Secure Coding Magnets

The CAPTCHA is annoying for us as humans, but it could be a great way to stop automatic attacks or bots like brute force, CSRF or even XSS attacks.

Devops is one of the best ways to follow the agile methodology but, if you include cybersecurity in such mechanisms, it becomes DevSecOps which is a good way to discover vulnerabilities and flaws in the code in earlier development stages in an automated basis.

OWASP is a foundation that provides trainings, guidelines and useful tools for cybersecurity professionals to make the internet a safe place.

This design represents some of the security controls that you might want to put in place in order to practice layered defense. You may find TLS, secure coding, IAM, pentesting, antispam and patching.

OWASP is a foundation that provides trainings, guidelines and useful tools for cybersecurity professionals to make the internet a safe place. This is a black background with white letters design version.

Want to avoid the undesired clickjacking attack on your website? Then X-Frame-Options should be one of the headers to respond with sameorigin value. Or you can make it even more restrictive with deny. The result is avoiding any eventual attacker to use hidden frames to compromise the website user. This is a black background with white letters design version.

In case that x-powered-by header is delivered by your service, override it with misleading information to make attackers life harder like "Not Your Business 1.0". This is a black background with white letters design.

HSTS is a must when it comes to securing web application HTTPS connections. So, if there is no HSTS header, no deal. This is a black background with white letters design.

HTTPOnly flag for cookies should be a must. This avoids other unwanted usages of cookies from your browser like scripts and only restricts its usage for HTTP. Black background with white letters design version.

A cool and funny way to remind one of the OWASP guidelines, the A1:2021. This design will guide your developers to follow the best practices for broken access control.

HTTPOnly flag for cookies should be a must. This avoids other unwanted usages of cookies from your browser like scripts and only restricts its usage for HTTP.

Threat modeling should be a mainstream activity for every current and new designs to better understand which could be the threats and which could be the security measures to mitigate the risk.

Threat modeling should be a mainstream activity for every current and new designs, to better understand which could be the threats and which could be the security measures to mitigate the risk. This is a black background with white letters design version.

Insecure deserialisation could lead to remote code execution if no proper validation is done previously.

A shield design of the input validation steps that developers should do in the methods or functions that manipulates untrusted data. This is one of the best practice of OWASP for secure coding.

This is one of the best practice which is a must when developing any web server that provides cookies. With the secure flag assigned on cookies, it will only be transferred through HTTPS. Black background with white letters design version.

Awareness design to remind the importance of validating zip files before decompressing it like limiting the number of files, the decompressed size and a maximum decompressed file size.

This is one of the best practice which is a must when developing any web server that provides cookies. With the secure flag assigned on cookies, it will only be transferred through HTTPS.

A cool and funny way to remind one of the OWASP guidelines, the A3:2021. This design will guide your developers to follow the best practices to avoid Injections on code no matter it is LDAP, XML, SQL, Command and so on.

A reminder for developers to review commented code and take care of it to avoid disclosing secrets or giving hints to a malicious actor. After all secure coding.

An awareness design to tell your peer developers to implement input validation to prevent injection, buffer overflows, denial of service or even log sanitisation.

Any input that is controllable by the user is susceptible of being manipulated and turn it as an evil payload for remote code execution on the victim server. Black background design with white letters.

A black background with white letters design version about one of the guidelines provided by OWASP, to put in place security measures to restrict the import or usage of packages with known vulnerabilities.

This design is for secure coding awareness, because if any of your coworker developers performs git push with secrets, it not only implies the clean up of the secrets on the git repo, but also the clean up the git history which will contain the secrets as well.

Developers are under great pressure with aggressive delivering dates but, one of the most important things that they shouldn't overlook, is to applying input validation in the functions or methods.

This is a reminder for developers to replace any print used for debugging purposes with logger to write them in files.

Developers are under great pressure with aggressive delivering dates but, one of the most important things that they shouldn't overlook, is to applying input validation in the functions or methods. This is a black background with white letters design version.

A cool and funny way to remind one of the OWASP guidelines, the A6:2021 vulnerable and outdated components. This design will guide your developers to follow the best practices and mitigate the risks of using any vulnerable or old dependencies in the software.

The helmet.js should be the minimum security requirement for node.js express applications. By doing so, developers can provide protection to the web application with the necessary secure http headers. This is a dark background with white letters design version.

A design made for providing guidance to CSRF attack prevention. If it is not prevented adequately, it may leave attackers to trigger undesired actions from victims' browser like performing inadvertent transactions on your website.

Normally, any authentication through a website is done through HTTP POST method since a form is needed with login information. This could minimise the risk of disclosing the credentials when your browser stores the URL in plan text or even being written in logs on the server side.

Never forget to handle a potential exception thrower code to avoid any undesired web application status. Run the code within a try and process the error on the catch section.

This should be the input validation steps that the code must do to avoid processing harmful untrusted data. This is a black background with white letters design version.

To mitigate the risk of supply chain attacks or other similar ones that implies malicious code being incorporated in the code, it is recommended to perform malware scanning to the dependencies before using them into your project. This is a black background design version with white letters.

Besides input validation which avoids processing any untrusted data by the application, it is important to perform output validation when writing logs, not only to avoid disclosing any sensitive information but also to prevent local file inclusion attacks.

A design about the the common weakness enumeration 787 represented in an iconic way. Good for secure coding guideline.