Where it usually goes wrong
- Someone reviews your code and says it has a security bug, and you feel lost.
- Words like XSS, CSRF, and injection sound scary and hard.
- You want to grow, but you do not know where to start.
Learn the common attacks, one at a time
You do not need to learn everything at once. Understand these few ideas and you will already be ahead of most beginners. Each guide is written in plain words with real examples.
Injection and cross site scripting
These happen when user input is treated as code. They are the most common web bugs, so start here. Read what is cross site scripting and SQL injection. Reference: MDN Web Security.
How login attacks work
Learn how attackers guess and reuse passwords, and why a second step at sign in stops them. Read the three password attacks compared and multi factor authentication. Reference: OWASP Authentication Cheat Sheet.
Cross site request forgery
Learn how one site can make a request run on another in your name, and the simple ways to stop it. Read CSRF explained. Reference: OWASP CSRF Cheat Sheet.
Keeping data and secrets safe
Learn why passwords must be hashed, and why keys should never sit in your code. Read password hashing and secrets management. Reference: OWASP Password Storage Cheat Sheet.
See the big picture: the OWASP Top 10
The OWASP Top 10 is the list of the most common security risks on the web. It is the map every security person uses. Explore it in a friendly way with our ASVS Explorer, and see the full list at OWASP Top 10.
Practice, do not just read
Security clicks when you use it. Train your eye to spot bugs the way a reviewer does.
- Play the Spot the Vulnerability quiz to find bugs in real code.
- Try the JWT Decoder to see what a token actually holds.
- Work through the Security Checklist on your own project.
When you build a real app
Some parts of security are easy to get wrong, even for seniors. When you build a real project, our libraries handle those parts for you so you can focus on your app. OwlAuth protects login, and OwlTokenGuard manages tokens the right way.
Two ways we help
Learn: read the plain English guides and explore the standard in the free OWASP toolkit.
Build: when you are ready, add our libraries and learn from how they work.