Intro

# ===== The artefacts that matter =====
# OWASP Top 10              the most-known list of common risks
# OWASP ASVS                Application Security Verification Standard (1/2/3)
# OWASP Cheat Sheet Series  pragmatic per-topic guidance
# OWASP ZAP                 free DAST scanner
# OWASP Dependency-Check    SCA for known CVEs
# OWASP SAMM                Software Assurance Maturity Model
# OWASP Juice Shop          intentionally vulnerable app for training

# ===== Top 10 (2021) =====
# A01 Broken access control
# A02 Cryptographic failures
# A03 Injection
# A04 Insecure design
# A05 Security misconfiguration
# A06 Vulnerable / outdated components
# A07 ID + authentication failures
# A08 Software + data integrity failures
# A09 Security logging + monitoring failures
# A10 SSRF

# Each item maps to controls you can apply in code + infrastructure.

# ===== Where to start =====
# 1. Take OWASP ASVS Level 1 as the floor for any app
# 2. Add ZAP baseline scan to weekly CI on staging
# 3. Add dependency scanning to PR checks (Snyk, npm audit, OSV)
# 4. Tabletop the Top 10 each quarter; map controls to your code

# ===== Pick a tool per concern =====
# SAST:        Semgrep, CodeQL, SonarQube
# DAST:        OWASP ZAP, Burp Suite, Nuclei
# SCA:         OWASP Dependency-Check, Snyk, Dependabot, OSV-Scanner
# Secrets:     gitleaks, trufflehog
# IaC:         Checkov, KICS, tfsec
# Container:   Trivy, Grype, Clair

# ===== Cheat sheets you will reference often =====
# - Authentication
# - Session management
# - Access control
# - Cryptographic storage
# - Input validation
# - HTML5 security
# - REST security
# - GraphQL security

# ===== When OWASP wins =====
# - You need a starting point and reference vocabulary for AppSec
# - Compliance frameworks (PCI, ISO 27001, SOC 2) reference it
# - Free, vendor-neutral, regularly updated
# - Plenty of training material based on Juice Shop / WebGoat

# ===== Patterns to internalise =====
# - Cheat sheets in code review as canonical references
# - Top 10 as a CHECKLIST, not a hit list
# - Pair every offensive finding with a detection rule + hardening control
# - Authorise testing in writing before any keystrokes

# ===== Pitfalls =====
# - 'We did the Top 10' as a finish line
# - ZAP scans against prod (use staging that mirrors prod)
# - Component vulnerabilities deferred to quarterly review
# - Treating ASVS as a tick-box exercise instead of a control set

// OWASP is a non-profit that publishes the Top 10, ASVS, Cheat Sheets,
// SAMM, ZAP, and other free resources. It is the de-facto common language
// of web AppSec.