Security resources for developers

A nine-stage path for securing LLM apps and AI agents, or testing them as a red-teamer, with one path for each: security foundations, how LLM apps break, the OWASP LLM and agentic lists and MITRE ATLAS, layered defences against prompt injection, agent, tool and MCP security, the data and model supply chain, red-teaming and security evals, monitoring and incidents, and a route into the work. It suits developers and security learners who can already build. By the end you have a practice app defended or assessed end to end.

• AI
• Security
• Testing
• Career

A release checklist for web apps and APIs, organised around the OWASP Top 10:2025 and the OWASP cheat sheets. Each check tells you how much it matters and exactly how to confirm it is done, from access control and sessions to headers, dependencies, logging and file uploads.

• Security

A practical guide to threat modeling for development teams who want it to be a normal part of design, not a yearly workshop. It covers the four questions, data flow diagrams and trust boundaries, STRIDE and abuse cases, rating and responding to threats, turning them into tickets and tests, keeping models current, and threat modeling features built on language models and agents.

• Security
• Backend
• AI

A supply chain security checklist you can run against a real repository and its pipeline. It covers what you install (lockfiles, pinning, install scripts, update bots, dependency review), how you build (CI permissions, secrets, actions pinned by SHA, protected branches) and what you ship (SLSA provenance, Sigstore signatures, SBOMs, registry publishing), plus a drill for the day a package you depend on is compromised.

• Security
• DevOps

A practical guide to secure coding for developers who write server-side code in TypeScript, Node.js or Python. It covers trust boundaries and input validation, injection of every kind, output encoding, safe parsing and deserialization, file uploads, path traversal, server-side request forgery, error handling that fails closed, and dependency hygiene, mapped to the OWASP Top 10:2025 and ASVS 5.0.

• Security
• Backend
• Programming

A practical guide to secrets management for developers who build and deploy apps. It covers where secrets should live, keeping them out of git and catching leaks, least privilege, rotation, CI/CD with OIDC instead of long-lived keys, what the browser can and cannot see, log redaction, and what to do in the first hour after a leak.

• Security
• DevOps

A mobile app security checklist for Android, iOS, Flutter and React Native apps, organised by the eight OWASP MASVS categories. Every check says how much it matters and how to verify it on a real build, using platform tools or the techniques in the OWASP Mobile Application Security Testing Guide.

• Mobile
• Security

A Linux server hardening checklist for a VPS or cloud VM that runs your app. It covers user accounts and sudo, SSH, security updates, open ports and the firewall, system settings and permissions, logging, and checking the result against a CIS benchmark, with a command to verify every check.

• Security
• DevOps
• Cloud

A pre-launch verification list for a workload going to production on Kubernetes, and for the cluster it lands on. Each check has a severity and a command or test that proves it, covering cluster version and access, resources, probes, availability, Pod security, RBAC and network policy, secrets and images, autoscaling, and backups of cluster state.

• DevOps
• Cloud
• Security

An incident response checklist for software teams, covering both outages and security incidents. It walks through preparation, detecting and declaring an incident, roles and coordination, mitigation, security containment and evidence, communication, and closing with a blameless postmortem, with a way to check each item before you need it.

• DevOps
• Security
• Cloud

A practical checklist for engineering and product teams whose AI systems reach people in the EU. It walks through whether the AI Act applies to you and in which role, the prohibited practices, high-risk classification, transparency duties, general-purpose AI model obligations, deployer and provider duties for high-risk systems, and the dates each part applies, with a severity and a verification step for every check.

• AI
• Security

A backup and disaster recovery checklist for teams running production systems in the cloud or on their own hardware. It covers recovery objectives per system, backup coverage, isolated and immutable copies, restore testing, zone and region strategy, runbooks, drills, dependencies and communication, each with a severity and a concrete way to verify it.

• DevOps
• Cloud
• Security

A practical checklist for engineers and analysts who store, query, move or share personal data. It covers knowing which rules apply, data inventory and mapping, minimization, PII classification, masking and pseudonymization, retention and deletion, access control, cross-border transfers, logging, vendor sharing and breach readiness. It is general guidance, not legal advice.

• Security
• Data

A practical cryptography guide for application developers, not cryptographers. It covers choosing the right primitive and a high-level library, authenticated encryption and nonces, secure randomness, key management with KMS and rotation, TLS configuration, and how to prepare for post-quantum algorithms with crypto agility.

• Security
• Backend

A practical guide to browser security for web developers. It explains how cross-site scripting happens in modern frameworks and how Trusted Types and a strict Content Security Policy contain it, how to configure CORS without opening your API, which cookie attributes and prefixes to use, how to stop CSRF and clickjacking, which security headers matter, and how to load third-party scripts and talk between windows safely.

• Security
• Frontend
• Web

An AWS account security checklist for teams that run real workloads on AWS without a dedicated security team. It covers the root user, human and workload access, multi-account guardrails, CloudTrail and threat detection, S3 and data protection, EC2 and network exposure, and readiness for a leaked key, with an AWS CLI command or console check for each item.

• Cloud
• Security
• DevOps

A practical guide to authorization for developers who build apps where users should only see and change some of the data. It covers deny by default and server-side checks, object-level authorization against IDOR and BOLA, choosing between RBAC, ABAC and ReBAC, multi-tenant isolation with row-level security, policy engines, admin and support access, auditing, and testing that permissions actually hold.

• Security
• Backend

A practical guide to authentication for developers who build their own sign-in or need to review one. It covers password rules and storage, the login flow and brute force protection, multi-factor authentication, passkeys, session handling, and account recovery, following NIST SP 800-63B-4 and the OWASP cheat sheets.

• Security
• Backend

An API security checklist you can run against a real codebase before a release. It is built on the OWASP API Security Top 10 (2023 edition) and the OWASP cheat sheets, and every check says how much it matters and exactly how to verify it.

• Security
• Backend

A security checklist for teams putting AI agents and MCP servers into production. It covers tool inventory and least privilege, authentication and authorization for MCP servers, prompt injection that arrives through tool output, human approval for risky actions, sandboxed code execution, secrets handling, logging and incident response, and the supply chain of the MCP servers your agents load, each with a severity and a way to verify it.

• AI
• AI agents
• Security

A revision reference for securing and testing LLM apps and AI agents, in 9 chapters and two editions (app and agent security, red-teaming): security foundations, how LLM apps break, the OWASP LLM and agentic lists, MITRE ATLAS, prompt injection and guard layers, agent, tool and MCP security, the data and model supply chain, red-teaming tools and evals, monitoring and incidents, and career routes. It follows the Sefism AI security roadmap chapter by chapter, with no attack payloads.

• AI
• Security
• Testing

The UK Information Commissioner's Office guidance on applying data protection law to AI: accountability and DPIAs, lawfulness, accuracy, fairness and bias, security, data minimisation and individual rights. Under review after the Data (Use and Access) Act 2025.

• AI
• Security

An open source toolkit, started at Microsoft and now community maintained, that detects personal data such as names, phone numbers and card numbers in text and images, then redacts, masks, replaces, hashes or encrypts it.

• AI
• Security
• Programming

A free guide from the OpenSSF Best Practices and AI/ML working groups on writing instructions that make AI coding assistants produce more secure code: secure coding principles, supply chain security, platform and language-specific rules, standards to reference, and sample instructions you can adapt for your own project.

• AI
• Security