Cyber Security developers on Discord

• Join the serverFree, and it takes a minute.
• Pick Cyber SecurityThe Cyber Security room opens, with a pinned starter pack and the roadmap.
• Ask and shareSolved questions get tagged, so the answers stay easy to find.

Tools for Cyber Security work

Start with these 14

• OWASP Cheat Sheet Series: concise security guidance

  Short, practical notes on how to build safely: authentication, session handling, input validation, secrets, REST security, Docker and many more. They are written for developers, not auditors. Browse the cheatsheets/ folder and start with Authentication_Cheat_Sheet.md, then read whatever matches your stack. Good to keep open during code review. License: CC BY-SA 4.0.

  github.comLearningIntermediate

• Trivy: a vulnerability and misconfiguration scanner in Go

  A defensive scanner for container images, filesystems, IaC and dependencies. Reading it teaches how artifacts are unpacked and matched against advisories: pkg/fanal handles analysis of images and files, cmd/ wires the CLI, and docs/ explains usage. Run it against your own Dockerfile first. License: Apache-2.0.

  github.comFull AppAdvanced

• age: a small, modern file encryption tool in Go

  A compact encryption library and CLI designed to be simple and hard to misuse. The core is a handful of readable files such as age.go, x25519.go and scrypt.go, with the command in cmd/ and extensibility in plugin/. A good example of a deliberately small cryptographic API. License: BSD-3-Clause.

  github.comLibraryIntermediate

• OWASP Web Security Testing Guide: a methodical checklist

  A defensive guide for testing web applications you own or are authorised to assess, organised by area such as authentication, session management and input handling. Use document/ for the chapters and checklists/ for working lists you can follow during a review. It also teaches developers what testers look for. License: CC BY-SA 4.0.

  github.comLearningIntermediate

• OpenSSF Scorecard: automated checks on repo security habits

  A Go tool that scores open source projects on practices such as branch protection, dependency updates and pinned workflows. Read ARCHITECTURE.md, then look at checks/ and checks/raw/ to see how each check is implemented. Run it on your own repository. License: Apache-2.0.

  github.comFull AppIntermediate

• Falco: runtime threat detection for containers

  A defensive runtime security tool that watches system activity and raises alerts based on rules. It is worth reading for how kernel events are turned into policy: see userspace/, then falco.yaml and config/ for configuration. Run it in a lab cluster to understand its output. License: Apache-2.0.

  github.comFull AppAdvanced

• OWASP Cheat Sheet Series

  Concise, practical guidance on specific application security topics such as authentication and input validation.

  cheatsheetseries.owasp.orgCheatsheetIntermediate

• Web Security Academy

  Free, legal labs from PortSwigger that teach real web vulnerabilities and how to prevent them.

  portswigger.netPracticeIntermediate

• OverTheWire Wargames

  Legal hacking games that teach Linux and security concepts. Start with Bandit.

  overthewire.orgPracticeBeginner

• Trivy

  An open-source scanner for vulnerabilities and misconfigurations in containers, code and infrastructure.

  trivy.devCLI

• Gitleaks

  Finds passwords, API keys and tokens in your Git history. Run it as a pre-commit hook or in CI before a secret gets out.

  github.comCLI

• Semgrep

  Fast static analysis for many languages, with rules that look like the code you are searching for.

  github.comCLI

• ZAP

  A free, open-source web application security scanner. Only use it against applications you own or have permission to test.

  zaproxy.orgTool

• Wireshark

  The classic network protocol analyzer. See exactly what is on the wire when something will not connect.

  wireshark.orgTool