# appsec.fyi

> A curated application security resource library covering 25 topics across 6,516+ resources — articles, tools, writeups, and conference talks. Each resource is summarized and indexed by topic, source publisher, primary tool (if applicable), and difficulty level (beginner / intermediate / advanced / news).

Content is curated by Carl Sampson (https://chs.us). The site is free, no signup, no ads. A weekly digest goes out via Buttondown. A native app for iOS, iPadOS, and macOS is on the App Store.

## Topics

- [IDOR](https://appsec.fyi/idor.html): Access control flaws via predictable object references (100 resources)
- [XSS](https://appsec.fyi/xss.html): Client-side injection through untrusted input in web pages (382 resources)
- [AI Security](https://appsec.fyi/ai.html): LLM security, prompt injection, and AI-powered attacks (641 resources)
- [XXE](https://appsec.fyi/xxe.html): XML parser exploitation for file read and SSRF (86 resources)
- [SSRF](https://appsec.fyi/ssrf.html): Server-side requests to unintended internal targets (1092 resources)
- [SQL Injection](https://appsec.fyi/sqli.html): Database injection through unsanitized query parameters (154 resources)
- [CSRF](https://appsec.fyi/csrf.html): Forged authenticated requests from cross-origin pages (78 resources)
- [OSINT](https://appsec.fyi/osint.html): Public intelligence gathering for attack surface mapping (124 resources)
- [Python Security](https://appsec.fyi/python.html): Security tools, scripting, and secure coding in Python (217 resources)
- [Burp Suite](https://appsec.fyi/burp.html): Web security testing with Burp Suite proxy and scanner (177 resources)
- [RCE](https://appsec.fyi/rce.html): Arbitrary code execution on remote target systems (754 resources)
- [Bug Bounty](https://appsec.fyi/bugbounty.html): Finding and reporting vulnerabilities for rewards (382 resources)
- [Talks](https://appsec.fyi/talks.html): Security conference presentations and workshops (89 resources)
- [Recon](https://appsec.fyi/recon.html): Subdomain, port, and service discovery techniques (232 resources)
- [Fuzzing](https://appsec.fyi/fuzzing.html): Automated input mutation to discover crashes and bugs (118 resources)
- [GraphQL](https://appsec.fyi/graphql.html): API security risks unique to GraphQL endpoints (117 resources)
- [AuthZ](https://appsec.fyi/authz.html): Broken access control and privilege escalation flaws (238 resources)
- [API Security](https://appsec.fyi/apisec.html): REST and API-specific vulnerability patterns (308 resources)
- [Mobile Security](https://appsec.fyi/mobile.html): iOS and Android application security testing (145 resources)
- [Supply Chain](https://appsec.fyi/supplychain.html): Dependency, build pipeline, and package attacks (753 resources)
- [Secrets](https://appsec.fyi/secrets.html): Credential leaks, secret scanning, and key management (245 resources)
- [Deserialization](https://appsec.fyi/deser.html): Insecure deserialization and gadget chain exploits (98 resources)
- [Authentication](https://appsec.fyi/authn.html): OAuth, SAML, MFA, and passkey rollouts (228 resources)
- [JWT](https://appsec.fyi/jwt.html): JWT attack techniques: alg confusion, kid injection, weak secrets (108 resources)
- [SSTI](https://appsec.fyi/ssti.html): Template injection in Jinja, Twig, Freemarker leading to RCE (98 resources)

## Cross-topic surfaces

- [Mega Guides](https://appsec.fyi/guide/): one long-form, source-cited article per topic, synthesized from the full text of every resource in that topic and rebuilt monthly. Each claim carries an inline citation linking to the source it came from. Start here for a survey of a topic rather than a list of links.
- [Learning paths](https://appsec.fyi/learn/): the same resources ordered for study instead of recency — three stages per topic (beginner orientation, then testing methodology, then advanced research). News items are excluded. Use when the question is "how do I learn X" rather than "what is new in X".
- [Sources index](https://appsec.fyi/source/): per-publisher pages — every resource curated from a given site (PortSwigger, OWASP, Wiz, Intigriti, etc.) across all 25 topics. Useful when you want everything from one author.
- [Tools index](https://appsec.fyi/tools.html): resources grouped by primary AppSec tool (Burp Suite, sqlmap, nuclei, ffuf, Frida, MobSF, etc.). Each tool section links to the tool's own product page or GitHub repo.
- [Comparisons](https://appsec.fyi/compare/): side-by-side breakdowns of common AppSec concept pairs (XSS vs CSRF, SSRF vs CSRF, AuthN vs AuthZ, SAST vs DAST, OAuth vs SAML, etc.).
- [Glossary](https://appsec.fyi/glossary.html): definitions of common application security terms.
- [Recently exploited (CISA KEV)](https://appsec.fyi/xss.html#kev-sidebar): topic pages display top recent KEV-listed CVEs in a sidebar above the resource table.

## Resources for AI agents and integrations

- [Embed widgets](https://appsec.fyi/embed/): drop a one-iframe sidebar showing the latest resources for any topic on your blog.
- [Main RSS feed](https://appsec.fyi/feed.xml): newest 50 resources across all topics.
- [Per-topic RSS feeds](https://appsec.fyi/feeds/): one RSS feed per topic (e.g., https://appsec.fyi/feeds/xss.xml, https://appsec.fyi/feeds/ssrf.xml).
- [Changelog feed](https://appsec.fyi/feeds/changelog.xml): resources added in the last 7 days.
- [Sitemap](https://appsec.fyi/sitemap.xml): all indexed pages (topics, sources, tools, guides, learning paths, comparisons, glossary).

## How content is curated

1. Articles are bookmarked into a topic-tagged collection.
2. A nightly job summarizes each new entry to ~100 words.
3. An LLM-based off-topic filter hides content that does not match its tagged topic (e.g., a WW2 article tagged 'SSRF' would be hidden).
4. Each entry is auto-classified by difficulty and (when applicable) primary tool.
5. Topic, source, and tool index pages are regenerated twice daily.

## About

- [How It Works](https://appsec.fyi/about.html): pipeline overview.
- [Submit a resource](https://appsec.fyi/submit.html): suggest a new entry.
- [Privacy policy](https://appsec.fyi/privacy-policy/): no tracking beyond first-party Clicky and click-counts on resource links.