A curated list of books, articles, websites, and tools for learning application security across multiple programming languages.
Awesome AppSec is a curated GitHub repository that collects high-quality resources for learning about application security. It includes books, articles, websites, blog posts, and self-assessment quizzes covering general security principles and language-specific secure coding practices. The project aims to make security education more accessible and organized for developers.
Developers, security engineers, and students who want to learn or improve their knowledge of application security, secure coding practices, and common vulnerabilities across various programming languages and platforms.
It provides a single, well-organized source of trusted security learning materials, saving time compared to scattered searches, and is maintained by security professionals with community contributions to ensure quality and relevance.
A curated list of resources for learning about application security
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Aggregates high-quality materials like the 'Web Application Hacker's Handbook' and OWASP Top Ten wiki, providing a trusted starting point for learners without scattered searches.
Includes language-specific secure coding standards, such as SEI CERT guides for Java and C, and PHP articles on timing attacks, enabling targeted learning across tech stacks.
Maintained by Paragon Initiative Enterprises with community contributions, ensuring diverse perspectives and ongoing updates, as seen in the contributing guide.
Offers gentle introductions like 'A Gentle Introduction to Application Security' and structured topics, lowering the barrier for newcomers to appsec.
Many listed books and articles are old, such as 'Cryptography Engineering' (2010) and 'The Art of Software Security Assessment' (2006), which may not reflect modern threats or best practices.
The repository relies on periodic community contributions without automated versioning, leading to potential staleness and gaps in recent security developments.
Numerous resources are marked as non-free (e.g., books with paywalls), which can restrict access for users on tight budgets or in educational settings.