Secure Coding
12 items tagged with "secure-coding"
Best Practices12
OWASP Top 10 (2023)
The ten most critical web application security risks; updated community consensus.
OWASP Application Security Verification Standard (ASVS)
A framework of security requirements that defines testable controls for designing, building, and verifying secure web applications and services.
OWASP API Security Top 10 (2023)
A ranked list of the most critical security risks specific to APIs, covering broken authorization, authentication, and unsafe resource consumption.
OWASP Mobile Application Security Verification Standard (MASVS)
A standard of security requirements for mobile apps, covering storage, cryptography, authentication, network communication, and platform interaction.
CWE Top 25 Most Dangerous Software Weaknesses
An annually updated list of the most common and impactful software weaknesses, derived from real-world vulnerability data, to guide prevention and prioritization.
Microsoft Security Development Lifecycle (SDL)
A set of security practices integrated across every phase of software development, from training and design through implementation, verification, and response.
OWASP Secure Headers Project
Guidance and recommended values for HTTP response security headers that harden web applications against common client-side attacks.
Secrets Management Best Practices
Practices for storing, rotating, and accessing credentials and keys securely, keeping them out of source code and limiting their exposure.
Pre-Commit Hooks Automation
Automating checks such as formatting, linting, and secret scanning that run on every Git commit, catching issues locally before they ever reach the shared repository.
Prompt Injection Defense
Prompt injection defense protects LLM applications from attacks that hide malicious instructions in user input or retrieved content to override the system's intended behavior.
Content Security Policy (CSP)
A W3C security standard delivered via an HTTP header that controls which sources a browser may load, mitigating cross-site scripting and data injection attacks.
Static Application Security Testing in CI
Integrating SAST tools into the CI pipeline to scan source code for security vulnerabilities automatically on every change.