Language-specific secure coding guidelines. Every entry follows the same template: Threat, Insecure example, Why it fails, Secure example, Notes, References.
- Common pitfalls — recurring mistakes across stacks
- Input validation
- Output encoding
- Cryptography: do and don't
- Authentication
- Authorization
- Session management
- Error handling and logging
- Secrets handling
- Insecure deserialization
- Java — JDK 17+
- Python — Python 3.11+
- Go — Go 1.21+
- JavaScript and TypeScript — Node 20+
See the contributing guide for the file template and PR validation checklist.