FSEstyle

Description: Devops is one of the best ways to follow the agile methodology but, if you include cybersecurity in such mechanisms, it becomes DevSecOps which is a good way to discover vulnerabilities and flaws in the code in earlier development stages in an automated basis.

Description: A funny design of a Shiba Inu telling a good advice regarding pushing secrets in git repositories.

Description: A funny design of a samoyed reminding the importance of doing input validation before processing any user provided data.

Description: This is a reminder for developers to replace any print used for debugging purposes with logger to write them in files.

Description: A cool and funny way to remind one of the OWASP guidelines, the A2:2021. This design will guide your developers to follow the best practices and avoid insecure designs.

Description: A cool and funny way to remind one of the OWASP guidelines, the A3:2021. This design will guide your developers to follow the best practices to avoid Injections on code no matter it is LDAP, XML, SQL, Command and so on.

Description: A cool and funny way to remind one of the OWASP guidelines, the A2:2021. This design will guide your developers to follow the best practices for cryptographic failures.

Description: A cool and funny way to remind one of the OWASP guidelines, the A1:2021. This design will guide your developers to follow the best practices for broken access control.

Description: This design reminds to the developer the importance of using defensive copy instead of clone. It will reduce the risk of data compromise.

Description: A design about the the common weakness enumeration 20 also known as improper input validation. If user input is not properly escaped, sanitised and validated then the attackers can perform DoS, RCE or even tamper the information.

Description: A design about the the common weakness enumeration 78 represented with an icon. This is a good way to concern developers to sanitise any inputs before using them to run any OS command.

Description: A design about the the common weakness enumeration 89 represented in an iconic way. Good for secure coding guideline and awareness to avoid being vulnerable to sql injection attacks.

Description: Another secure coding design about the sensitive information disclosure caused by pushing code with secrets to the git repository. One of the ways to avoid this is by introducing the file names of the project with secrets into the .gitignore file.

Description: A design about the the common weakness enumeration 79 represented in an iconic way. Good for secure coding guideline and awareness to avoid being vulnerable to XSS attacks.

Description: A design about the the common weakness enumeration 787 represented in an iconic way. Good for secure coding guideline.

Description: Kind secure coding advice for developers to ensure that the content security policy header is used on http responses and mitigate XSS attacks on users visiting your website.

Description: A funny design to concern developers that the usage of eval() to process or parse untrusted data could let attackers to inject code to run.

Description: This is a cool and funny design to certify that the code is free of any possible injection threats following the best practices like OWASP or CWE.

Description: Never forget to handle a potential exception thrower code to avoid any undesired web application status. Run the code within a try and process the error on the catch section.

Description: Want to avoid the undesired clickjacking attack on your website? Then X-Frame-Options should be one of the headers to respond with sameorigin value. Or you can make it even more restrictive with deny. The result is avoiding any eventual attacker to use hidden frames to compromise the website user.

Description: In case that x-powered-by header is delivered by your service, override it with misleading information to make attackers life harder like "Not Your Business 1.0"

Description: A design made for providing guidance to CSRF attack prevention. If it is not prevented adequately, it may leave attackers to trigger undesired actions from victims' browser like performing inadvertent transactions on your website.

Description: To protect from file upload attacks on your website that could leave attackers to upload malicious software or backdoors, here's some of the protections to prevent such attacks.

Description: Here's a cheat sheet like design to remind some of the secure coding measures to prevent all kind XSS attacks: Reflective, Stored or DOM based. Failing to do so, will imply code execution on victim's browser when visiting your site.

Description: The CAPTCHA is annoying for us as humans, but it could be a great way to stop automatic attacks or bots like brute force, CSRF or even XSS attacks.

Description: One of the recommendations of secure coding is to practice pair programming, because 4 eyes catches more than 2 and it is a good way to share context and knowledge between coworkers.

Description: A shield design of the input validation steps that developers should do in the methods or functions that manipulates untrusted data. This is one of the best practice of OWASP for secure coding.

Description: Developers are under great pressure with aggressive delivering dates but, one of the most important things that they shouldn't overlook, is to applying input validation in the functions or methods.

Description: OWASP is a foundation that provides trainings, guidelines and useful tools for cybersecurity professionals to make the internet a safe place.

Description: Besides input validation which avoids processing any untrusted data by the application, it is important to perform output validation when writing logs, not only to avoid disclosing any sensitive information but also to prevent local file inclusion attacks.

Description: Fuzzing is an important testing to be done on running applications because it can catch flaws that static analysis can't like buffer overflows or memory corruption.

Description: If you think that your architecture doesn't needs to be reviewed then try to threat modeling it. Probably you'll know about new weakness overlooked previously thanks to the different points of view provided by the different participants.

Description: This should be the input validation steps that the code must do to avoid processing harmful untrusted data.

Description: This is one of the best practice which is a must when developing any web server that provides cookies. With the secure flag assigned on cookies, it will only be transferred through HTTPS.

Description: HTTPOnly flag for cookies should be a must. This avoids other unwanted usages of cookies from your browser like scripts and only restricts its usage for HTTP.

Description: One of the best practices stated in OWASP is to allow only to use local static DTD when processing XML to avoid XXE attacks.