Learn security
No security background required. Each guide takes one idea and says what it is, why it matters, where it fits, and which tools do it.
Start hereThe security controls landscapeA plain-language map of software security controls (SCA, SAST, DAST, secret scanning, IaC, licenses) and where each fits in the life of your software.Or take the short way round: SCA → SAST → Secret scanning → Vulnerability prioritization
Code & dependenciesThe code you wrote, and the open-source packages it depends on.4 guidesBuild & artifactsThe images you ship, the files that configure them, and a list of what is inside.5 guidesRunning servicesYour service once it is live, tested from outside the way a stranger reaches it.3 guidesPosture & operationsThe servers and clusters it runs on, and what is known to be attacking them.2 guidesCompliance & governanceShowing an auditor what you checked, and recording the risks you chose to live with.3 guidesCross-cuttingHow problems get named and ranked, and how a pipeline decides to stop a change.10 guides