# appsec.fyi

> A curated application security resource library covering 25 topics across 7,167+ resources — articles, tools, writeups, and conference talks. Each resource is summarized and indexed by topic, source publisher, primary tool (if applicable), and difficulty level (beginner / intermediate / advanced / news).

Content is curated by Carl Sampson (https://chs.us). The site is free, no signup, no ads. A weekly digest goes out via Buttondown. A native app for iOS, iPadOS, and macOS is on the App Store.

## Topics

- [IDOR](https://appsec.fyi/idor.html): Access control flaws via predictable object references (96 resources)
- [XSS](https://appsec.fyi/xss.html): Client-side injection through untrusted input in web pages (479 resources)
- [AI Security](https://appsec.fyi/ai.html): LLM security, prompt injection, and AI-powered attacks (563 resources)
- [XXE](https://appsec.fyi/xxe.html): XML parser exploitation for file read and SSRF (88 resources)
- [SSRF](https://appsec.fyi/ssrf.html): Server-side requests to unintended internal targets (1170 resources)
- [SQL Injection](https://appsec.fyi/sqli.html): Database injection through unsanitized query parameters (198 resources)
- [CSRF](https://appsec.fyi/csrf.html): Forged authenticated requests from cross-origin pages (77 resources)
- [OSINT](https://appsec.fyi/osint.html): Public intelligence gathering for attack surface mapping (136 resources)
- [Python Security](https://appsec.fyi/python.html): Security tools, scripting, and secure coding in Python (239 resources)
- [Burp Suite](https://appsec.fyi/burp.html): Web security testing with Burp Suite proxy and scanner (182 resources)
- [RCE](https://appsec.fyi/rce.html): Arbitrary code execution on remote target systems (970 resources)
- [Bug Bounty](https://appsec.fyi/bugbounty.html): Finding and reporting vulnerabilities for rewards (399 resources)
- [Talks](https://appsec.fyi/talks.html): Security conference presentations and workshops (85 resources)
- [Recon](https://appsec.fyi/recon.html): Subdomain, port, and service discovery techniques (225 resources)
- [Fuzzing](https://appsec.fyi/fuzzing.html): Automated input mutation to discover crashes and bugs (129 resources)
- [GraphQL](https://appsec.fyi/graphql.html): API security risks unique to GraphQL endpoints (106 resources)
- [AuthZ](https://appsec.fyi/authz.html): Broken access control and privilege escalation flaws (182 resources)
- [API Security](https://appsec.fyi/apisec.html): REST and API-specific vulnerability patterns (371 resources)
- [Mobile Security](https://appsec.fyi/mobile.html): iOS and Android application security testing (147 resources)
- [Supply Chain](https://appsec.fyi/supplychain.html): Dependency, build pipeline, and package attacks (953 resources)
- [Secrets](https://appsec.fyi/secrets.html): Credential leaks, secret scanning, and key management (205 resources)
- [Deserialization](https://appsec.fyi/deser.html): Insecure deserialization and gadget chain exploits (101 resources)
- [Authentication](https://appsec.fyi/authn.html): OAuth, SAML, MFA, and passkey rollouts (214 resources)
- [JWT](https://appsec.fyi/jwt.html): JWT attack techniques: alg confusion, kid injection, weak secrets (109 resources)
- [SSTI](https://appsec.fyi/ssti.html): Template injection in Jinja, Twig, Freemarker leading to RCE (99 resources)

## Cross-topic surfaces

- [Sources index](https://appsec.fyi/source/): per-publisher pages — every resource curated from a given site (PortSwigger, OWASP, Wiz, Intigriti, etc.) across all 25 topics. Useful when you want everything from one author.
- [Tools index](https://appsec.fyi/tools.html): resources grouped by primary AppSec tool (Burp Suite, sqlmap, nuclei, ffuf, Frida, MobSF, etc.). Each tool section links to the tool's own product page or GitHub repo.
- [Comparisons](https://appsec.fyi/compare/): side-by-side breakdowns of common AppSec concept pairs (XSS vs CSRF, SSRF vs CSRF, AuthN vs AuthZ, SAST vs DAST, OAuth vs SAML, etc.).
- [Glossary](https://appsec.fyi/glossary.html): definitions of common application security terms.
- [Recently exploited (CISA KEV)](https://appsec.fyi/xss.html#kev-sidebar): topic pages display top recent KEV-listed CVEs in a sidebar above the resource table.

## Resources for AI agents and integrations

- [Embed widgets](https://appsec.fyi/embed/): drop a one-iframe sidebar showing the latest resources for any topic on your blog.
- [Main RSS feed](https://appsec.fyi/feed.xml): newest 50 resources across all topics.
- [Per-topic RSS feeds](https://appsec.fyi/feeds/): one RSS feed per topic (e.g., https://appsec.fyi/feeds/xss.xml, https://appsec.fyi/feeds/ssrf.xml).
- [Changelog feed](https://appsec.fyi/feeds/changelog.xml): resources added in the last 7 days.
- [Sitemap](https://appsec.fyi/sitemap.xml): all indexed pages (topics, sources, tools, comparisons, glossary).

## How content is curated

1. Articles are bookmarked into a topic-tagged collection.
2. A nightly job summarizes each new entry to ~100 words.
3. An LLM-based off-topic filter hides content that does not match its tagged topic (e.g., a WW2 article tagged 'SSRF' would be hidden).
4. Each entry is auto-classified by difficulty and (when applicable) primary tool.
5. Topic, source, and tool index pages are regenerated twice daily.

## About

- [How It Works](https://appsec.fyi/about.html): pipeline overview.
- [Submit a resource](https://appsec.fyi/submit.html): suggest a new entry.
- [Privacy policy](https://appsec.fyi/privacy-policy/): no tracking beyond first-party Clicky and click-counts on resource links.