DevGuide/mkdocs.yaml at main · OWASP/DevGuide · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
site_name: OWASP Developer Guide
site_description: OWASP Foundation Developer Guide project
site_author: OWASP Developer Guide team
site_url: https://devguide.owasp.org/

copyright: Licensed under the <a rel="license" href="https://creativecommons.org/licenses/by-sa/4.0/">Creative Commons Attribution Share Alike 4.0 International license</a>.

repo_name: OWASP/DevGuide
repo_url: https://github.com/OWASP/DevGuide

theme:
  name: material
  language: en
  logo: assets/images/dg_logo_solid.png
  favicon: assets/images/favicon.png
  features:
    - search.highlight
    - search.suggest
    - navigation.tabs

  palette:
    # Palette toggle for automatic mode
    - media: "(prefers-color-scheme)"
      toggle:
        icon: material/brightness-auto
        name: Switch to light mode
    # Palette toggle for light mode
    - media: "(prefers-color-scheme: light)"
      scheme: default
      toggle:
        icon: material/brightness-7
        name: Switch to dark mode
    # Palette toggle for dark mode
    - media: "(prefers-color-scheme: dark)"
      scheme: slate
      toggle:
        icon: material/brightness-4
        name: Switch to system preference

markdown_extensions:
  - def_list
  - attr_list
  - md_in_html

plugins:
  - open-in-new-tab
  - search
  - redirects:
      redirect_maps:
        'en/04-design/02-web-app-checklist/01-define-security-requirements.md': 'en/04-design/02-web-app-checklist/01-secure-by-default.md'
        'en/04-design/01-threat-modeling/06-toolkit.md': 'en/04-design/01-threat-modeling/01-threat-modeling-project.md'
        'en/04-design/01-threat-modeling/01-threat-modeling.md': 'en/04-design/01-threat-modeling/07-practical-threat-modeling.md'

nav:
  - 'Developer Guide':
    - Introduction: index.md
    - Foundations:
      - Overview: en/02-foundations/index.md
      - Security fundamentals: en/02-foundations/01-security-fundamentals.md
      - Secure development and integration: en/02-foundations/02-secure-development.md
      - Principles of security: en/02-foundations/03-security-principles.md
      - Principles of cryptography: en/02-foundations/04-crypto-principles.md
      - OWASP Top 10: en/02-foundations/05-top-ten.md
    - Requirements:
      - Overview: en/03-requirements/index.md
      - Requirements in practice: en/03-requirements/01-requirements.md
      - Risk profile: en/03-requirements/02-risk.md
      - OpenCRE: en/03-requirements/03-opencre.md
      - SecurityRAT: en/03-requirements/04-security-rat.md
      - ASVS: en/03-requirements/05-asvs.md
      - MAS: en/03-requirements/06-mas.md
      - SKF: en/03-requirements/07-skf.md
    - Design:
      - Overview: en/04-design/index.md
      - Threat modeling:
        - Overview: en/04-design/01-threat-modeling/index.md
        - Threat modeling: en/04-design/01-threat-modeling/01-threat-modeling-project.md
        - pytm: en/04-design/01-threat-modeling/02-pytm.md
        - Threat Dragon: en/04-design/01-threat-modeling/03-threat-dragon.md
        - Cornucopia: en/04-design/01-threat-modeling/04-cornucopia.md
        - LINDDUN GO: en/04-design/01-threat-modeling/05-linddun-go.md
        - Threat Model Library: en/04-design/01-threat-modeling/06-threat-model-library.md
        - Threat modeling in practice: en/04-design/01-threat-modeling/07-practical-threat-modeling.md
      - Web application checklist:
        - Overview: en/04-design/02-web-app-checklist/index.md
        - Secure by Default: en/04-design/02-web-app-checklist/01-secure-by-default.md
        - Leverage Security Frameworks and Libraries: en/04-design/02-web-app-checklist/02-frameworks-libraries.md
        - Secure Database Access: en/04-design/02-web-app-checklist/03-secure-database-access.md
        - Encode and Escape Data: en/04-design/02-web-app-checklist/04-encode-escape-data.md
        - Validate All Inputs: en/04-design/02-web-app-checklist/05-validate-inputs.md
        - Implement Digital Identity: en/04-design/02-web-app-checklist/06-digital-identity.md
        - Enforce Access Controls: en/04-design/02-web-app-checklist/07-access-controls.md
        - Protect Data Everywhere: en/04-design/02-web-app-checklist/08-protect-data.md
        - Implement Security Logging and Monitoring: en/04-design/02-web-app-checklist/09-logging-monitoring.md
        - Handle all Errors and Exceptions: en/04-design/02-web-app-checklist/10-handle-errors-exceptions.md
      - MAS checklist: en/04-design/03-mas-checklist.md
    - Implementation:
      - Overview: en/05-implementation/index.md
      - Documentation:
        - Overview: en/05-implementation/01-documentation/index.md
        - Top 10 Proactive Controls: en/05-implementation/01-documentation/01-proactive-controls.md
        - Go Secure Coding Practices: en/05-implementation/01-documentation/02-go-scp.md
        - Cheatsheet Series: en/05-implementation/01-documentation/03-cheatsheets.md
      - Dependencies:
        - Overview: en/05-implementation/02-dependencies/index.md
        - Dependency-Check: en/05-implementation/02-dependencies/01-dependency-check.md
        - Dependency-Track: en/05-implementation/02-dependencies/02-dependency-track.md
        - CycloneDX: en/05-implementation/02-dependencies/03-cyclonedx.md
      - Secure Libraries:
        - Overview: en/05-implementation/03-secure-libraries/index.md
        - ESAPI: en/05-implementation/03-secure-libraries/01-esapi.md
        - CSRFGuard: en/05-implementation/03-secure-libraries/02-csrf-guard.md
        - OSHP: en/05-implementation/03-secure-libraries/03-secure-headers.md
      - MASWE: en/05-implementation/04-maswe.md
    - Verification:
      - Overview: en/06-verification/index.md
      - Guides:
        - Overview: en/06-verification/01-guides/index.md
        - WSTG: en/06-verification/01-guides/01-wstg.md
        - MASTG: en/06-verification/01-guides/02-mastg.md
        - ASVS: en/06-verification/01-guides/03-asvs.md
      - Tools:
        - Overview: en/06-verification/02-tools/index.md
        - DAST tools: en/06-verification/02-tools/01-dast.md
        - Amass: en/06-verification/02-tools/02-amass.md
        - OWTF: en/06-verification/02-tools/03-owtf.md
        - Nettacker: en/06-verification/02-tools/04-nettacker.md
        - OSHP verification: en/06-verification/02-tools/05-secure-headers.md
      - Frameworks:
        - Overview: en/06-verification/03-frameworks/index.md
        - secureCodeBox: en/06-verification/03-frameworks/01-secure-codebox.md
      - Vulnerability management:
        - Overview: en/06-verification/04-vulnerability-management/index.md
        - DefectDojo: en/06-verification/04-vulnerability-management/01-defectdojo.md
    - Training and Education:
      - Overview: en/07-training-education/index.md
      - Vulnerable Applications:
        - Overview: en/07-training-education/01-vulnerable-apps/index.md
        - Juice Shop: en/07-training-education/01-vulnerable-apps/01-juice-shop.md
        - WebGoat: en/07-training-education/01-vulnerable-apps/02-webgoat.md
        - PyGoat: en/07-training-education/01-vulnerable-apps/03-pygoat.md
        - Security Shepherd: en/07-training-education/01-vulnerable-apps/04-security-shepherd.md
      - Secure Coding Dojo: en/07-training-education/02-secure-coding-dojo.md
      - SKF: en/07-training-education/03-skf.md
      - SamuraiWTF: en/07-training-education/04-samurai-wtf.md
      - OWASP Top 10: en/07-training-education/05-top-ten.md
      - Mobile Top 10: en/07-training-education/06-mobile-top-ten.md
      - API Top 10: en/07-training-education/07-api-top-ten.md
      - WrongSecrets: en/07-training-education/08-wrongsecrets.md
      - OWASP Snakes and Ladders: en/07-training-education/09-snakes-ladders.md
    - Culture building and Process maturing:
      - Overview: en/08-culture-process/index.md
      - Security Culture: en/08-culture-process/01-security-culture.md
      - Security Champions:
        - Overview: en/08-culture-process/02-security-champions/index.md
        - Security champions program: en/08-culture-process/02-security-champions/01-security-champions-program.md
        - Security Champions Guide: en/08-culture-process/02-security-champions/02-security-champions-guide.md
        - Security Champions Playbook: en/08-culture-process/02-security-champions/03-security-champions-playbook.md
      - SAMM: en/08-culture-process/03-samm.md
      - ASVS: en/08-culture-process/04-asvs.md
      - MAS: en/08-culture-process/05-mas.md
    - Operations:
      - Overview: en/09-operations/index.md
      - DevSecOps Guideline: en/09-operations/01-devsecops.md
      - Coraza WAF: en/09-operations/02-coraza.md
      - ModSecurity WAF: en/09-operations/03-modsecurity.md
      - OWASP CRS: en/09-operations/04-crs.md
    - Metrics:
      - Overview: en/10-metrics/index.md
    - Security gap analysis:
      - Overview: en/11-security-gap-analysis/index.md
      - Guides:
        - Overview: en/11-security-gap-analysis/01-guides/index.md
        - SAMM: en/11-security-gap-analysis/01-guides/01-samm.md
        - ASVS: en/11-security-gap-analysis/01-guides/02-asvs.md
        - MAS: en/11-security-gap-analysis/01-guides/03-mas.md
      - BLT: en/11-security-gap-analysis/02-blt.md
  - 'Guía del Desarrollador':
    - Introducción: es/index.md
    - Fundamentos:
      - Descripción: es/02-foundations/index.md
      - Fundamentos de seguridad: es/02-foundations/01-security-fundamentals.md
      - Desarrollo e integración segura: es/02-foundations/02-secure-development.md
      - Principios de seguridad: es/02-foundations/03-security-principles.md
      - Principios de criptografía: es/02-foundations/04-crypto-principles.md
      - OWASP Top 10: es/02-foundations/05-top-ten.md
    - Requisitos:
      - Descripción: es/03-requirements/index.md
      - Requisitos en la práctica: es/03-requirements/01-requirements.md
      - Perfil de riesgo: es/03-requirements/02-risk.md
      - OpenCRE: es/03-requirements/03-opencre.md
      - SecurityRAT: es/03-requirements/04-security-rat.md
      - ASVS: es/03-requirements/05-asvs.md
      - MAS: es/03-requirements/06-mas.md
      - SKF: es/03-requirements/07-skf.md
    - Diseño:
      - Descripción: es/04-design/index.md
      - Modelado de amenazas:
        - Descripción: es/04-design/01-threat-modeling/index.md
        - Modelado de amenazas en la práctica: es/04-design/01-threat-modeling/01-threat-modeling.md
        - pytm: es/04-design/01-threat-modeling/02-pytm.md
        - Threat Dragon: es/04-design/01-threat-modeling/03-threat-dragon.md
        - Cornucopia: es/04-design/01-threat-modeling/04-cornucopia.md
        - LINDDUN GO: es/04-design/01-threat-modeling/05-linddun-go.md
        - Threat Modeling toolkit: es/04-design/01-threat-modeling/06-toolkit.md
      - Lista de verificación para aplicaciones web:
        - Descripción: es/04-design/02-web-app-checklist/index.md
        - Definir Requisitos de Seguridad: es/04-design/02-web-app-checklist/01-define-security-requirements.md
        - Aprovechar Marcos y Bibliotecas de Seguridad: es/04-design/02-web-app-checklist/02-frameworks-libraries.md
        - Acceso Seguro a Bases de Datos: es/04-design/02-web-app-checklist/03-secure-database-access.md
        - Codificar y Escapar Datos: es/04-design/02-web-app-checklist/04-encode-escape-data.md
        - Validar Todas las Entradas: es/04-design/02-web-app-checklist/05-validate-inputs.md
        - Implementar Identidad Digital: es/04-design/02-web-app-checklist/06-digital-identity.md
        - Aplicar Controles de Acceso: es/04-design/02-web-app-checklist/07-access-controls.md
        - Proteger Datos en Todas Partes: es/04-design/02-web-app-checklist/08-protect-data.md
        - Implementar Registro y Monitoreo de Seguridad: es/04-design/02-web-app-checklist/09-logging-monitoring.md
        - Manejar todos los Errores y Excepciones: es/04-design/02-web-app-checklist/10-handle-errors-exceptions.md
      - Lista de verificación MAS: es/04-design/03-mas-checklist.md
    - Implementación:
      - Descripción: es/05-implementation/index.md
      - Documentation:
        - Descripción: es/05-implementation/01-documentation/index.md
        - Top 10 Proactive Controls: es/05-implementation/01-documentation/01-proactive-controls.md
        - Go Secure Coding Practices: es/05-implementation/01-documentation/02-go-scp.md
        - Cheatsheet Series: es/05-implementation/01-documentation/03-cheatsheets.md
      - Dependencias:
        - Descripción: es/05-implementation/02-dependencies/index.md
        - Dependency-Check: es/05-implementation/02-dependencies/01-dependency-check.md
        - Dependency-Track: es/05-implementation/02-dependencies/02-dependency-track.md
        - CycloneDX: es/05-implementation/02-dependencies/03-cyclonedx.md
      - Bibliotecas seguras:
        - Descripción: es/05-implementation/03-secure-libraries/index.md
        - ESAPI: es/05-implementation/03-secure-libraries/01-esapi.md
        - CSRFGuard: es/05-implementation/03-secure-libraries/02-csrf-guard.md
        - OSHP: es/05-implementation/03-secure-libraries/03-secure-headers.md
      - MASWE: es/05-implementation/04-maswe.md
    - Verificación:
      - Descripción: es/06-verification/index.md
      - Guías:
        - Descripción: es/06-verification/01-guides/index.md
        - WSTG: es/06-verification/01-guides/01-wstg.md
        - MASTG: es/06-verification/01-guides/02-mastg.md
        - ASVS: es/06-verification/01-guides/03-asvs.md
      - Herramientas:
        - Descripción: es/06-verification/02-tools/index.md
        - DAST tools: es/06-verification/02-tools/01-dast.md
        - Amass: es/06-verification/02-tools/02-amass.md
        - OWTF: es/06-verification/02-tools/03-owtf.md
        - Nettacker: es/06-verification/02-tools/04-nettacker.md
        - OSHP verification: es/06-verification/02-tools/05-secure-headers.md
      - Marcos de verificación:
        - Descripción: es/06-verification/03-frameworks/index.md
        - secureCodeBox: es/06-verification/03-frameworks/01-secure-codebox.md
      - Gestión de vulnerabilidades:
        - Descripción: es/06-verification/04-vulnerability-management/index.md
        - DefectDojo: es/06-verification/04-vulnerability-management/01-defectdojo.md
  - 'راهنمای فارسی':
    - Introduction: fa/index.md
    - Foundations:
      - Overview: fa/02-foundations/index.md
      - Security fundamentals: fa/02-foundations/01-security-fundamentals.md
      - Secure development and integration: fa/02-foundations/02-secure-development.md
      - Principles of security: fa/02-foundations/03-security-principles.md
      - Principles of cryptography: fa/02-foundations/04-crypto-principles.md
      - OWASP Top 10: fa/02-foundations/05-top-ten.md
  - 'Guia de Desenvolvimento':
    - Introdução: pt-br/index.md
    - Fundamentos:
      - Introdução: pt-br/02-foundations/index.md
      - Fundamentos de segurança: pt-br/02-foundations/01-security-fundamentals.md
      - OWASP Top Dez: pt-br/02-foundations/05-top-ten.md
  - 'Get involved':
    - Providing content: contributing.md
    - Code of Conduct: code_of_conduct.md
    - License: license.txt