Checkmarx/JS-SCP

Stars
173
Rank 220,124 (Top 5 %)
Language
License
Creative Commons ...
Created almost 7 years ago
Updated about 3 years ago

Checkmarx/JS-SCP

Checkmarx

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

JavaScript Secure Coding Practices guide

JavaScript Web Application Secure Coding Practices is available for download in pdf, MOBI, and ePub.

Introduction

JavaScript Web Application Secure Coding Practices is a guide written for anyone who is using the JavaScript Programming Language for web development. This book is a collaborative effort by the Checkmarx Security Research Team and it follows the OWASP Secure Coding Practices - Quick Reference Guide v2 (stable) release.

The main goal of this guide is to help developers avoid common mistakes while simultaneously learning a new programming language through a hands-on approach. This book provides an in-depth look at 'how to do it securely, showing the kinds of security problems which could pop up during development.

About Checkmarx

Checkmarx is an Application Security software company, whose mission is to provide enterprise organizations with application security testing products and services that empower developers to deliver secure applications. Amongst the company's 1,000 customers are five of the world's top 10 software vendors, four of the top American banks, and many Fortune 500 and government organizations, including SAP, Samsung and Salesforce.com. For more information about Checkmarx, visit https://www.checkmarx.com or follow us on Twitter @checkmarx

About OWASP Secure Coding Practices

The Secure Coding Practices Quick Reference Guide is an OWASP - Open Web Application Security Project, project. It is a "technology agnostic set of general software security coding practices, in a comprehensive checklist format, that can be integrated into the development lifecycle" (source).

OWASP itself is "an open community dedicated to enabling organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. All of the OWASP tools, documents, forums, and chapters are free and open to anyone interested in improving application security" (source).

How To Contribute

This book was created using a few open source tools. If you're curious about how we built it from scratch, read the How To Contribute section.

kics

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

Open Policy Agent

capital

A built-to-be-vulnerable API application based on the OWASP top 10 API vulnerabilities. Use c{api}tal to learn, train and exploit API Security vulnerabilities within your own API Security CTF.

2ms

Too many secrets (2MS) helps people protect their secrets on any file or on systems like CMS, chats and git

chainjacking

Find which of your direct GitHub dependencies is susceptible to RepoJacking attacks

kics-github-action

GitHub actions of KICS scan - Keeping Infrastructure as Code Secure

chainalert-github-action

scans popular packages and alerts in cases there is suspicion of an account takeover

ast-cli

A CLI project wrapping application security testing (AST) APIs

dustilock

DustiLock is a tool to find which of your dependencies is susceptible to a Dependency Confusion attack.

Goatlin

(aka Kotlin Goat) - an intentionally vulnerable Kotlin application

cuteboi

This open-source project tracks CuteBoi's activity over time as there are evidence the actor is still active. All information provided here is intended for research purposes.

Kotlin-SCP

Kotlin Secure Coding Practices is a guide written for anyone using Kotlin for mobile development.

ast-github-action

Checkmarx application security testing (AST) GitHub action

WebViewGoat

A deliberately vulnerable Android application to demonstrate exfiltration scenarios

red-lili

This open-source project tracks RED-LILI's activity over time as there are evidence the actor is still active. All information provided here is intended for research purposes.

ast-vscode-extension

The Checkmarx One Visual Studio Code plugin (extension) enables you to import results from a Checkmarx One scan directly into your VS Code console. You can view the vulnerabilities that were identified in your source code and navigate directly to the vulnerable code in the editor.

kics-cdk-validator-plugin

A KICS plugin for AWS CDK

driffty

Cloud Infrastructure Security Drift Detection - for KICS

Open Policy Agent

ci-cd-integrations

If you are using a CI/CD platform that doesn’t yet have a dedicated Checkmarx plugin, please check this repository.

swag

ast-azure-plugin

The CxAST Azure DevOps plugin enables you to trigger SAST, SCA, and KICS scans directly from an Azure DevOps pipeline.

sast-to-ast-export

CLI tool to export data from CxSAST and import into Checkmarx Application Security Testing Platform

ast-teamcity-plugin

The CxAST TeamCity plugin enables you to trigger SAST, SCA, and KICS scans directly from a TeamCity project.

ast-eclipse-plugin

The CxAST Eclipse plugin enables you to import results from a CxAST scan directly into your IDE. You can view the vulnerabilities that were identified in your source code and navigate directly to the vulnerable code in the editor.

dast-github-action

API-Security-Top-10

ast-visual-studio-extension

The CxAST Visual Studio plugin enables you to import results from a CxAST scan directly into your IDE

JobDeCrypter

A decryption tool for the JobCrypter ransomware

homebrew-ast-cli

NFCdrip

solidity-ddenv

Containerized Solidity Decentralized App Development Environment

kics-codefresh-step

ast-jetbrains-plugin

The CxAST JetBrains plugin enables you to import results from a CxAST scan directly into your IDE.

nexus-security-plugin

SmartBulbExfil

kics-orb

vorpal-reviewdog-github-action

Run Vorpal with reviewdog 🐶