AppSec-Atlas - Open-source application security knowledge base: 5

项目说明

<di="center">

<img src="website/static/img/logo.png" alt="AppSec Atlas Logo" width="120" />

🗺️ AppSec Atlas

*An Open-Source Security Knowledge Base Across the Full AppSec Landscape*

Map the entire security landscape. One repo. Zero excuses.

![Website]()
![GitHub Stars]()

<br/>

🌐 Live Site · 📚 Browse Guides · 🗺️ Learning Paths · 🤝 Contribute · 💬 Discord · 💖 Sponsor · ☕ Ko-fi

</div>

---

> 🚀 AppSec Atlas is now live at appsecatlas.com! — Star ⭐ the repo to help others discover it.

🌟 Why AppSec Atlas?

AppSec Atlas is the only open-source security knowledge base that covers the full spectrum of modern security — from timeless application security fundamentals to the bleeding edge of AI/LLM security.

| Feature | AppSec Atlas | Other Resources |
|---------|:---:|:---:|
| Covers AI/LLM Security deeply | ✅ | ❌ |
| Real code — exploits AND fixes | ✅ | Partial |
| MCP & Agentic AI Security | ✅ | ❌ |
| Hands-on Docker labs | ✅ | Partial |
| Role-based learning paths | ✅ | Partial |
| 100% Free, no paywalls | ✅ | ✅ |
| Acti & Discord | ✅ | |

> 54 guides. 9 security domains. One atlas.

---

📚 Guides

🏗️ Section 1: Foundational Security

> Core concepts every security professional and de must know

| Guide | Status | Level |
|-------|--------|-------|
| OWASP Top 10 Deep Dive | ✅ A | Beginner |
| Secure Coding Practices | ✅ A | Beginner |
| Cryptography for De | ✅ A | Intermediate |
| Post-Quantum Cryptography | ✅ A | Ad |
| Authentication & Authorization Masterclass | ✅ A | Intermediate |
| Zero Trust Architecture Guide | ✅ A | Ad |
| Security Design Patterns | ✅ A | Intermediate |

🌐 Section 2: Web & API Security

> From classic web to modern API attack surfaces

| Guide | Status | Level |
|-------|--------|-------|
| Web Application Security Handbook | ✅ A | Intermediate |
| API Security Guide | ✅ A | Intermediate |
| Modern API Identity | ✅ A | Ad |
| Frontend Security Playbook | ✅ A | Intermediate |
| Mobile App Security Guide | ✅ A | Intermediate |
| CORS & Same-Origin Policy Explained | ✅ A | Beginner |

☁️ Section 3: Cloud & Infrastructure Security

> Securing modern cloud-native and infrastructure en

| Guide | Status | Level |
|-------|--------|-------|
| Cloud Security Fundamentals | ✅ A | Intermediate |
| Cross-Cloud IAM Federation | ✅ A | Ad |
| Confidential Computing Enclaves | ✅ A | Ad |
| Cloud Zero-Day Playbooks | ✅ A | Ad |
| Container & Kubernetes Security | ✅ A | Intermediate |
| Kubernetes & eBPF Runtime Security | ✅ A | Ad |
| Infrastructure as Code Security | ✅ A | Intermediate |
| Ser Security Guide | ✅ A | Intermediate |
| CI/CD Pipeline Security | ✅ A | Intermediate |
| Secrets Management Guide | ✅ A | Intermediate |

🤖 Section 4: AI/ML Security ⭐ *Our Flagship*

> The most comprehensi AI security resource — from LLMs to agentic systems

| Guide | Status | Level |
|-------|--------|-------|
| Agentic AI Security Guide | ✅ A | Ad |
| LLM Security & Prompt Injection | ✅ A | Intermediate |
| ML Model Security & Ad Attacks | ✅ A | Ad |
| RAG Security Guide | ✅ A | Ad |
| AI Red Teaming Playbook | ✅ A | Ad |
| MCP & Tool-Use Security | ✅ A | Ad |

🔴 Section 5: Offensi

> Red team techniques, penetration testing, and ethical hacking

| Guide | Status | Level |
|-------|--------|-------|
| Penetration Testing Methodology | ✅ A | Intermediate |
| Enterprise Security Assessment | ✅ A | Ad |
| Social Engineering & Phishing | ✅ A | Beginner |
| Network Security & Attack Techniques | ✅ A | Intermediate |
| Bug Bounty Hunting Guide | ✅ A | Intermediate |
| CTF Learning Guide | ✅ A | Beginner |

🛡️ Section 6: Defensi & SOC

> Blue team playbooks, incident response, and security operations

| Guide | Status | Level |
|-------|--------|-------|
| Incident Response Playbook | ✅ A | Intermediate |
| Security Chaos Engineering | ✅ A | Ad |
| Security Logging & Monitoring | ✅ A | Intermediate |
| Digital Forensics Basics | ✅ A | Intermediate |
| Management Guide | ✅ A | Intermediate |
| SOC Operations Guide | ✅ A | Ad |

🔐 Section 7: Specialized Security Domains

> Hardware, IoT, Blockchain, and Supply Chain security

| Guide | Status | Level |
|-------|--------|-------|
| Software Supply Chain Security | ✅ A | Ad |
| Blockchain & Smart Contract Security | ✅ A | Ad |
| IoT Security Guide | ✅ A | Intermediate |
| Privacy Engineering Guide | ✅ A | Intermediate |
| Hardware Security Basics | ✅ A | Ad |
| Browser Extension Security | ✅ A | Intermediate |

📋 Section 8: Compliance & Go

> Frameworks, standards, and regulatory compliance

| Guide | Status | Level |
|-------|--------|-------|
| NIST Cybersecurity Framework Guide | ✅ A | Intermediate |
| SOC 2 Compliance Guide | ✅ A | Intermediate |
| GDPR Technical Implementation | ✅ A | Intermediate |
| De Handbook | ✅ A | Intermediate |

🧪 Section 9: Hands-On Labs

> Practice makes perfect — build your skills with real exercises

| Guide | Status | Level |
|-------|--------|-------|
| CTF Challenge Set | ✅ A | All Levels |
| App Lab | ✅ A | All Levels |
| Security Code Review Guide | ✅ A | Intermediate |

---

🗺️ Learning Paths

Not sure where to start? Pick your role:

| I am a... | Start here |
|-----------|-----------|
| 🧑‍💻 De wanting to write secure code | Secure Coding → OWASP Top 10 → API Security |
| ☁️ Cloud Engineer | Secrets Management → CI/CD Security → Cloud Security |
| 🤖 AI/ML Engineer | Agentic AI Security → LLM Security → RAG Security |
| 🔴 Aspiring Pentester | OWASP Top 10 → Web App Security → Pentest Methodology |
| 🔵 Blue Teamer / SOC Analyst | Logging & Monitoring → IR Playbook → Management |
| 🎓 Complete Beginner | OWASP Top 10 → Auth & AuthZ → CTF Guide |

---

📋 Checklists

Quick-reference printable checklists for common security tasks:

📄 Web Application Security Checklist

📄 API Security Checklist

📄 Cloud Deployment Checklist

📄 Code Review Security Checklist

📄 Incident Response Checklist

---

🚀 AppSec Ecosystem & Open-Source Projects

Check out our specialized open-source security tools and companion repositories:

| Project | Description | Link |
|---|---|---|
| 🔐 De | Premium De Cryptography & Security Toolkit Platform | de.dev · GitHub |
| 🤖 Agentic AI Security Guide | Specialized guide for securing autonomous AI agents, tool execution, and LLM orchestration | GitHub Repo |
| 🛡️ Threat Modelling Basics | Practical frameworks, templates, and methodologies for threat modeling (STRIDE, PASTA, DREAD) | GitHub Repo |
| ⚛️ Quantum-Safe Py | Python library implementing Post-Quantum Cryptography (NIST ML-KEM, ML-DSA, SLH-DSA) | GitHub Repo |
| 🔍 Quantum Safe Auditor | Automated SAST scanner for detecting quantum- cryptography across codebase repositories | GitHub Repo |

> ⭐ Explore and star these companion projects to support the open-source security ecosystem!

---

🤝 Contributing

AppSec Atlas is built by the community, for the community. Every contribution matters.

Ways to contribute:

✍️ Write or improve a guide

🐛 Fix errors, typos, outdated information

🧪 Add lab exercises or CTF challenges

🌍 Translate guides to other languages

⭐ Star the repo and spread the word

Read CONTRIBUTING.md to get started. First-time contributors: look for issues labeled good first issue.

---

💝 Support This Project

AppSec Atlas is 100% free and open-source. If this project has saved you time, helped you pass an audit, or ad your career, consider supporting ongoing research:

💖 GitHub Sponsors — Become a monthly sponsor to sustain ongoing research & de

☕ Ko-fi — Buy the author a coffee to show your appreciation

⭐ Star this repository — Help more security engineers and de discover the Atlas

---

📜 License

All guides and content in this repository are licensed under Creati Attribution 4.0 International (CC BY 4.0).

You are free to share and adapt the material for any purpose, e, as long as you gi credit.

---

<di="center">

Built with ❤️ by the security community, for the security community.

🌐 appsecatlas.com · 💬 Discord · 💖 GitHub Sponsors · ☕ Ko-fi

*If AppSec Atlas helped you, please ⭐ star it to help others find it.*

</div>

项目信息

开发语言：TypeScript

Star 数：3

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open-source application security knowledge base: 54 modules across web & API, cloud, AI/ML, offensive, defensive and compliance security.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。