Secure defaults and frameworks

Ship without debug modes, verbose errors or exposed files

Turn off debug output, publish an allowlisted build and probe each deployment for exposed files and endpoints.

Development · Developers, Platform engineers and SREs

Preserve framework security controls across the request lifecycle

Trace middleware, persistence and rendering so custom code does not bypass the protections supplied by the framework.

Development · Developers, AppSec engineers

Prevent DOM XSS, postMessage abuse and client-side injection

Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.

Development · Developers, AppSec engineers

Configure HTTP security headers from a tested baseline

Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.

Development · Developers

Secure design patterns: a catalogue for insecure-design (A06)

A catalogue of reusable secure-design patterns, grouped by concern, each with when to use it, a short example and the failure it prevents: choke-point authorization, capability tokens, parse-don't-validate, safe-by-default APIs, tenant scoping, fail-closed, idempotency, and more.

Design · AppSec engineers

Secure the developer workstation: extensions, package managers, secrets and AI agents

Attackers reach the software supply chain through developers' editors, package installs and AI agents. Allow-list extensions, stop install scripts and brand-new versions, keep long-lived secrets off laptops, and lock down repository files that run code when a project opens.

Design, Development, Release · Developers, AppSec engineers, Platform engineers and SREs

Harden the images you ship against CIS, STIG and SCAP benchmarks

Hold each image your team ships (container base images, golden VM images, Kubernetes node images) to a published benchmark through a pinned SCAP Security Guide profile, scan every build with OpenSCAP, and fail the build on any failure that a deviation register does not explain with an owner, an approver and an expiry.

Development, Release, Maintenance, Security program · Developers, AppSec engineers, Platform engineers and SREs

Apply CISA Secure by Design: principles, pledge goals and evidence

What CISA's Secure by Design guidance and pledge ask of software manufacturers as of October 2026, and how to turn each of the three principles, the seven pledge goals and the Product Security Bad Practices into engineering actions, metrics and evidence.

Security program · AppSec engineers, Security leaders

UK Software Security Code of Practice: the 14 principles as engineering practice

What the UK government's voluntary Software Security Code of Practice (May 2025) asks of software vendors, each of its 14 principles mapped to engineering practice, NIST SSDF and the EU Cyber Resilience Act, and a CI check for the support-period principles.

Maintenance, Security program · AppSec engineers, Security leaders

CSP builder lab: Build a strict Content-Security-Policy

A page sends a Content-Security-Policy whose script-src allows any HTTPS origin, so an injected external script runs despite the nonce. Repair the builder so it produces a strict nonce-based policy from the document’s declared needs.