8 Lessons, Kick-start Your Cybersecurity Learning.
Vulnerable app with examples showing how to not use secrets
OWASP Community Pages are a place where OWASP can accept community contributions for security-related content.
vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.
ZAP Add-ons
A vulnerable version of Rails that follows the OWASP Top 10
In progress rough solutions to bWAPP / bee-box
OWASP Code Review Guide Web Repository
OWASP Zed Attack Proxy project landing page.
The OWASP Vulnerable Web Applications Directory Project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available.
OWASP Foundation Threat Dragon Project Web Repository
Curated cyber security resources for blue team, red team, DFIR, OSINT, AppSec, cloud security, security logging, and training.
The source of ZAP website
OWASP Citizen Development Top 10
Integrates OWASP Zed Attack Proxy reports into SonarQube
See why a web vulnerability works, not just how to trigger it — a single-file, zero-dependency security lab that renders a vulnerable app as a 7-layer cross-section. 17 labs, attacker & defender modes, AI-authorable.
Agentic AI for DevSecOps: Transforming Security with GitHub Advanced Security and GitHub Copilot. GitHub Advanced Security - DevSecOps Guidelines - Unified visibility into DevOps security posture. DevSecOps E2E Demos.
Claude Code skill + 18 AI agents for Android & iOS mobile app security audits. OWASP MASVS/MASTG-aligned, with adversarial exploitation confirmation.
To associate your repository with the appsec topic, visit your repo's landing page and select "manage topics."