Application Security
15 items tagged with "application-security"
Best Practices13
OWASP Top 10 (2023)
The ten most critical web application security risks; updated community consensus.
OWASP Application Security Verification Standard (ASVS)
A framework of security requirements that defines testable controls for designing, building, and verifying secure web applications and services.
OWASP API Security Top 10 (2023)
A ranked list of the most critical security risks specific to APIs, covering broken authorization, authentication, and unsafe resource consumption.
OWASP Mobile Application Security Verification Standard (MASVS)
A standard of security requirements for mobile apps, covering storage, cryptography, authentication, network communication, and platform interaction.
CWE Top 25 Most Dangerous Software Weaknesses
An annually updated list of the most common and impactful software weaknesses, derived from real-world vulnerability data, to guide prevention and prioritization.
STRIDE Threat Modeling
A structured method for finding security threats by category, spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
OWASP Secure Headers Project
Guidance and recommended values for HTTP response security headers that harden web applications against common client-side attacks.
AI Red Teaming
AI red teaming is structured adversarial testing of AI systems to find harmful, biased, or insecure behavior before attackers or real users do, using crafted attacks and probes.
OWASP Top 10 for LLM Applications (2025)
The OWASP Top 10 for LLM Applications lists the most critical security risks for generative AI systems, including prompt injection, sensitive data disclosure, and supply chain risk.
Prompt Injection Defense
Prompt injection defense protects LLM applications from attacks that hide malicious instructions in user input or retrieved content to override the system's intended behavior.
OAuth 2.0 and OpenID Connect
OAuth 2.0 delegates authorization via access tokens; OpenID Connect adds an identity layer for authentication. Together they secure API access and single sign-on.
Content Security Policy (CSP)
A W3C security standard delivered via an HTTP header that controls which sources a browser may load, mitigating cross-site scripting and data injection attacks.
Static Application Security Testing in CI
Integrating SAST tools into the CI pipeline to scan source code for security vulnerabilities automatically on every change.
Benchmarks2
SAST/DAST Detection Rate Benchmark
Measures how accurately static and dynamic application security testing tools find real vulnerabilities, reporting true-positive, false-positive, and recall rates.
Secrets Detection Accuracy Benchmark
Measures how accurately tools find leaked credentials in code and history, reporting recall, precision, and false-positive rate across secret types.