Sources & Maintenance
Drupal Research Install
Path: ~/workspace/contrib/web/
Web Sources
| Source | URL | Guide Sections | Last Verified |
|---|---|---|---|
| OWASP Top 10:2021 | https://owasp.org/Top10/2021/ | 2.0 | 2026-02-14 |
| OWASP Cheat Sheet Series | https://cheatsheetseries.owasp.org/ | 1.0-21.0 | 2026-02-14 |
| OWASP XSS Prevention Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html | 4.0, 5.0, 6.0 | 2026-02-14 |
| OWASP Input Validation Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html | 3.0 | 2026-02-14 |
| OWASP SQL Injection Prevention Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html | 7.0 | 2026-02-14 |
| OWASP CSRF Prevention Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html | 8.0 | 2026-02-14 |
| OWASP Authentication Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html | 9.0 | 2026-02-14 |
| OWASP Password Storage Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html | 9.0 | 2026-02-14 |
| OWASP Authorization Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html | 10.0 | 2026-02-14 |
| OWASP Cryptographic Storage Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html | 11.0, 17.0 | 2026-02-14 |
| OWASP Secure Headers Project | https://owasp.org/www-project-secure-headers/ | 12.0 | 2026-02-14 |
| OWASP HTTP Headers Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html | 12.0 | 2026-02-14 |
| OWASP API Security Top 10 | https://owasp.org/www-project-api-security/ | 13.0 | 2026-02-14 |
| OWASP REST Security Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html | 13.0 | 2026-02-14 |
| OWASP File Upload Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html | 14.0 | 2026-02-14 |
| OWASP Logging Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html | 16.0 | 2026-02-14 |
| OWASP SAMM | https://owaspsamm.org/ | 18.0 | 2026-02-14 |
| OWASP ASVS | https://owasp.org/www-project-application-security-verification-standard/ | 20.0, 21.0 | 2026-02-14 |
| CWE-79: Cross-site Scripting | https://cwe.mitre.org/data/definitions/79.html | 5.0 | 2026-02-14 |
| CWE-89: SQL Injection | https://cwe.mitre.org/data/definitions/89.html | 7.0 | 2026-02-14 |
| Microsoft Security Development Lifecycle | https://www.microsoft.com/en-us/securityengineering/sdl | 18.0 | 2026-02-14 |
| Content Security Policy - MDN | https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP | 6.0, 12.0 | 2026-02-14 |
| SameSite cookies explained | https://web.dev/articles/samesite-cookies-explained | 8.0 | 2026-02-14 |
| OAuth 2.0 Security BCP RFC 9700 | https://www.rfc-editor.org/rfc/rfc9700.html | 9.0 | 2026-02-14 |
| DOMPurify | https://github.com/cure53/DOMPurify | 6.0 | 2026-02-14 |
| Bleach (Python) | https://bleach.readthedocs.io/ | 6.0 | 2026-02-14 |
| Cryptography library (Python) | https://cryptography.io/ | 17.0 | 2026-02-14 |
| Dark Reading - Supply Chain Worms 2026 | https://www.darkreading.com/cyberattacks-data-breaches/supply-chain-worms-in-2026-what-shai-hulud-taught-attackers-and-how-to-prepare | 15.0 | 2026-02-14 |
| Silobreaker - Supply Chain Attacks 2025 | https://www.silobreaker.com/blog/cyber-threats/supply-chain-attacks-in-2025-a-month-by-month-summary/ | 15.0 | 2026-02-14 |
| Sygnia - Supply Chain Attacks Q4 2025 | https://www.sygnia.co/threat-reports-and-advisories/supply-chain-attacks-in-q4-2025/ | 15.0 | 2026-02-14 |
| Microsoft - Shai-Hulud 2.0 | https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/ | 15.0 | 2026-02-14 |
| Sonatype 2026 Software Supply Chain Report | https://www.sonatype.com/state-of-the-software-supply-chain/2026 | 15.0 | 2026-02-14 |
| Help Net Security - Open Source Attacks | https://www.helpnetsecurity.com/2026/02/03/open-source-attacks-supply-chain-development-workflows/ | 15.0 | 2026-02-14 |
| Unit42 - Shai-Hulud npm Attack | https://unit42.paloaltonetworks.com/npm-supply-chain-attack/ | 15.0 | 2026-02-14 |
| GitLab - npm Supply Chain Attack | https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/ | 15.0 | 2026-02-14 |
| OWASP Dependency-Check | https://owasp.org/www-project-dependency-check/ | 15.0, 21.0 | 2026-02-14 |
| Snyk | https://snyk.io/ | 15.0, 21.0 | 2026-02-14 |
| PortSwigger - File Upload Vulnerabilities | https://portswigger.net/web-security/file-upload | 14.0 | 2026-02-14 |
| Sourcery - File Upload MIME Bypass | https://www.sourcery.ai/vulnerabilities/file-upload-content-type-bypass | 14.0 | 2026-02-14 |
| SecureFlag - Unrestricted File Upload | https://knowledge-base.secureflag.com/vulnerabilities/unrestricted_file_upload/unrestricted_file_upload_vulnerability.html | 14.0 | 2026-02-14 |
| OWASP Unrestricted File Upload | https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload | 14.0 | 2026-02-14 |
| Redrays - CVE-2025-42910 | https://redrays.io/blog/cve-2025-42910-critical-unrestricted-file-upload-vulnerability-in-sap-srm/ | 14.0 | 2026-02-14 |
| AccuKnox - Best SAST Tools 2026 | https://accuknox.com/blog/best-sast-tools | 18.0, 21.0 | 2026-02-14 |
| Jit - Top 10 DAST Tools 2026 | https://www.jit.io/resources/appsec-tools/top-dast-tools-for-2024 | 18.0, 21.0 | 2026-02-14 |
| OX Security - SAST Tools 2025 | https://www.ox.security/blog/static-application-security-sast-tools/ | 18.0, 21.0 | 2026-02-14 |
| OWASP Source Code Analysis Tools | https://owasp.org/www-community/Source_Code_Analysis_Tools | 18.0, 21.0 | 2026-02-14 |
| Astra - DAST Tools 2026 | https://www.getastra.com/blog/dast/top-dast-tools/ | 18.0, 21.0 | 2026-02-14 |
| Aikido - DAST Tools 2026 | https://www.aikido.dev/blog/top-dynamic-application-security-testing-dast-tools | 18.0, 21.0 | 2026-02-14 |
| MDN Web Security | https://developer.mozilla.org/en-US/docs/Web/Security | 12.0 | 2026-02-14 |
| OWASP Threat Modeling Process | https://owasp.org/www-community/Threat_Modeling_Process | 1.0 | 2026-02-14 |
| W3C Trusted Types specification | https://w3c.github.io/trusted-types/dist/spec/ | 12.1 | 2026-06-09 |
| MDN Cross-Origin-Embedder-Policy | https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy | 12.1 | 2026-06-09 |
| Fetch Metadata request headers — web.dev | https://web.dev/articles/fetch-metadata | 12.1 | 2026-06-09 |
| MDN Clear-Site-Data | https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Clear-Site-Data | 12.1 | 2026-06-09 |
| Practical DevSecOps - STRIDE | https://www.practical-devsecops.com/what-is-stride-threat-model/ | 1.0 | 2026-02-14 |
Code Sources
No Drupal-specific code sources — this guide is tool-agnostic. All code examples are illustrative patterns for modern web development across languages (Python, JavaScript, PHP, Java).