The vendor-neutral software security reference

Security at every step of your SDLC

The 34 security practices a development team needs across a traditional software development lifecycle, from planning to maintenance. Check which ones your team has, then open any practice for what it is, the first steps and how to tell it is done.

Check your gaps Download the checklist (Markdown)

Root causes and new requirements feed the next cycle

Around every phase

The security practices that belong in each phase of a traditional software development lifecycle, whether a phase is a project stage, a sprint or one pull request. Select a practice for what it is, how to start and how to tell it is done.

213 guides
188 fix cards
38 browser labs
22 local projects

More ways in

Start from what you have

A finding or an ID

Fix it in your stack

The vulnerable code, the fix, a plausible fix that still fails and the tests that tell them apart: 188 cards for 30 weaknesses.

All fix cards

A task to do

Cited to primary sources
Code proved by tests
No account, analytics or ads
CC BY 4.0 text, MIT code

How the guides are made