security
Practical resources about security for software engineers.
109 results
Protecting Applications and Data
Security is not a checkbox — it is a mindset. From input validation and XSS prevention to secrets management and compliance frameworks, every layer of the stack needs defensive design.
Browse recipes for implementing Content Security Policy, encrypting data at rest and in transit, managing API keys, and conducting dependency audits. Guides also cover OWASP Top 10 mitigations and secure coding practices by language.
Penetration Test Report Template with Remediation
Document security assessment findings with this penetration test report template — risk ratings,...
Complete Guide to LLM Security
A practical playbook for securing LLM apps in production: prompt injection, jailbreaks, data...
Complete Guide to GraphQL Security
Secure a production GraphQL API: introspection control, depth and cost limits, rate limiting,...
CI/CD Pipeline Security: Prevent Supply Chain Attacks
A practical guide to securing CI/CD pipelines: secrets management, least-privilege runners,...
Complete Guide to Docker in Production
Run Docker in production: multi-stage builds, distroless images, health checks, scanning, resource...
Incident Response Process: Step-by-Step Guide
Step-by-step incident response process: severity levels, incident commander roles, communication...
Disaster Recovery: RTO, RPO, and Resilient Recovery Runbooks
A practical guide to disaster recovery planning: defining RTO and RPO, backup strategies,...
API Security Checklist — Authentication to Encryption
A thorough security checklist for APIs: authentication, authorization, input validation, rate...
Complete Guide to API Security
Secure your APIs end-to-end: rate limiting, auth, input validation, CORS, injection prevention,...
Complete Guide to Authentication Patterns
Implement production authentication: JWT, OAuth2, sessions, passkeys, MFA, SAML and OIDC SSO, RBAC...
Content Security Policy: CSP Headers, Nonces, Hashes
Deploy Content Security Policy without breaking your site: directives, nonces, hashes,...
CORS Security: Origins, Headers, Preflight, Credentials
How CORS actually works: same-origin policy, preflight requests, CORS headers, credential handling,...
Encryption at Rest: AES-256, KMS, Envelope Encryption
Encrypt stored data correctly: AES-256-GCM, KMS-managed keys, envelope encryption, key rotation,...
OAuth2 and OIDC: Authorization Code, PKCE, Token Validation
Implement OAuth2 and OIDC in production: PKCE authorization code flow, JWKS token validation,...
Complete Guide to OWASP Top 10 2025
Mitigate each risk in the OWASP Top 10 2025 list with practical code examples. Covers the new...
Complete Guide to Secrets Management
Manage application secrets securely in production: Vault, AWS, Azure, GCP, Kubernetes secrets,...
Complete Guide to Supply Chain Security
Secure your software supply chain end-to-end: SBOMs, dependency scanning, Sigstore signing, SLSA...
Complete Guide to Web Security Headers
Implement CSP, HSTS, X-Frame-Options, and secure headers. Covers content security policy, CORS,...
GDPR Compliance — A Practical Guide for Developers
A developer-focused guide to GDPR compliance: data subject rights, lawful basis, data minimization,...
SOC 2 Compliance — Basics for Engineering Teams
A practical guide to SOC 2 Type II for developers: Trust Service Criteria, evidence collection,...
No results found.