A curated list of books, articles, websites, and tools for learning application security across multiple programming languages.
Awesome AppSec is a curated GitHub repository that aggregates learning resources for application security. It provides a structured collection of books, articles, websites, tools, and vulnerable applications to help developers and security professionals understand and mitigate software vulnerabilities. The project covers topics ranging from secure coding practices and cryptography to platform-specific guidance for languages like PHP, Node.js, and Python.
Developers, DevOps engineers, security researchers, and students seeking to learn or improve their knowledge of application security principles and practices. It is especially valuable for those building or securing web applications across various technology stacks.
It saves time by vetting and organizing high-quality security resources in one place, eliminating the need to scour the internet. The list is community-maintained, ensuring it stays current with evolving threats and best practices across multiple programming ecosystems.
A curated list of resources for learning about application security
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Includes dedicated sections for PHP, Node.js, Python, Java, and more, as shown in the README's structured categorization, making it versatile for multi-stack developers.
Features vulnerable applications like Juice Shop and NodeGoat, along with capture-the-flag exercises, providing practical, safe environments for skill development.
Maintained by Paragon Initiative Enterprises with community contributions, ensuring resources are curated for relevance and quality, as noted in the philosophy.
Most resources, such as articles and open-source tools, are free, lowering barriers for learners, though some books are marked as non-free.
Some listed books and articles date back to the 1990s or early 2000s (e.g., 'C Interfaces and Implementations' from 1996), which may not reflect current security practices or vulnerabilities.
Serves as a static reference list rather than an interactive platform; users must independently seek out and engage with external resources, which can be inefficient for beginners.
While curated, the list doesn't guarantee the accuracy or effectiveness of every resource, leaving verification to the user, and some entries lack detailed descriptions.