OWASP Developer Guide

Developer Guide

The OWASP Developer Guide provides an introduction to security concepts and a handy reference for application and system developers. This guide does not seek to replicate the many excellent sources on specific security topics; it rarely tries to go into detail on a subject and instead provides links for greater depth on these security topics. The content of the Developer Guide aims to be accessible, introducing practical security concepts and providing enough detail to get developers started on various OWASP tools and documents.

History

Along with the OWASP Top Ten, the Developer Guide is one of the original resources published soon after OWASP was formed in 2001. Version 1.0 of the Developer Guide was released in 2002 and then there were various releases up to version 2.0 in 2005.

After much effort throughout 2023 and early 2024 the Developer Guide has been updated for the modern security landscape. The intended audience of the Developer Guide is application developers (web, desktop, mobile, and cloud) and API developers, and has been written using contributions from the wider application security community.

The draft version is a work in progress and is subject to large scale and frequent changes. Periodically the draft version is tagged and the contents promoted to the release area of the Developer Guide.

Contributing

Contributions and suggestions are all welcome, we just ask that you follow our code of conduct and read the contributing guidelines which provide style and document structure suggestions. We also welcome new issues, changes via a pull request and discussions in the project wiki.

The easiest way to get in contact with the development community for this documentation project is via the OWASP Slack #project-developer-guide project channel (you may need to subscribe first).

OWASP Developer Guide: accessible security for system and application developers

developer guide logo

Contribute to the Developer Guide

The Developer Guide is first and foremost a guide for development teams, and is intended to be a body of knowledge that these teams can draw on and should be familiar with. The Developer Guide must be a community effort with a diverse and wide range of contributors from across the whole software security field. The Developer Guide does not seek to replicate the various projects and resources already available, such as OWASP ASVS or WSTG, but provides basic and medium level introductions to software security; referencing other projects for a more in depth or advanced treatment of the subjects.

There are various areas of the guide that need content; please contribute where you can. If you feel a section is missing then suggest changes to the structure in a feature request.

Be sure to follow our code of conduct and the contributing guidelines which provide style and document structure suggestions.

Watch Star