Common Weakness Enumeration Merch

A cool and funny way to remind one of the OWASP guidelines, the A3:2021. This design will guide your developers to follow the best practices to avoid Injections on code no matter it is LDAP, XML, SQL, Command and so on.

A design about the the common weakness enumeration 787 represented in an iconic way. Good for secure coding guideline.

A design about the the common weakness enumeration 78 represented with an icon. This is a good way to concern developers to sanitise any inputs before using them to run any OS command.

The CAPTCHA is annoying for us as humans, but it could be a great way to stop automatic attacks or bots like brute force, CSRF or even XSS attacks.

This should be the input validation steps that the code must do to avoid processing harmful untrusted data.

A cool and funny way to remind one of the OWASP guidelines, the A5:2021 security misconfiguration. This design will guide your developers to follow the best practices and mitigate the risks of any default settings or credentials.

Threat modeling should be a mainstream activity for every current and new designs to better understand which could be the threats and which could be the security measures to mitigate the risk.

A design made for providing guidance to CSRF attack prevention. If it is not prevented adequately, it may leave attackers to trigger undesired actions from victims' browser like performing inadvertent transactions on your website.

A reminder for developers to review commented code and take care of it to avoid disclosing secrets or giving hints to a malicious actor. After all secure coding.

Awareness design to remind the importance of validating zip files before decompressing it like limiting the number of files, the decompressed size and a maximum decompressed file size.

An awareness design to tell your peer developers to implement input validation to prevent injection, buffer overflows, denial of service or even log sanitisation.

Besides input validation which avoids processing any untrusted data by the application, it is important to perform output validation when writing logs, not only to avoid disclosing any sensitive information but also to prevent local file inclusion attacks.

A shield design of the input validation steps that developers should do in the methods or functions that manipulates untrusted data. This is one of the best practice of OWASP for secure coding.

APP Security Engineer is a Cool design of this role tittle. If you are this kind of cybersecurity professional, your duty is to reduce the risk as much as possible in code and dependencies. Also you'll enact activities like threat modelling, malware scanning, secure coding practices and correct secret management. This is a design version with black background.

A design about the the common weakness enumeration 79 represented in an iconic way. Good for secure coding guideline and awareness to avoid being vulnerable to XSS attacks.

HTTPOnly flag for cookies should be a must. This avoids other unwanted usages of cookies from your browser like scripts and only restricts its usage for HTTP.

This design reminds to the developer the importance of using defensive copy instead of clone. It will reduce the risk of data compromise.

HSTS is a must when it comes to securing web application HTTPS connections. So, if there is no HSTS header, no deal.

This should be the input validation steps that the code must do to avoid processing harmful untrusted data. This is a black background with white letters design version.

The design is about one of the guidelines provided by OWASP, to put in place security measures to restrict the import or usage of packages with known vulnerabilities.

A cool and funny way to remind one of the OWASP guidelines, the A6:2021 vulnerable and outdated components. This design will guide your developers to follow the best practices and mitigate the risks of using any vulnerable or old dependencies in the software.

Insecure deserialisation could lead to remote code execution if no proper validation is done previously.

This should be the input validation steps that the code must do to avoid processing harmful untrusted data.

In case that x-powered-by header is delivered by your service, override it with misleading information to make attackers life harder like "Not Your Business 1.0"

This is one of the best practice which is a must when developing any web server that provides cookies. With the secure flag assigned on cookies, it will only be transferred through HTTPS.

Developers are under great pressure with aggressive delivering dates but, one of the most important things that they shouldn't overlook, is to applying input validation in the functions or methods.

Normally, any authentication through a website is done through HTTP POST method since a form is needed with login information. This could minimise the risk of disclosing the credentials when your browser stores the URL in plan text or even being written in logs on the server side.

A cool and funny way to remind one of the OWASP guidelines, the A1:2021. This design will guide your developers to follow the best practices for broken access control.

To protect from file upload attacks on your website that could leave attackers to upload malicious software or backdoors, here's some of the protections to prevent such attacks.

One of the recommendations of secure coding is to practice pair programming, because 4 eyes catches more than 2 and it is a good way to share context and knowledge between coworkers.

OWASP is a foundation that provides trainings, guidelines and useful tools for cybersecurity professionals to make the internet a safe place.

A cool and funny way to remind one of the OWASP guidelines, the A2:2021. This design will guide your developers to follow the best practices for cryptographic failures.

Never forget to handle a potential exception thrower code to avoid any undesired web application status. Run the code within a try and process the error on the catch section.

DevSecOps is an approach to software development that integrates security into the DevOps process, with the goal of delivering secure, high-quality software at a faster pace. A minimalist DevSecOps design would involve a streamlined, focused approach to security, with an emphasis on simplicity and efficiency.

One of the best practices stated in OWASP is to allow only to use local static DTD when processing XML to avoid XXE attacks.

A security funny awareness design to remind developers that secrets, passwords or api tokens is not a good practice.