OWASP Cheat Sheet Series: concise guides to building applications securely

OWASP Cheat Sheet Series (about 34,000 stars on GitHub) is an OWASP project that collects practical guidance on specific security topics in a form developers can read in a few minutes. The series began on the OWASP wiki in 2009 and moved to GitHub in 2018, where it is now maintained by Jim Manico, Jakub Maćkowski and other project leads with hundreds of contributors. The repository holds more than a hundred Markdown files, and the same content is published as a website at cheatsheetseries.owasp.org.

What a cheat sheet contains

Each sheet takes one topic and states what to do, with short explanations and code examples where they help. The authentication sheet, for example, covers password storage, rate limiting, error messages that do not reveal whether a username exists, and multi-factor options; the input validation sheet distinguishes syntactic from semantic checks and warns against relying on blocklists. Other sheets cover session management, cross-site scripting prevention, SQL injection prevention, cryptographic storage, secrets management, logging, file uploads, REST and GraphQL APIs, Docker security, Kubernetes, and framework-specific notes for Django, Node.js, .NET, Java and others. Index pages map the sheets to the OWASP Top 10 and to the Application Security Verification Standard, so a team can go from a finding to the matching guidance.

Who it is for

• Developers who need the right answer for one concrete question, such as how to hash a password or where to store a token, without reading a book.
• Code reviewers who want a reference to link in a review comment.
• Teams writing their own secure coding guidelines, who can adopt the sheets rather than start from scratch.
• Students and new security engineers building a working knowledge of application security.

How to browse it

The website is the easiest way to read; the repository is the place to open an issue or propose a correction. A local clone is useful for grepping across all sheets at once:

git clone --depth 1 https://github.com/OWASP/CheatSheetSeries.git
grep -ril "content security policy" CheatSheetSeries/cheatsheets/

Changes go through pull requests with review by the project leads, and the site rebuilds automatically, so the Markdown in the repository is always the current version.

Credit

The series is maintained by the OWASP Cheat Sheet Series project leads and contributors under the OWASP Foundation. The content is published under the Creative Commons Attribution-ShareAlike 4.0 licence.