate before canonicalize"],["Integer overflow or wraparound","Overflow","Wraparound"],["Observable response discrepancy"],["Observable timing discrepancy"],["Sensitive data in error messages"],["Exposure of sensitive information due to incompatible policies"],["Sensitive information in debugging code"],["Improper handling of extra parameters"],["Storing passwords in a recoverable format"],["Password in configuration file"],["Weak encoding for password"],["Improper privilege management"],["Permission issues"],["Improper authorization","AuthZ"],["Improper authentication","authentification","AuthN","AuthC"],["Authentication bypass using an alternate path or channel"],["Authentication bypass by spoofing"],["Authentication bypass by capture-replay"],["Improper certificate validation"],["Improper following of a certificate's chain of trust"],["Improper validation of certificate with host mismatch"],["Improper validation of certificate expiration"],["Improper restriction of excessive authentication attempts"],["Use of single-factor authentication"],["Missing encryption of sensitive data"],["Cleartext storage of sensitive information"],["Cleartext transmission of sensitive information"],["Use of hard-coded cryptographic key"],["Reusing a nonce, key pair in encryption"],["Use of a key past its expiration date"],["Inadequate encryption strength"],["Use of weak hash"],["Use of insufficiently random values"],["Insufficient entropy"],["Use of cryptographically weak pseudo-random number generator (PRNG)"],["Insufficient verification of data authenticity"],["Origin validation error"],["Use of less trusted source"],["Acceptance of extraneous untrusted data with trusted data"],["Missing support for integrity check"],["Exposure of private personal information to an unauthorized actor","PPI","PII","PHI"],["Race condition","TOCTOU"],["Time-of-check time-of-use (TOCTOU) race condition","TOCTTOU","TOCCTOU"],["Insecure temporary file"],["Creation of temporary file in directory with insecure permissions"],["Session fixation"],["Improper handling of highly compressed data (data amplification)"],["Uncontrolled search path element"],["Interpretation conflict"],["Confused deputy"],["Improper cleanup on thrown exception"],["External control of assumed-immutable web parameter"],["Active debug code"],["Exposure of sensitive system information to an unauthorized control sphere"],["Trust boundary violation"],["Weak password requirements"],["Insufficiently protected credentials"],["Exposure of version-control repository to an unauthorized control sphere"],["Sensitive data in log files"],["Insertion of sensitive information into externally-accessible file or directory"],["Inclusion of sensitive information in source code"],["Directory listing"],["Open redirect"],["Client-Side enforcement of server-side security"],["XML external entities (XXE)","XXE"],["Insufficient session expiration"],["Cookie without Secure attribute"],["Reachable assertion"],["Failing open"],["Weak password recovery mechanism for forgotten password"],["XPath injection"],["Reliance on file name or extension of externally-supplied file"],["Improper isolation or compartmentalization"],["Reliance on security through obscurity"],["Violation of secure design principles"],["Improper initialization"],["Exposure of resource to wrong sphere"],["Uncontrolled recursion"],["Incorrect calculation"],["Incorrect permission assignment for critical resource"],["Exposed dangerous method or function"],["Algorithm downgrade"],["Reliance on undefined, unspecified, or implementation-defined behavior"],["Use of a one-way hash without a salt"],["Use of a one-way hash with a predictable salt"],["Mismatched memory management routines"],["XML entity expansion","XEE"],["Regular expression without anchors"],["Use of hard-coded credentials"],["Improper control of interaction frequency"],["Improper enforcement of a single, unique action"],["Numeric range comparison without minimum check"],["Improper enforcement of behavioral workflow"],["Hidden functionality"],["Mass assignment","autobinding"],["Expression language injection"],["Insecure storage of sensitive information"],["Improper export of Android application components"],["Use of implicit intent for sensitive communication"],["Improper authorization in handler for custom URL scheme"],["Improper verification of source of a communication channel"],["Permissive CORS policy"],["Improper neutralization of special elements in data query logic"],["Cookie without HttpOnly flag","HttpOnly"],["Improper restriction of rendered UI layers or frames","Clickjacking","Tapjacking"],["Use of unmaintained third party components"],["Initialization of a resource with an insecure default"],["Improper neutralization of formula elements in a CSV file"],["Use of a cryptographic primitive with a risky implementation"],["Unintended reentrant invocation of non-reentrant code via nested calls"],["Improper SameSite cookie attribute","SameSite"],["Firmware not updateable"],["Improper validation of specified quantity in input"],["Improper validation of specified type of input"],["Prototype pollution","__proto__"],["Reliance on component that is not updateable"],["Inefficient regular expression complexity","ReDoS"],["Server-side template injection"],["Missing origin validation in WebSockets"],["Weak authentication"],["Use of default credentials"],["Dependency on vulnerable third-party component"],["Improper validation of generative AI output"],["Improper neutralization of input used for LLM prompting"],[],["misconfiguration"],["Software Supply Chain Failures"],["Injection"],[],["Mishandling of Exceptional Conditions"],["Broken Object Level Authorization","BOLA","IDOR"],["Broken Object Property Level Authorization","BOPLA"],["Broken Function Level Authorization","BFLA"],["Unrestricted Access to Sensitive Business Flows","scalping"],["Server Side Request Forgery","SSRF"],["Unsafe Consumption of APIs"],[],[],[],[],["Authorization"],[],["WebRTC"],["Secure data storage"],["Preventing data leaks"],["Strong cryptography"],["Key management"],["Authentication and authorization protocols"],["Local authentication"],["Step-up for sensitive operations"],["Secure network traffic"],["Identity pinning"],["Inter-process communication"],["WebViews"],["User interface"],["Up-to-date platform"],["Enforced app updates"],["Components without known vulnerabilities"],["Untrusted input validation"],["Platform integrity"],["Anti-tampering"],["Anti-static analysis"],["Anti-dynamic analysis"],["Data minimization"],["Preventing user identification"],["Transparency"],["User control over data"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["SQLi"],[],[],[],[],[],[],[],["semgrep","codeql","gosec","bandit","brakeman","psalm","spotbugs","findsecbugs","roslyn","netanalyzers","sonarqube","sonarlint","eslint","govulncheck","recheck","regexploit"],[],[],[],[],[],[],[],[],[],["Solorigate"],[],[],[],[],[],[],["purl","SPDX","CycloneDX","SBOM"],[],["Dependabot"],["Sigstore"],[],[],[],[],[],[],[],[],[],["CODEOWNERS","gitsign"],[],["copyleft"],["Privateer"],["S2C2F"],["rollback"],[],["Code download without integrity check"],["Embedded malicious code","backdoor"],["Inclusion of untrusted functionality"],["Untrustworthy components"],["Software or Data Integrity Failures"],["Insufficient Flow Control Mechanisms"],["Inadequate Identity and Access Management"],["Dependency Chain Abuse","typosquatting"],["Poisoned Pipeline Execution (PPE)","PPE","pull_request_target"],["Insufficient PBAC (Pipeline-Based Access Controls)","PBAC"],["Insufficient Credential Hygiene"],["Insecure System Configuration"],["Ungoverned Usage of 3rd Party Services"],["Improper Artifact Integrity Validation"],["Insufficient Logging and Visibility"],[],[],[],[],[],["SBOM"],[],["zizmor"],[],["IngressNightmare"],["CircleCI"],[],[],["DoS"],["logging"],[],["NetworkPolicy"],[],[],["CNAME"],[],[],["queues","backpressure","timeouts"],[],[],[],[],[],[],["Falco","Tetragon","Tracee","eBPF"],["EKS","AKS","GKE","AppArmor"],["Slowloris","DDoS"],["CSPM","CWPP","CIEM","CNAPP","DSPM","ASPM"],[],["OpenSCAP"],[],[],["Resource allocation without limits","DoS"],["Unnecessary privileges"],["Uncontrolled resource consumption","DoS"],["HTTP request smuggling","desynchronization"],["Sensitive data in a shared cache"],["Insufficient logging"],["Security Logging and Alerting Failures"],["Unrestricted Resource Consumption"],[],["Improper Inventory Management"],[],[],["Insecure Workload Configurations","securityContext"],["Overly Permissive Authorization Configurations"],["Lack Of Cluster Level Policy Enforcement"],["Missing Network Segmentation Controls","NetworkPolicy"],["Overly Exposed Kubernetes Components"],["Misconfigured And Vulnerable Cluster Components"],["Cluster To Cloud Lateral Movement","IRSA"],["Broken Authentication Mechanisms"],["Inadequate Logging And Monitoring"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["ROCA"],["LastPass"],["Okta"],["Ericsson"],["MailItemsAccessed"],[],[],[],[],[],[],["nextjs"],[],[],[],[],["OAuth","OIDC","PKCE","SSO"],["JWT","JWKS"],["WebAuthn","passkeys","MFA","FIDO2"],[],["AEAD","nonce"],[],["certificate"],["SPIFFE"],[],[],[],["RSA"],[],[],["localStorage"],["SMS","TOTP"],[],["SOPS","OpenBao","ESO"],["Incorrect authorization"],["Improper access control"],["Broken or risky crypto algorithm","MD5","RC4","ECB"],["Improper signature verification"],["Weak password hashing","Argon2id","bcrypt","scrypt","PBKDF2"],[],[],[],["Authentication"],[],[],[],["Cryptography"],[],["Configuration"],[],["Secrets Management Failures"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["RSA","ChaCha20","ECDSA","Ed25519","hashing"],[],[],[],[],[],[],["SAMM"],[],[],[],[],[],[],[],[],[],[],["EPSS","CVSS","KEV","SSVC"],[],["BSIMM","BSIMM16"],[],["certifications","OSWE","CSSLP"],["SOC2"],["ISO27001"],["GV.SC"],["DPIA","DSAR"],["NIS2","DORA"],[],[],["crosswalk","OSCAL"],["POA&M","3PAO"],["ASVS"],[],[],[],[],[],["standards","frameworks","identifiers","WSTG","SSDF","SLSA"],[],["Moffatt"],["s1ngularity","Nx","pull_request_target"],["CodeBuild"],[],[],[],[],[],["garak","PyRIT","promptfoo","Inspect","canary"],[],[],[],[],[],["quarantine"],[],[],["misinformation","hallucination","overreliance","grounding","LLM07"],["sandbox","gVisor","Firecracker","microVM"],["canary","LLM08"],["AML.T0080","ASI06"],[],[],["Prompt Injection","jailbreak"],["Sensitive Information Disclosure"],["Excessive Agency"],["Supply Chain"],["Data and Model Poisoning","backdoor"],["Unbounded Consumption"],["Misinformation","hallucination","overreliance"],["Hidden Context Exposure"],["Vector and Embedding Weaknesses"],["Improper Output Handling"],["Agent Goal Hijack"],["Tool Misuse and Exploitation"],["Identity and Privilege Abuse"],["Agentic Supply Chain Vulnerabilities"],["Unexpected Code Execution (RCE)","RCE"],["Memory & Context Poisoning"],["Insecure Inter-Agent Communication"],["Cascading Failures"],["Human-Agent Trust Exploitation"],["Rogue Agents"],[],[],[],[],[],[],[],["PII"],[],[],[],[],[],["ASan"],[],[],["GCM"],[],[],[],[],[],["Argon2id"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["CA"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["XSRF"],[],[],[],[],[],[],[],[],[],[],[],[],[],["DoS"],[],[],[],[],[],[],[],[],[],[],[],[],[],["Ed25519","Ed448"],["embeddings"],[],[],[],[],[],[],[],[],[],[],[],["fuzzer"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["IdP"],[],["IMDSv2"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["autobinding"],[],[],[],[],[],["2FA"],["ATLAS"],["ATT&CK"],[],[],[],[],[],[],[],[],[],[],["OAuth2"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["pentest"],[],[],[],["PQC"],[],[],[],[],[],[],["TOCTOU"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["sandboxing","sandboxed"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["SQLi"],[],[],[],[],[],[],[],["SRI"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["typosquat"],["UAF"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["capstone","template","templates"],[],[],[],[],[]],"identifiers":[["CWE-674","CWE-1104","CAPEC-137","CAPEC-242","CVE-2021-44228","CVE-2021-45046","CVE-2021-45105","CVE-2021-44832"],["CAPEC-66","CVE-2023-34362","CVE-2023-35036","CVE-2023-35708"],["CWE-306"],["CWE-119","CWE-613","CAPEC-593","CVE-2023-4966","CVE-2025-5777"],["CAPEC-242","CVE-2022-22965","CVE-2022-22968"],["CWE-129"],["CWE-352","A01:2025"],["CWE-862","CWE-639","CWE-863","A01:2025","API1:2023"],["CWE-601","A01:2025"],["CWE-22","CWE-23","CWE-36","CWE-59","A01:2025"],["CWE-918","A01:2025"],["CWE-942","CWE-346","A02:2025","A07:2025"],["CWE-611","CWE-776","A02:2025"],["CWE-94","CWE-95","A05:2025"],["CWE-79","A05:2025"],["CWE-1236","A05:2025"],["CWE-90","A05:2025"],["CWE-943","A05:2025"],["CWE-78","CWE-88","A05:2025"],["CWE-1336","CWE-94","CWE-95","A05:2025"],["CWE-89","A05:2025"],["CWE-643","CWE-91","A05:2025"],["CWE-1021","A06:2025"],["CWE-1021","A06:2025"],["CWE-1333","A06:2025"],["CWE-770","CWE-400","A06:2025","API4:2023"],["CWE-434","CWE-646","CWE-73","CWE-770","A06:2025"],["CWE-434","CWE-646","CWE-73","CWE-770","A06:2025"],["CWE-502","A08:2025"],["CWE-915","A08:2025","API3:2023"],["CWE-117","CWE-93","CWE-113","A09:2025","A05:2025"],[],[],[],[],[],[],[],[],[],[],[],["CWE-639","CWE-862","A01:2025","API1:2023","WSTG-ATHZ-04","V8"],["CWE-434","A06:2025","WSTG-BUSL-08","WSTG-BUSL-09","V5"],["CWE-347","CWE-294","CWE-306","CWE-208"],["A06:2025"],["CWE-1395","CWE-1104","A03:2025","CVE-2025-55182","CVE-2025-66478","V15"],["CWE-602","CWE-939"],["CWE-79","CWE-116","A05:2025","CAPEC-63","CAPEC-588","CAPEC-591","CAPEC-592","WSTG-INPV-01","WSTG-INPV-02","V1","V3"],["CWE-918","A01:2025","API7:2023","CAPEC-664","WSTG-INPV-19"],["CWE-209","CWE-636","CWE-460","CWE-489","A10:2025","WSTG-ERRH-01","WSTG-ERRH-02","V16"],["CWE-200","CWE-209","CWE-215","CWE-489","CWE-548","CWE-527","CWE-538","A02:2025","V13.4","WSTG-CONF-02","WSTG-CONF-04","WSTG-CONF-05","WSTG-ERRH-01","V13"],[],["CWE-352","CWE-1275","A01:2025","CAPEC-62","WSTG-SESS-05","V3"],["CWE-942","CWE-346","CWE-1021","A02:2025","API8:2023","WSTG-CLNT-07","V3"],["CWE-79","CWE-346","A05:2025","CAPEC-588","CAPEC-592","V1","V3"],["CWE-915","CWE-213","CWE-862","A01:2025","API3:2023","API5:2023","V8"],["CWE-362","CWE-367","CWE-837","A06:2025","CAPEC-26","CAPEC-29","V2","V15"],["CWE-943","CWE-90","A05:2025","CAPEC-88","CAPEC-201","CAPEC-586","CAPEC-676","CAPEC-136","CAPEC-242","V1"],["CWE-78","CWE-77","CWE-88","A05:2025","CAPEC-88","CAPEC-6","CAPEC-248","WSTG-INPV-12"],["CWE-94","CWE-95","CWE-1336","CWE-917","A05:2025","CAPEC-242","WSTG-INPV-11","WSTG-INPV-18"],["CWE-22","CWE-23","CWE-36","CWE-59","CWE-409","A01:2025","CAPEC-126","CAPEC-139","CAPEC-597","V5"],["CWE-409"],["CWE-441","CWE-295","CWE-359","V17"],[],[],["CWE-130","CWE-1284","CAPEC-28"],["CWE-1188","CWE-288","CWE-489"],["CWE-926","CWE-939","CWE-922","CWE-532","CWE-295"],["CWE-749","CWE-346","CWE-940"],["CWE-494","CWE-1277","CWE-1329","A08:2025"],["CWE-1265","CWE-841"],["CWE-20","CWE-502","CWE-611","CWE-776","A05:2025","A08:2025","V1","V2"],["CWE-1321","V15"],["CWE-312","CWE-319","CWE-295","CWE-926","CWE-927","CWE-749","CWE-939","CWE-532","MASVS-STORAGE-1","MASVS-STORAGE-2","MASVS-CRYPTO-1","MASVS-CRYPTO-2","MASVS-AUTH-2","MASVS-AUTH-3","MASVS-NETWORK-1","MASVS-NETWORK-2","MASVS-PLATFORM-1","MASVS-PLATFORM-2","MASVS-PLATFORM-3","MASVS-CODE-1","MASVS-CODE-4","MASVS-RESILIENCE-1","MASVS-RESILIENCE-2"],["CWE-472","CWE-602","CWE-1284","CWE-839","CWE-837","CWE-841","CWE-640","CWE-799","A06:2025","API6:2023","V2.2","V2.3","V2.4","V6.4","CAPEC-162","CAPEC-74","CAPEC-50","CAPEC-212"],["CWE-93","CWE-113","CWE-117","CWE-1236","A05:2025","V1.2","V4.2","V16.4","CAPEC-34","CAPEC-105","CAPEC-93","CAPEC-81"],["CWE-798","CWE-1395","CWE-1104","V13.3","V15.1","V15.2"],["V15.1","V15.2"],["CWE-346","A05:2025","V1.2","V1.3","V3.2","V3.5","CAPEC-588","CAPEC-63"],["CWE-312","CWE-319","CWE-295","CWE-939","CWE-940","CWE-749","CWE-532","CWE-602","MASVS-STORAGE-1","MASVS-STORAGE-2","MASVS-CRYPTO-1","MASVS-CRYPTO-2","MASVS-AUTH-2","MASVS-AUTH-3","MASVS-NETWORK-1","MASVS-NETWORK-2","MASVS-PLATFORM-1","MASVS-PLATFORM-2","MASVS-PLATFORM-3","MASVS-CODE-4","MASVS-RESILIENCE-1","MASVS-RESILIENCE-2","MASVS-PRIVACY-1","MASVS-PRIVACY-3"],["CWE-787","CWE-125","CWE-416","CWE-120","CWE-121","CWE-122","CWE-476","CWE-190","V1.4","CAPEC-100","CAPEC-540","CAPEC-92"],["CWE-943","CWE-90","CWE-643","CWE-1287","A05:2025","V1.2","V1.3","V15.3","CAPEC-676","CAPEC-136","CAPEC-83"],["CWE-601","A01:2025","WSTG-CLNT-04"],["CWE-1333","CWE-1287","CWE-777","CWE-180","CWE-235","V1.1","V1.2","V1.3","V2.2","V15.3","CAPEC-492","CAPEC-460","CAPEC-267","CAPEC-71"],["CWE-758","CWE-762","CWE-190","CWE-617","CWE-1395","V1.4","V15.1","V15.2","CAPEC-538","CAPEC-100"],["CWE-1021","CWE-319","CWE-614","CWE-1004","A02:2025","CAPEC-103","CAPEC-102","WSTG-CONF-07","WSTG-CLNT-09"],["A06:2025"],[],[],[],["CWE-306"],[],["CWE-98","CWE-73","A05:2025","CAPEC-252","CAPEC-193","WSTG-INPV-11","WSTG-ATHZ-01"],["CWE-377","CWE-379","CWE-59","CWE-367","V15.4","CAPEC-27","CAPEC-29"],["CWE-295","CWE-601","CWE-522","API10:2023","CAPEC-141","CAPEC-275"],["CWE-922","CWE-295","CWE-319","CWE-308","CWE-926","MASVS-STORAGE-1","MASVS-CRYPTO-1","MASVS-AUTH-2","MASVS-AUTH-3","MASVS-NETWORK-1","MASVS-NETWORK-2","MASVS-PLATFORM-1","MASVS-PLATFORM-3","MASVS-RESILIENCE-1","A06:2025"],["CWE-1427","A06:2025"],["CWE-294","CWE-665","CWE-682"],[],[],[],["CWE-79"],["CWE-89"],["CWE-352"],["CWE-862"],["CWE-787"],["CWE-22"],["CWE-416"],["CWE-125"],["CWE-78"],["CWE-94"],["CWE-120"],["CWE-434"],["CWE-476"],["CWE-121"],["CWE-502"],["CWE-122"],["CWE-20"],["CWE-200"],["CWE-306"],["CWE-918"],["CWE-77"],["CWE-639"],["CWE-23"],["CWE-36"],["CWE-59"],["CWE-73"],["CWE-74"],["CWE-88"],["CWE-90"],["CWE-91"],["CWE-93"],["CWE-95"],["CWE-98"],["CWE-113"],["CWE-116"],["CWE-117"],["CWE-119"],["CWE-129"],["CWE-130"],["CWE-180"],["CWE-190"],["CWE-204"],["CWE-208"],["CWE-209"],["CWE-213"],["CWE-215"],["CWE-235"],["CWE-257"],["CWE-260"],["CWE-261"],["CWE-269"],["CWE-275"],["CWE-285"],["CWE-287"],["CWE-288"],["CWE-290"],["CWE-294"],["CWE-295"],["CWE-296"],["CWE-297"],["CWE-298"],["CWE-307"],["CWE-308"],["CWE-311"],["CWE-312"],["CWE-319"],["CWE-321"],["CWE-323"],["CWE-324"],["CWE-326"],["CWE-328"],["CWE-330"],["CWE-331"],["CWE-338"],["CWE-345"],["CWE-346"],["CWE-348"],["CWE-349"],["CWE-353"],["CWE-359"],["CWE-362"],["CWE-367"],["CWE-377"],["CWE-379"],["CWE-384"],["CWE-409"],["CWE-427"],["CWE-436"],["CWE-441"],["CWE-460"],["CWE-472"],["CWE-489"],["CWE-497"],["CWE-501"],["CWE-521"],["CWE-522"],["CWE-527"],["CWE-532"],["CWE-538"],["CWE-540"],["CWE-548"],["CWE-601"],["CWE-602"],["CWE-611"],["CWE-613"],["CWE-614"],["CWE-617"],["CWE-636"],["CWE-640"],["CWE-643"],["CWE-646"],["CWE-653"],["CWE-656"],["CWE-657"],["CWE-665"],["CWE-668"],["CWE-674"],["CWE-682"],["CWE-732"],["CWE-749"],["CWE-757"],["CWE-758"],["CWE-759"],["CWE-760"],["CWE-762"],["CWE-776"],["CWE-777"],["CWE-798"],["CWE-799"],["CWE-837"],["CWE-839"],["CWE-841"],["CWE-912"],["CWE-915"],["CWE-917"],["CWE-922"],["CWE-926"],["CWE-927"],["CWE-939"],["CWE-940"],["CWE-942"],["CWE-943"],["CWE-1004"],["CWE-1021"],["CWE-1104"],["CWE-1188"],["CWE-1236"],["CWE-1240"],["CWE-1265"],["CWE-1275"],["CWE-1277"],["CWE-1284"],["CWE-1287"],["CWE-1321"],["CWE-1329"],["CWE-1333"],["CWE-1336"],["CWE-1385"],["CWE-1390"],["CWE-1392"],["CWE-1395"],["CWE-1426"],["CWE-1427"],["A01:2025"],["A02:2025"],["A03:2025"],["A05:2025"],["A06:2025"],["A10:2025"],["API1:2023"],["API3:2023"],["API5:2023"],["API6:2023"],["API7:2023"],["API10:2023"],["V1"],["V2"],["V3"],["V5"],["V8"],["V15"],["V17"],["MASVS-STORAGE-1"],["MASVS-STORAGE-2"],["MASVS-CRYPTO-1"],["MASVS-CRYPTO-2"],["MASVS-AUTH-1"],["MASVS-AUTH-2"],["MASVS-AUTH-3"],["MASVS-NETWORK-1"],["MASVS-NETWORK-2"],["MASVS-PLATFORM-1"],["MASVS-PLATFORM-2"],["MASVS-PLATFORM-3"],["MASVS-CODE-1"],["MASVS-CODE-2"],["MASVS-CODE-3"],["MASVS-CODE-4"],["MASVS-RESILIENCE-1"],["MASVS-RESILIENCE-2"],["MASVS-RESILIENCE-3"],["MASVS-RESILIENCE-4"],["MASVS-PRIVACY-1"],["MASVS-PRIVACY-2"],["MASVS-PRIVACY-3"],["MASVS-PRIVACY-4"],["CWE-352","A01:2025"],["CWE-22","A01:2025"],["CWE-362","CWE-367","A06:2025"],["CWE-639","A01:2025","API1:2023"],["CWE-345","CWE-294","A08:2025","A07:2025"],["CWE-918","A06:2025","API7:2023"],["CWE-942","A02:2025","A01:2025"],["CWE-1021","A02:2025","A05:2025"],["CWE-79","A05:2025"],["CWE-472","CWE-1284","CWE-837","A06:2025","API6:2023"],["CWE-89","A05:2025","API8:2023"],["CWE-22","A01:2025"],["CWE-918","A06:2025","API7:2023"],["CWE-601","A01:2025"],["CWE-434","CWE-646","CWE-73","CWE-770","A06:2025","API4:2023"],["CWE-78","CWE-88","A05:2025"],["CWE-915","A08:2025","API3:2023"],["CWE-125","CWE-130","A10:2025"],["CWE-1336","CWE-94","CWE-95","A05:2025"],["CWE-611","CWE-776","A02:2025"],["CWE-502","A08:2025"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["CWE-89","A05:2025","CAPEC-66","WSTG-INPV-05","V1"],["CWE-307","CWE-204","CWE-640","CWE-841","CWE-345","CWE-1236","CWE-1427","CAPEC-600","CAPEC-565","CAPEC-575","CAPEC-50","CAPEC-650","CAPEC-126","CAPEC-26","CAPEC-664","CAPEC-66","CAPEC-87","CAPEC-62"],["CWE-290","CWE-441","CWE-436","CWE-367","CWE-294","CWE-532","CWE-1427","CAPEC-21","CAPEC-1","CAPEC-66","CAPEC-33","CAPEC-586","CAPEC-29","CAPEC-664","CAPEC-141","CAPEC-538","CAPEC-130"],["CWE-657","CWE-636","CWE-1188","A06:2025","V1.2","V1.3"],[],[],[],[],[],[],[],[],[],[],[],["CWE-506","CWE-522","A03:2025","V15.2","V13.3","CAPEC-538","CAPEC-511"],["CWE-506","CWE-532","A03:2025","V13.3","CAPEC-538","CAPEC-439","CVE-2025-30066","CVE-2025-30154"],["CWE-506","CWE-912","A03:2025","CAPEC-444","CAPEC-538","CVE-2024-3094"],["CWE-912","CAPEC-444","CAPEC-511","CAPEC-206"],["CAPEC-439"],["CAPEC-511","CAPEC-444","CAPEC-206","CVE-2023-29059"],["CAPEC-538","CVE-2021-4229"],["CVE-2024-38526"],["A03:2025","A08:2025","CAPEC-444"],["A03:2025"],["A03:2025"],["A03:2025"],["CWE-1395","CWE-1104","A03:2025","V15"],["CWE-347","A03:2025","A08:2025","CAPEC-206","CICD-SEC-9"],["A03:2025","A08:2025","CAPEC-444","CICD-SEC-9"],["CWE-829","A03:2025","CAPEC-88","CAPEC-242","CICD-SEC-4"],["CWE-506","A03:2025","CAPEC-538"],["A03:2025"],["A03:2025"],["CWE-1104","CWE-1357","A03:2025","V15"],["CWE-494","A03:2025","A08:2025","CAPEC-657"],["CWE-427","CWE-1104","A03:2025","CAPEC-471","CAPEC-538","CICD-SEC-3"],["CWE-116","CWE-275","CWE-349","A03:2025","CAPEC-88","CAPEC-538","CICD-SEC-4"],["CICD-SEC-1"],["CWE-522"],[],[],[],[],[],["CWE-494"],["CWE-506"],["CWE-829"],["CWE-1357"],["A08:2025"],["CICD-SEC-1"],["CICD-SEC-2"],["CICD-SEC-3"],["CICD-SEC-4"],["CICD-SEC-5"],["CICD-SEC-6"],["CICD-SEC-7"],["CICD-SEC-8"],["CICD-SEC-9"],["CICD-SEC-10"],["CWE-1395","A03:2025"],["CWE-345","A08:2025"],["CWE-94","CWE-78","A03:2025"],[],[],[],[],[],[],["CWE-653","CWE-306","CVE-2025-1974","CVE-2025-24514","CVE-2025-1097","CVE-2025-1098","CVE-2025-24513"],["CWE-294","CWE-522","CWE-798"],["CWE-732","CWE-798"],["CWE-732","CWE-312","A02:2025"],["CWE-770","CWE-400","API4:2023"],["CWE-532","CWE-778","A09:2025","V16"],["CWE-250","A02:2025","K01:2025"],["A02:2025","K04:2025","K05:2025"],["A02:2025"],["A02:2025"],["WSTG-CONF-10"],["CWE-290","CWE-348","CWE-306","API9:2023"],["CWE-1385","CWE-307","V4"],[],["V12"],["A09:2025"],[],["CWE-444","A06:2025","API8:2023","CAPEC-33","V4"],["CWE-524","API8:2023","CAPEC-141","V14"],["CWE-1188","CWE-732","CWE-798","A02:2025","V13.2","V13.3","V16.4","CAPEC-664","CAPEC-560"],[],["CWE-269","CWE-1188","K07:2025"],["CAPEC-469","CAPEC-488"],["CWE-1188","CWE-732"],["CWE-538","CWE-1395"],["CWE-1188"],[],[],["CWE-770"],["CWE-250"],["CWE-400"],["CWE-444"],["CWE-524"],["CWE-778"],["A09:2025"],["API4:2023"],["API8:2023"],["API9:2023"],["V4"],["V16"],["K01:2025"],["K02:2025"],["K04:2025"],["K05:2025"],["K06:2025"],["K07:2025"],["K08:2025"],["K09:2025"],["K10:2025"],["CWE-250","A02:2025"],["CWE-668","CWE-284","A01:2025","A02:2025"],["CWE-863","CWE-284","A01:2025","A02:2025"],[],[],[],[],[],["CWE-323","CWE-353","A04:2025"],["CWE-328","CWE-295","A04:2025"],["CWE-757","CWE-208","A04:2025"],["CWE-757","CWE-326","A04:2025"],["A04:2025"],["CWE-326","A04:2025"],["CWE-1240","CWE-326","A04:2025"],["CWE-522","CWE-311","CWE-1104","CAPEC-568","CAPEC-55"],["CWE-522","CWE-532","CWE-294","CWE-613","CAPEC-593","CAPEC-60","CAPEC-560"],["CWE-298","CWE-324","CWE-295"],["CWE-324","CAPEC-196"],["CWE-330","CWE-338","A04:2025"],["CWE-916","CWE-759","CWE-327","A04:2025"],["CWE-798","CWE-260","CWE-261","A07:2025","A02:2025","A04:2025"],["CWE-295","CWE-297","CWE-296","A07:2025","A04:2025"],["CWE-347","CWE-287","A07:2025","A04:2025"],["CWE-306","CWE-287","A07:2025","API2:2023"],["CWE-306","CWE-287","A07:2025","API2:2023"],["CWE-384","CWE-613","CWE-614","CWE-1004","CWE-1275","A07:2025","A02:2025","A01:2025"],["CWE-798","CWE-522","CWE-532","V13"],["CWE-384","CWE-613","CWE-614","CWE-1004","CWE-1275","A07:2025","CAPEC-60","CAPEC-61","CAPEC-593","V7"],["CWE-916","CWE-759","CWE-760","CWE-257","CWE-521","A04:2025","CAPEC-16","CAPEC-49","CAPEC-55","V11"],["CWE-601","CWE-346","CWE-294","A07:2025","V10"],["CWE-347","CWE-290","A07:2025","API2:2023","CAPEC-475","V9"],["CWE-308","CWE-294","CWE-1390","A07:2025","V6"],["CWE-640","CWE-204","A07:2025","API2:2023","CAPEC-50","V6"],["CWE-323","CWE-353","A04:2025","V11"],["CWE-324","CWE-323","CWE-321","A04:2025","V11"],["CWE-295","CWE-297","CWE-298","CWE-319","A04:2025","CAPEC-94","V12"],["CWE-290","V13"],["CWE-863","A01:2025","CWE-284","V8"],["CWE-359","CWE-532","V14"],["CWE-359","CWE-328"],["CWE-326","A04:2025","V11"],["CWE-347","CWE-290","CWE-294","A07:2025","V6"],["CWE-613"],["CWE-287","CWE-290","CWE-613","CWE-326","A07:2025","API2:2023","CAPEC-475","CAPEC-196","CAPEC-593"],["CWE-307","CWE-308","CWE-294","CWE-204","CWE-208","CWE-521","CWE-640","A07:2025","V6.2","V6.3","V6.4","V6.5","V6.6","V2.4","CAPEC-600","CAPEC-565","CAPEC-49","CAPEC-94","CAPEC-575"],["CWE-601","CWE-346","CWE-294","CWE-287","A07:2025","CAPEC-62","CAPEC-593"],["CWE-798","CWE-522","CWE-312","CWE-732","CAPEC-37","CAPEC-560","K03:2025"],["CWE-863"],["CWE-284"],["CWE-327"],["CWE-347"],["CWE-916"],["A04:2025"],["A07:2025"],["API2:2023"],["V6"],["V7"],["V9"],["V10"],["V11"],["V12"],["V13"],["V14"],["K03:2025"],["CWE-287","A07:2025","API2:2023"],["CWE-640","A07:2025"],["CWE-323","A04:2025"],["CWE-347","A07:2025","API2:2023"],["CWE-601","CWE-287","A01:2025","A07:2025","API2:2023"],["CWE-338","CWE-330","CWE-331","A04:2025"],["CWE-916","CWE-759","CWE-327","A04:2025","A07:2025"],[],[],[],[],[],["CWE-798","CWE-540","CWE-532","CWE-522","CWE-321","V13.3","V13.2","CAPEC-560","CAPEC-37","CAPEC-191"],["CWE-327","A04:2025","V11"],["CWE-353","CWE-208","A04:2025","V11"],["CWE-328","CWE-327","A04:2025","V11"],["CWE-331","CWE-326","A04:2025","V11"],["CWE-327","A04:2025","V11"],["CWE-327","CWE-326","A04:2025","V11"],["CWE-326","CWE-328","CWE-338","CWE-323","CWE-757","A04:2025","V11.2","V11.3","V11.4","V11.5","V11.6","V12.1","CAPEC-97","CAPEC-20","CAPEC-55","CAPEC-463","CAPEC-620"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["CWE-1395","V3.6","V15.1","V15.2"],[],["CWE-1395"],["CWE-798","CWE-1392"],[],[],[],[],[],[],[],[],[],[],[],[],[],["CWE-345","A08:2025"],[],[],[],[],[],[],[],[],["CWE-522","CVE-2025-8217"],["CWE-1427","LLM01:2026","ASI01:2026"],["LLM09:2026"],["CWE-367","LLM03:2026","ASI02:2026","ASI09:2026"],["A05:2025","LLM10:2026","V1"],[],["CWE-1427"],["LLM06:2026"],["LLM04:2026"],["LLM05:2026"],["CWE-359","LLM02:2026"],["CWE-441","ASI03:2026","ASI07:2026","ASI04:2026"],["ASI08:2026","ASI10:2026"],[],["CWE-1427"],["CWE-1426","LLM07:2026"],["CWE-653","ASI05:2026"],["CWE-497","CWE-656","CWE-798","LLM08:2026"],["CWE-501","CWE-349","CWE-1427","ASI06:2026"],[],[],["LLM01:2026"],["LLM02:2026"],["LLM03:2026"],["LLM04:2026"],["LLM05:2026"],["LLM06:2026"],["LLM07:2026"],["LLM08:2026"],["LLM09:2026"],["LLM10:2026"],["ASI01:2026"],["ASI02:2026"],["ASI03:2026"],["ASI04:2026"],["ASI05:2026"],["ASI06:2026"],["ASI07:2026"],["ASI08:2026"],["ASI09:2026"],["ASI10:2026"],["CWE-285","LLM09:2026","LLM02:2026","A01:2025"],["CWE-862","LLM03:2026","ASI02:2026","A01:2025"],["CWE-79","A05:2025","LLM10:2026"],[],[],[],[],["CWE-798","CWE-522","CWE-532","CWE-359"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[]],"base":[0,0,1,0,2,3,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,5,4,4,4,6,4,4,4,7,7,7,7,7,7,7,7,7,7,4,1,8,8,9,0,3,2,8,2,2,0,10,10,10,1,11,2,2,2,8,8,8,12,13,13,2,3,3,3,14,15,2,3,11,2,13,13,10,3,3,2,8,15,3,10,9,0,9,0,0,0,2,2,8,9,9,14,16,17,18,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,19,20,20,20,20,20,20,21,21,21,21,21,21,22,22,22,22,22,22,22,23,23,23,23,23,23,23,23,23,23,23,23,23,23,23,23,23,23,23,23,23,23,23,23,24,24,24,24,24,24,24,24,24,24,24,24,24,24,24,24,24,24,24,24,24,25,25,25,26,26,26,26,26,26,26,26,26,26,26,26,2,9,9,9,27,27,27,27,4,28,29,29,29,29,29,30,31,30,32,31,32,30,30,31,33,33,33,30,34,34,31,30,35,32,30,36,30,31,31,31,30,31,30,36,37,19,19,19,19,20,38,38,38,38,38,38,38,38,38,38,24,24,24,25,26,27,27,27,28,39,40,40,40,41,42,39,39,40,40,40,41,41,43,44,42,45,45,45,40,42,39,43,40,39,39,46,47,19,19,19,19,19,19,20,21,21,21,22,22,48,48,48,48,48,48,48,48,48,24,24,24,25,26,26,26,28,49,50,49,50,49,49,50,51,52,50,52,4,4,4,4,4,4,53,4,51,52,52,52,52,52,52,49,50,50,54,54,55,55,50,52,52,52,52,52,51,19,19,19,19,19,20,20,21,22,22,22,22,22,22,22,22,48,24,24,24,24,24,24,24,25,25,26,26,26,51,49,49,50,50,49,49,49,27,28,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,56,57,24,25,27,27,16,16,29,58,59,59,58,58,59,58,60,60,59,61,61,61,59,59,62,59,58,59,58,59,63,64,65,65,65,65,65,65,65,65,65,65,66,66,66,66,66,66,66,66,66,66,24,24,24,25,26,26,26,58,28,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,67,16,16,16,16,16,68,16,25,16,16,16],"relatedIdentifiers":[["CWE-502","CWE-400","CWE-917","A05:2025","A08:2025","A03:2025","V1","V15"],["CWE-89","A05:2025"],["CWE-639","A01:2025"],["A07:2025"],["CWE-94","CWE-915","A05:2025","A03:2025"],["CWE-125","A10:2025"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["CWE-863","CWE-284"],["CWE-770","API4:2023"],["A07:2025","A08:2025","API10:2023","V2","V4"],["CWE-639","A01:2025","API1:2023","V8","CWE-863"],["CWE-506"],["CWE-639","A01:2025","API1:2023","V8","MASVS-STORAGE-1","MASVS-AUTH-1","MASVS-PLATFORM-1","MASVS-RESILIENCE-1","MASVS-RESILIENCE-3","MASVS-RESILIENCE-4","A06:2025"],[],["API10:2023","V1","V13","V15"],["CWE-200","API8:2023","V2"],[],[],[],["CWE-79","CWE-352","A01:2025","A05:2025"],[],["CWE-863","CWE-284","A08:2025","V15"],[],["CWE-78","CWE-94","CWE-502","CWE-77","CWE-88","CWE-611","CWE-1336","A02:2025","A08:2025","CWE-917"],["V1"],["V1"],["CWE-770","API4:2023"],["CWE-611","CWE-918","CWE-22","CWE-400","A02:2025","A01:2025"],["CWE-770"],["CWE-862","CWE-639","A01:2025","API1:2023","V8"],["CWE-89","A05:2025","V1"],["CWE-125","V1"],["CWE-352","A01:2025","A02:2025","V13"],["MASVS-STORAGE-1","MASVS-STORAGE-2","MASVS-NETWORK-1","MASVS-PLATFORM-1","MASVS-PLATFORM-3","MASVS-RESILIENCE-1"],["CWE-250","A01:2025"],["A03:2025","CWE-347"],[],["CWE-770","CWE-400","A02:2025","API4:2023","V15"],["CWE-20","CWE-915","A05:2025","A08:2025","API3:2023"],["A01:2025","A02:2025","A04:2025","A07:2025","A08:2025"],["A07:2025"],["A09:2025"],["CWE-494","A03:2025","A02:2025","A08:2025"],["A03:2025","A05:2025"],["CWE-79","CWE-95","CWE-1336"],["A01:2025","A02:2025","A04:2025","A06:2025","A07:2025"],["A10:2025"],["CWE-917"],["V3","V10"],["CWE-20","A05:2025","API4:2023"],["CWE-416","CWE-1357","A03:2025","A10:2025"],["API8:2023","A04:2025","A06:2025","V3"],[],[],["V2","V6","V8","V16"],[],["CWE-347"],[],["A01:2025","CWE-829","CWE-22","CWE-94"],["A01:2025"],["CWE-20","CWE-770","A03:2025","A05:2025","API7:2023"],["MASVS-AUTH-1","CWE-862","API1:2023","API2:2023","API6:2023"],["CWE-862","CWE-918","CWE-79","LLM01:2026","LLM02:2026","LLM03:2026","LLM06:2026","LLM09:2026","LLM10:2026","ASI01:2026","ASI02:2026","ASI03:2026","ASI04:2026","ASI06:2026"],["CWE-347"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["CWE-639","CWE-862","CWE-915","CWE-434","CWE-22","CWE-362","CWE-918","A01:2025","A06:2025","A07:2025","API1:2023","API5:2023","API6:2023","API7:2023","LLM01:2026","LLM03:2026"],["CWE-639","CWE-863","CWE-915","CWE-89","CWE-502","CWE-918","CWE-829","CWE-770","A01:2025","A06:2025"],["A01:2025","CWE-862","CWE-863"],[],[],[],[],[],[],[],[],[],[],[],["CWE-829","CICD-SEC-3","CWE-1357","A08:2025"],["CWE-494","CWE-829","CICD-SEC-4","CICD-SEC-6","CICD-SEC-8","CICD-SEC-10","A08:2025"],["CWE-494","CWE-1357","A08:2025","V15"],["CWE-506","A03:2025","A08:2025"],["CICD-SEC-5","CICD-SEC-8","CICD-SEC-9","CWE-494","CWE-506","A03:2025","A08:2025"],["CWE-506","A03:2025","A08:2025"],["CWE-506","CWE-829","CWE-1357","A03:2025","A08:2025"],["CWE-829","CWE-494","A03:2025","A08:2025"],["CWE-829","CICD-SEC-1","CICD-SEC-4","CICD-SEC-9"],["V15"],[],[],[],["CWE-494","K04:2025"],["CWE-494"],["A08:2025","CICD-SEC-5","CWE-78","CWE-94","A05:2025"],["CWE-1357","A08:2025","CICD-SEC-3"],[],["A08:2025"],[],["CICD-SEC-6","CICD-SEC-9"],["CWE-494","CWE-829","CWE-1357","A08:2025","LLM04:2026"],["CWE-94","CWE-829","CICD-SEC-1","CICD-SEC-5","CICD-SEC-6","CICD-SEC-7","CICD-SEC-8","CWE-95","A08:2025","A05:2025"],["CICD-SEC-2","CICD-SEC-6","CICD-SEC-9","CWE-284","CWE-1357","A03:2025","A08:2025","V15"],["CICD-SEC-3","CWE-506","CWE-829","A03:2025","A08:2025"],[],["CICD-SEC-1"],["CICD-SEC-3"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["CWE-94","A02:2025","A05:2025"],["A07:2025","A04:2025"],["A02:2025","A01:2025"],["V13"],["A06:2025","V2","V15"],["CWE-117"],["K02:2025","K04:2025","K09:2025"],["A08:2025"],["CWE-250","CWE-863","CWE-284","A01:2025"],[],["A02:2025","V3"],["A01:2025","A07:2025","API2:2023","API8:2023","V4","V14"],["CWE-770","CWE-400","API4:2023","API2:2023"],["CWE-770","CWE-362","CWE-400","A10:2025","API4:2023","API10:2023","V15"],["CWE-863","CWE-295","A01:2025","A07:2025","API2:2023","API5:2023","V8","V13"],["CWE-778","V16","K10:2025"],["CWE-444","A07:2025","API2:2023","API6:2023","API8:2023","V2","V6","V14"],[],["CWE-200","A01:2025","A02:2025"],["CWE-918","K08:2025","CWE-778","A01:2025","A09:2025","A07:2025"],["K08:2025","K10:2025","CWE-778","A09:2025","V16"],["K01:2025","K02:2025","K04:2025","K06:2025","K08:2025","K09:2025","CWE-250","CWE-284","A02:2025","A01:2025","V13"],["CWE-400","CWE-770","API4:2023"],["CWE-250","A02:2025","A01:2025"],["CWE-250","CWE-494","A02:2025","A03:2025","K01:2025","K03:2025","K04:2025","A08:2025","V13","V15"],["K07:2025","A02:2025"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["CWE-327","V11"],["CWE-327","A08:2025","V11"],["V11","V12","CWE-327"],["V11","V12"],["V11","V12","CWE-327"],["CWE-327","V11","V12"],["V11"],["CWE-916","A04:2025","A07:2025","A02:2025"],["CWE-778","A07:2025","A09:2025","A02:2025"],["CWE-778","A02:2025","A04:2025","A09:2025"],["CWE-347","CWE-778","A07:2025","A04:2025","A09:2025"],[],[],[],[],[],[],[],[],["A04:2025","A09:2025"],["API2:2023","V6"],["A07:2025","API2:2023","V6"],["API2:2023","V6","V9","MASVS-AUTH-1","CWE-352"],["A04:2025","V10","CWE-918"],["API2:2023"],["CWE-362","V7"],["CWE-327"],["V13"],["A07:2025","API8:2023"],["CWE-250","A07:2025","API2:2023","K03:2025","CICD-SEC-6","CWE-863","A01:2025"],["CWE-862","CWE-639","API1:2023","API3:2023","API5:2023"],[],["V14","MASVS-PRIVACY-2"],["CWE-327"],["API2:2023","CWE-611","A04:2025"],["A01:2025","A07:2025","V7","V8","CWE-863"],["CWE-347","CWE-918","A04:2025","A01:2025","V9","V7","V10"],["API2:2023"],["CWE-352","A01:2025","API2:2023","V10","V3","V7"],["K02:2025","A02:2025","A04:2025"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["A07:2025","CICD-SEC-6","A04:2025","A02:2025"],[],["CWE-327"],["CWE-347"],[],["V12"],["V12"],["CWE-327","CWE-347","CWE-916","MASVS-CRYPTO-1"],[],[],[],[],["CWE-78","A05:2025","V1"],[],[],[],[],["CWE-1357","A03:2025"],[],[],["V14"],["V15"],["A03:2025","A08:2025"],["CWE-829","CWE-494","A03:2025","A08:2025"],[],["A03:2025","V15"],["CWE-89","CWE-79","CWE-78"],[],[],[],[],[],[],["MASVS-PRIVACY-1","MASVS-PRIVACY-4","V14"],[],[],[],[],[],[],[],[],[],[],[],[],[],["LLM07:2026","ASI09:2026"],["ASI04:2026","CWE-78","CWE-506","CWE-829","A03:2025","A08:2025","LLM03:2026","ASI05:2026"],["ASI04:2026","CWE-506","A08:2025","A03:2025","LLM03:2026","ASI05:2026"],["LLM03:2026","LLM08:2026","LLM10:2026","ASI02:2026","CWE-863"],["A01:2025","LLM02:2026","ASI06:2026","V8","CWE-863"],["LLM01:2026","ASI03:2026","V8","CWE-863"],["CWE-79","LLM07:2026","ASI05:2026","V3","CWE-89","CWE-78"],["LLM07:2026"],["LLM01:2026","LLM02:2026","LLM03:2026","LLM06:2026","LLM08:2026","LLM10:2026","ASI01:2026","ASI02:2026","ASI03:2026","ASI06:2026"],["CWE-770","CWE-400","API4:2023","LLM01:2026","ASI06:2026"],["A03:2025","A08:2025","CWE-502","CWE-494","CWE-829"],[],[],["CWE-829","LLM01:2026","LLM03:2026","ASI01:2026","ASI02:2026","V8","V10","CWE-918","CWE-639","CWE-863"],["CWE-770","LLM06:2026"],[],["CWE-829","ASI04:2026","ASI05:2026","CWE-1357","CWE-250","A03:2025","A08:2025","LLM01:2026","LLM02:2026","LLM03:2026","LLM04:2026","LLM07:2026","LLM10:2026","ASI01:2026","ASI02:2026","ASI03:2026","ASI09:2026","V15"],["LLM10:2026","ASI09:2026","LLM04:2026","ASI06:2026"],["ASI01:2026","ASI09:2026","CWE-94","CWE-250","CWE-770","LLM10:2026","LLM03:2026"],["LLM02:2026","LLM01:2026"],["ASI01:2026","LLM01:2026","LLM09:2026","LLM05:2026","ASI08:2026"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],["LLM02:2026","LLM06:2026","LLM10:2026","CWE-770","A07:2025","A09:2025"],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[]]},"extras":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"stack":["nextjs","next","typescript","ts","tsx","react"],"stackKey":"typescript-nextjs"},0,0,0,{"stack":["nextjs","next","typescript","ts","tsx","react"],"stackKey":"typescript-nextjs"},0,0,0,{"stack":["nodejs","node","express","javascript","js","ejs"],"stackKey":"node-express"},{"stack":["python","flask","jinja","jinja2"],"stackKey":"python-flask"},{"stack":["java","spring","springboot","thymeleaf"],"stackKey":"java-spring"},{"stack":["csharp","dotnet","asp","aspnet","aspnetcore","razor"],"stackKey":"csharp-aspnetcore"},{"stack":["nextjs","next","typescript","ts","tsx","react"],"stackKey":"typescript-nextjs"},{"stack":["fastapi","pydantic","starlette"],"stackKey":"python-fastapi"},{"stack":["django","drf"],"stackKey":"python-django"},{"stack":["go","golang","nethttp"],"stackKey":"go-nethttp"},{"stack":["ruby","rails","ror","erb","activerecord"],"stackKey":"ruby-rails"},{"stack":["php","laravel","blade","eloquent"],"stackKey":"php-laravel"},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"previous":["MASVS-STORAGE","MASVS-CRYPTO","MASVS-AUTH","MASVS-NETWORK","MASVS-PLATFORM","MASVS-CODE","MASVS-RESILIENCE","MASVS-PRIVACY"]},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"previous":["A01:2021","A10:2021","A5:2017"],"cwes":["CWE-22","CWE-23","CWE-36","CWE-59","CWE-61","CWE-65","CWE-200","CWE-201","CWE-219","CWE-276","CWE-281","CWE-282","CWE-283","CWE-284","CWE-285","CWE-352","CWE-359","CWE-377","CWE-379","CWE-402","CWE-424","CWE-425","CWE-441","CWE-497","CWE-538","CWE-540","CWE-548","CWE-552","CWE-566","CWE-601","CWE-615","CWE-639","CWE-668","CWE-732","CWE-749","CWE-862","CWE-863","CWE-918","CWE-922","CWE-1275"]},{"previous":["A05:2021","A6:2017","A4:2017"],"cwes":["CWE-5","CWE-11","CWE-13","CWE-15","CWE-16","CWE-260","CWE-315","CWE-489","CWE-526","CWE-547","CWE-611","CWE-614","CWE-776","CWE-942","CWE-1004","CWE-1174"]},{"previous":["A06:2021","A9:2017"],"cwes":["CWE-447","CWE-1035","CWE-1104","CWE-1329","CWE-1357","CWE-1395"]},{"previous":["A03:2021","A1:2017","A7:2017"],"cwes":["CWE-20","CWE-74","CWE-76","CWE-77","CWE-78","CWE-79","CWE-80","CWE-83","CWE-86","CWE-88","CWE-89","CWE-90","CWE-91","CWE-93","CWE-94","CWE-95","CWE-96","CWE-97","CWE-98","CWE-99","CWE-103","CWE-104","CWE-112","CWE-113","CWE-114","CWE-115","CWE-116","CWE-129","CWE-159","CWE-470","CWE-493","CWE-500","CWE-564","CWE-610","CWE-643","CWE-644","CWE-917"]},{"previous":["A04:2021"],"cwes":["CWE-73","CWE-183","CWE-256","CWE-266","CWE-269","CWE-286","CWE-311","CWE-312","CWE-313","CWE-316","CWE-362","CWE-382","CWE-419","CWE-434","CWE-436","CWE-444","CWE-451","CWE-454","CWE-472","CWE-501","CWE-522","CWE-525","CWE-539","CWE-598","CWE-602","CWE-628","CWE-642","CWE-646","CWE-653","CWE-656","CWE-657","CWE-676","CWE-693","CWE-799","CWE-807","CWE-841","CWE-1021","CWE-1022","CWE-1125"]},{"cwes":["CWE-209","CWE-215","CWE-234","CWE-235","CWE-248","CWE-252","CWE-274","CWE-280","CWE-369","CWE-390","CWE-391","CWE-394","CWE-396","CWE-397","CWE-460","CWE-476","CWE-478","CWE-484","CWE-550","CWE-636","CWE-703","CWE-754","CWE-755","CWE-756"]},{"previous":["API1:2019"]},{"previous":["API3:2019","API6:2019"]},{"previous":["API5:2019"]},0,0,0,{"sections":["V1.1","V1.2","V1.3","V1.4","V1.5"],"requirements":[2,10,12,3,3]},{"sections":["V2.1","V2.2","V2.3","V2.4"],"requirements":[3,3,5,2]},{"sections":["V3.1","V3.2","V3.3","V3.4","V3.5","V3.6","V3.7"],"requirements":[1,3,5,8,8,1,5]},{"sections":["V5.1","V5.2","V5.3","V5.4"],"requirements":[1,6,3,3]},{"sections":["V8.1","V8.2","V8.3","V8.4"],"requirements":[4,4,3,2]},{"sections":["V15.1","V15.2","V15.3","V15.4"],"requirements":[5,5,7,4]},{"sections":["V17.1","V17.2","V17.3"],"requirements":[2,8,2]},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"headings":"Establish the behavior Correct the root cause Prove the fix Close with evidence"},{"headings":"Define the contract Select controls Test abuse and ordinary use Prepare to operate"},{"headings":"Draw the actual system Challenge isolation Prioritize concrete failures Record decisions"},{"headings":"Agree the scope Build a permission matrix Exercise both outcomes Retest and report"},{"headings":"Verify the advisory Determine your exposure Contain and remediate Verify and learn"},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"previous":["A08:2021","A8:2017"],"cwes":["CWE-345","CWE-353","CWE-426","CWE-427","CWE-494","CWE-502","CWE-506","CWE-509","CWE-565","CWE-784","CWE-829","CWE-830","CWE-915","CWE-926"]},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"previous":["A09:2021","A10:2017"],"cwes":["CWE-117","CWE-221","CWE-223","CWE-532","CWE-778"]},{"previous":["API4:2019"]},{"previous":["API7:2019"]},{"previous":["API9:2019"]},{"sections":["V4.1","V4.2","V4.3","V4.4"],"requirements":[5,5,2,4]},{"sections":["V16.1","V16.2","V16.3","V16.4","V16.5"],"requirements":[1,5,4,3,4]},{"previous":["K01:2022"]},{"previous":["K03:2022"]},{"previous":["K04:2022"]},{"previous":["K07:2022"]},0,{"previous":["K09:2022","K10:2022"]},0,{"previous":["K06:2022"]},{"previous":["K05:2022"]},0,0,0,0,0,0,0,0,{"era":"2001","names":["WEP","RC4","FMS"]},{"era":"2012","names":["Flame","MD5"]},{"era":"2013–2014","names":["Lucky Thirteen","Lucky13","POODLE"]},{"era":"2015","names":["FREAK","Logjam","export grade"]},{"era":"2016","names":["DROWN","SSLv2"]},{"era":"2016","names":["Sweet32","3DES","Blowfish","64 bit block"]},{"era":"2017","names":["ROCA","Infineon"]},0,0,0,0,0,0,0,0,0,0,{"stack":["nextjs","next","typescript","ts","tsx","react"],"stackKey":"typescript-nextjs"},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"previous":["A02:2021","A3:2017"],"cwes":["CWE-261","CWE-296","CWE-319","CWE-320","CWE-321","CWE-322","CWE-323","CWE-324","CWE-325","CWE-326","CWE-327","CWE-328","CWE-329","CWE-330","CWE-331","CWE-332","CWE-334","CWE-335","CWE-336","CWE-337","CWE-338","CWE-340","CWE-342","CWE-347","CWE-523","CWE-757","CWE-759","CWE-760","CWE-780","CWE-916","CWE-1240","CWE-1241"]},{"previous":["A07:2021","A2:2017"],"cwes":["CWE-258","CWE-259","CWE-287","CWE-288","CWE-289","CWE-290","CWE-291","CWE-293","CWE-294","CWE-295","CWE-297","CWE-298","CWE-299","CWE-300","CWE-302","CWE-303","CWE-304","CWE-305","CWE-306","CWE-307","CWE-308","CWE-309","CWE-346","CWE-350","CWE-384","CWE-521","CWE-613","CWE-620","CWE-640","CWE-798","CWE-940","CWE-941","CWE-1390","CWE-1391","CWE-1392","CWE-1393"]},{"previous":["API2:2019"]},{"sections":["V6.1","V6.2","V6.3","V6.4","V6.5","V6.6","V6.7","V6.8"],"requirements":[3,12,8,6,8,4,2,4]},{"sections":["V7.1","V7.2","V7.3","V7.4","V7.5","V7.6"],"requirements":[3,4,2,5,3,2]},{"sections":["V9.1","V9.2"],"requirements":[3,4]},{"sections":["V10.1","V10.2","V10.3","V10.4","V10.5","V10.6","V10.7"],"requirements":[2,3,5,16,5,2,3]},{"sections":["V11.1","V11.2","V11.3","V11.4","V11.5","V11.6","V11.7"],"requirements":[4,5,5,4,2,2,2]},{"sections":["V12.1","V12.2","V12.3"],"requirements":[5,2,5]},{"sections":["V13.1","V13.2","V13.3","V13.4"],"requirements":[4,6,4,7]},{"sections":["V14.1","V14.2","V14.3"],"requirements":[2,8,3]},{"previous":["K08:2022"]},0,0,0,0,0,0,0,0,0,0,0,0,0,{"era":"legacy","names":["ECB"]},{"era":"legacy","names":["padding oracle","CBC"]},{"era":"legacy","names":["MD5","SHA-1","SHA1","collision"]},{"era":"legacy","names":["weak RSA","ROCA","weak keys"]},{"era":"legacy","names":["RC4"]},{"era":"legacy","names":["Sweet32","3DES","Blowfish","64 bit block"]},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"headings":"Find the owners Choose a small baseline Make the work repeatable Measure useful outcomes"},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"previous":["LLM01:2025"]},{"previous":["LLM02:2025"]},{"previous":["LLM06:2025"]},{"previous":["LLM03:2025"]},{"previous":["LLM04:2025"]},{"previous":["LLM10:2025"]},{"previous":["LLM09:2025"]},{"previous":["LLM07:2025"]},{"previous":["LLM08:2025"]},{"previous":["LLM05:2025"]},0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,{"guides":[500]},{"guides":[87]},{"guides":[492,493]},{"guides":[498]},{"guides":[81,66]},{"guides":[420,419]},{"guides":[496]},{"guides":[496]},{"guides":[589]},{"guides":[591,599]},{"guides":[593]},{"guides":[49,84]},{"guides":[42,424,417,425]},{"guides":[491]},{"guides":[59]},{"guides":[78,436]},{"guides":[551]},{"guides":[424,599]},{"guides":[87]},{"guides":[373,372]},{"guides":[418]},{"guides":[490,494,507,492]},{"guides":[500,42,56]},{"guides":[491]},{"guides":[508]},{"guides":[56]},{"guides":[42]},{"guides":[563,553]},{"guides":[81]},{"guides":[88]},{"guides":[75]},{"guides":[431,374]},{"guides":[84,61]},{"guides":[58,344]},{"guides":[541]},{"guides":[498]},{"guides":[498]},{"guides":[498]},{"guides":[496,546]},{"guides":[436]},{"guides":[86]},{"guides":[52]},{"guides":[436]},{"guides":[58,60]},{"guides":[372]},{"guides":[58,59]},{"guides":[554,564]},{"guides":[604]},{"guides":[599]},{"guides":[54]},{"guides":[369]},{"guides":[561]},{"guides":[507]},{"guides":[498]},{"guides":[76]},{"guides":[376,91]},{"guides":[561]},{"guides":[86,54]},{"guides":[436,432]},{"guides":[546]},{"guides":[53]},{"guides":[52]},{"guides":[371]},{"guides":[564]},{"guides":[65,64]},{"guides":[436,433]},{"guides":[369,368]},{"guides":[423]},{"guides":[65]},{"guides":[45,64]},{"guides":[501]},{"guides":[597]},{"guides":[429,54]},{"guides":[497]},{"guides":[417]},{"guides":[371]},{"guides":[380]},{"guides":[77]},{"guides":[502,598]},{"guides":[542]},{"guides":[79]},{"guides":[573]},{"guides":[508]},{"guides":[436]},{"guides":[372]},{"guides":[540]},{"guides":[498,473]},{"guides":[546]},{"guides":[546]},{"guides":[590]},{"guides":[546]},{"guides":[497]},{"guides":[564]},{"guides":[593]},{"guides":[591]},{"guides":[60]},{"guides":[500,50]},{"guides":[558]},{"guides":[494]},{"guides":[597]},{"guides":[546,498]},{"guides":[66]},{"guides":[559]},{"guides":[589]},{"guides":[542,491]},{"guides":[605]},{"guides":[546,502]},{"guides":[44]},{"guides":[497,70]},{"guides":[86]},{"guides":[490]},{"guides":[416,422]},{"guides":[421]},{"guides":[65]},{"guides":[492]},{"guides":[426,57]},{"guides":[504,492]},{"guides":[42]},{"guides":[49]},{"guides":[373]},{"guides":[428,539]},{"guides":[589]},{"guides":[51]},{"guides":[84]},{"guides":[58,596]},{"guides":[81]},0,{"guides":[558]},{"guides":[496,541]},{"guides":[589,593]},{"guides":[493]},{"guides":[493,506]},{"guides":[546,491]},{"guides":[497]},{"guides":[564]},{"guides":[497]},{"guides":[497]},{"guides":[82]},{"guides":[421,419]},{"guides":[87]},{"guides":[589,592]},{"guides":[380,367]},{"guides":[76,418]},{"guides":[546,541]},{"guides":[56]},{"guides":[74,80]},{"guides":[599]},{"guides":[598]},{"guides":[606]},{"guides":[81,85]},{"guides":[507,494]},{"guides":[598,593]},{"guides":[428]},{"guides":[503]},{"guides":[503]},{"guides":[598]},{"guides":[598]},{"guides":[427]},{"guides":[561,573]},{"guides":[496]},{"guides":[82]},{"guides":[81]},{"guides":[564,371]},{"guides":[492,508]},{"guides":[498]},{"guides":[492]},{"guides":[83]},{"guides":[54,53]},{"guides":[382]},{"guides":[371,46]},{"guides":[81]},{"guides":[48]},{"guides":[541]},{"guides":[344,58]},{"guides":[494]},{"guides":[61]},{"guides":[491]},{"guides":[562]},{"guides":[88]},{"guides":[491]},{"guides":[492]},{"guides":[498]},{"guides":[503]},{"guides":[589]},{"guides":[73]},{"guides":[373]},{"guides":[502]},{"guides":[52,90]},{"guides":[369]},{"guides":[57]},{"guides":[590]},{"guides":[429,562]},{"guides":[417]},{"guides":[500]},{"guides":[500]},{"guides":[84]},{"guides":[71]},{"guides":[508,492]},{"guides":[44,494]},{"guides":[377]},{"guides":[430]},{"guides":[554]},{"guides":[543,546]},{"guides":[382]},{"guides":[596]},{"guides":[491]},{"guides":[54,53]},{"guides":[53,490]},{"guides":[504]},{"guides":[553]},{"guides":[604,62]},{"guides":[65,77]},{"guides":[65]},{"guides":[369,368]},{"guides":[371]},{"guides":[505]},{"guides":[491]},{"guides":[489]},{"guides":[539,489]},{"guides":[563]},{"guides":[51]},{"guides":[421,419]},{"guides":[490]},{"guides":[490]},{"guides":[490]},{"guides":[418,428]},{"guides":[372]},{"guides":[373]},{"guides":[558,556]},{"guides":[369]},{"guides":[499,427]},{"guides":[344]},{"guides":[552]},{"guides":[504,505]},{"guides":[49]},{"guides":[58,60]},{"guides":[564]},{"guides":[87]},{"guides":[423]},{"guides":[562]},{"guides":[367]},{"guides":[589]},{"guides":[87,45]},{"guides":[44,546]},{"guides":[498]},{"guides":[502]},{"guides":[591]},{"guides":[599]},{"guides":[494,507]},{"guides":[64,87]},{"guides":[379]},{"guides":[79,55]},{"guides":[379,70]},{"guides":[63]},{"guides":[380]},{"guides":[81]},{"guides":[88,52]},{"guides":[590]},{"guides":[376,91]},{"guides":[429]},{"guides":[494]},{"guides":[44]},{"guides":[63]},{"guides":[499]},{"guides":[48]},{"guides":[72]},{"guides":[499,427,436]},{"guides":[415,432]},{"guides":[413,420]},{"guides":[387,5]},{"guides":[4,56]},0,0,0,0,0,0,0,0,0,0,0],"names":"/search-data/a2c337cb7a0cd1ac.json"}