guest@websec ~ % man 22-additional-resources

22 · Additional Resources

Security knowledge goes stale fast. A few good sources keep us current.

Stay informed about our stack

• Rails security announcements: subscribe; this is where Rails CVEs land first.
• Rails Security Guide (the basis for much of this guide) and the OWASP Ruby on Rails Cheat Sheet.
• ruby-advisory-db (what bundler-audit checks) and GitHub Dependabot alerts on our repos.
• Brakeman warning types: what each warning means and how to fix it.

OWASP

• OWASP Top 10:2025: the current list of critical web risks (mapped on the start page).
• OWASP Cheat Sheet Series: short, practical guides per topic. Start with XSS and Authorization.
• Cheat sheets indexed by Top 10 category (organized by the 2021 edition).

Mozilla and browsers

• Mozilla Web Security Guidelines: the checklist behind section 12 (TLS, cookies, CSP, SRI, headers).
• Mozilla SSL Configuration Generator for our load balancer and proxy configs.
• MDN HTTP Observatory: scan our sites' headers and get a grade.

Standards and data

• NIST SP 800-63B: passwords and authentication.
• OSV.dev: an open vulnerability database across ecosystems.

Practice

• PortSwigger Web Security Academy: free hands-on labs for nearly every attack in this guide.
• OWASP Juice Shop: a deliberately vulnerable app to attack locally.
• Run bin/brakeman and bundle exec bundler-audit check --update on our apps and fix one finding a week.

Check your knowledge

Done reading? Take the developer quiz, and share the awareness quiz with non-tech colleagues.