security
Practical resources about security for software engineers.
109 results
Protecting Applications and Data
Security is not a checkbox — it is a mindset. From input validation and XSS prevention to secrets management and compliance frameworks, every layer of the stack needs defensive design.
Browse recipes for implementing Content Security Policy, encrypting data at rest and in transit, managing API keys, and conducting dependency audits. Guides also cover OWASP Top 10 mitigations and secure coding practices by language.
Penetration Test Report Template with Remediation
Document security assessment findings with this penetration test plan template, including risk...
Complete Guide to LLM Security
Secure LLM applications in production. Covers prompt injection, jailbreaks, data leakage, OWASP Top...
Complete Guide to GraphQL Security
Secure GraphQL APIs against introspection leaks, query depth attacks, cost-based DoS, batching...
CI/CD Security: Harden Your Pipelines and Prevent Supply
A practical guide to securing CI/CD pipelines: secrets management, least-privilege runners,...
Complete Guide to Docker in Production
Run Docker containers in production with confidence. Covers multi-stage builds, distroless images,...
Incident Response: Structured Handling for Production
A practical guide to incident response: declaring incidents, building an incident command...
Disaster Recovery: RTO, RPO, and Resilient Recovery Runbooks
A practical guide to disaster recovery planning: defining RTO and RPO, backup strategies,...
API Security Checklist — Authentication to Encryption
A thorough security checklist for APIs: authentication, authorization, input validation, rate...
Complete Guide to API Security
Secure your APIs end-to-end. Covers rate limiting, authentication, input validation, CORS, SQL...
Complete Guide to Authentication Patterns
Implement authentication in production. Covers JWT, OAuth2, session-based auth, passkeys, MFA,...
Content Security Policy: CSP Headers, Nonces, Hashes
Master Content Security Policy: CSP directives, nonces, hashes, reporting, strict-dynamic,...
CORS Security: Origins, Headers, Preflight, Credentials
Master CORS security: same-origin policy, CORS headers, preflight requests, credential handling,...
Encryption at Rest: AES-256, KMS, Envelope Encryption
Master encryption at rest: AES-256-GCM, key management services, envelope encryption, key rotation,...
OAuth2 and OIDC: Authorization Code, PKCE, Token Validation
Master OAuth2 and OpenID Connect for production: authorization code flow with PKCE, token...
Complete Guide to OWASP Top 10 2025
Mitigate each OWASP Top 10 2025 risk with practical code examples. Covers broken access control,...
Complete Guide to Secrets Management
Manage application secrets securely in production. Covers HashiCorp Vault, AWS Secrets Manager,...
Complete Guide to Supply Chain Security
Secure your software supply chain end-to-end. Covers SBOM generation, dependency scanning,...
Complete Guide to Web Security Headers
Implement CSP, HSTS, X-Frame-Options, and secure headers. Covers content security policy, CORS,...
GDPR Compliance — A Practical Guide for Developers
A developer-focused guide to GDPR compliance: data subject rights, lawful basis, data minimization,...
SOC 2 Compliance — Basics for Engineering Teams
A practical guide to SOC 2 Type II for developers: Trust Service Criteria, evidence collection, and...
No results found.