I've taken a different approach to explaining the basics of application security. These are the things that are most likely to cause your application to be sec

I've taken a different approach to explaining the basics of application security. These are the things that are most likely to cause your application to be secure: 1. Data being treated as code. 2. Invalid (or missing) logic. 3. Insecure operating environment. (e.g. outdated packages) 4. Cryptography failures. Data being treated as code covers the obvious things like SQL Injection and Cross-Site Scripting, and makes it easier to conceptualize the solution: Never mix the two. That's what prepared statements accomplish. Invalid/missing logic is the realm of "missing access controls" and "confused deputy" problems. (This is also where I'd place CSRF vulnerabilities.) Insecure operating environment: A secure application on an insecure server is not secure. Patch your systems. Use HTTPS. WordPress can't save you from CVE-2012-1823. Apache can't save you from Shellshock. Cryptography failures are their own category, where the phrase "padding oracle" is routinely uttered with a straight face, a single mistake can cripple your application, and comparing strings the normal way programmers compare strings is considered dangerous. The solution here for people who aren't interested in becoming an expert is to hire one. Or a team of them. These descriptions are an attempt to address the fundamental problems with how insecure code is written, rather than to arm the reader with a checklist of specific instances of vulnerabilities they can check off. I generally dislike checklists (OWASP 10, SANS 25). How many people are well-armed against SQL Injection, but pass user data to PHP's unserialize() function with reckless abandon? This is a data-as-code issue. How many people use str_shuffle() for password reset token generation? This is a cryptographic failure. I wrote about this at length here: https://paragonie.com/blog/2015/08/gentle-introduction-application-security https://paragonie.com/blog/2015/08/gentle-introduction-appli... If anyone's interested, I also curate this reading list on Github: https://github.com/paragonie/awesome-appsec https://github.com/paragonie/awesome-appsec