For those of you that aren't familiar, OWASP (the Open Web Application Security Project) is a great resource for security neophytes. When my team is on applicat

For those of you that aren't familiar, OWASP (the Open Web Application Security Project) is a great resource for security neophytes. When my team is on application security engagements, we'll frequently introduce our clients to the OWASP cheat sheets for various different areas. For developers, it can be a great resource -- although I'm not sure how much stock I'd put into this "testing guide." Where OWASP really shines seems to be coverage (both detection and prevention) of the most common web application flaws. Given that their claim-to-fame is the "top ten" web application threats, this makes sense. Here's an example of what I'm talking about: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(... For people who are unfamiliar with different classes of web app vulnerabilities -- especially if they are developing an application themselves -- this can be an excellent resource.