OWASP Cheat Sheet Series

The OWASP Cheat Sheet Series is a collection of markdown documents that distill application security best practices into short, actionable references. It's built for developers, security engineers, and architects who need quick, trustworthy guidance on how to defend against specific vulnerabilities without reading a full textbook on the topic.

The project is maintained by a team of volunteers under the OWASP Foundation and has grown from an OWASP Wiki initiative into a GitHub-hosted repository with dozens of topic-specific cheat sheets. Each sheet targets a narrow security concern (authentication, input validation, cryptography, session management, and more) and gives concrete recommendations rather than abstract theory.

Key features

• Topic-specific cheat sheets: dozens of markdown files, each focused on one security concern like XSS prevention, SQL injection defense, or secure password storage.
• Community-maintained content: written and reviewed by security practitioners and kept current through pull requests and issue tracking.
• Static site generation: the repository builds into a browsable website via a documented make workflow, so you can run it locally or offline.
• Offline bundle: a downloadable ZIP archive of the full site is available for use without internet access.
• Linting tooling: markdown and terminology linters (via npm) help contributors keep formatting and wording consistent across the series.
• Container support: Docker and Podman build files let you spin up the site in an isolated environment without installing dependencies on your host.
• Open license: content is released under CC-BY-SA-4.0, so teams can adapt and redistribute it with attribution.

Ideal use cases

This repository fits teams and individuals who want a fast, credible reference during development, code review, or security training. Use it when you need a quick answer to "how should I implement this securely" for a common problem like session handling, CSRF protection, or secure file uploads. It also works well as onboarding material for new developers who need a grounding in secure coding practices, or as a source of language-agnostic guidance to plug into internal wikis and security standards.

It is not a good fit if you need a hands-on security scanner, a vulnerability database, or automated code analysis, the repo contains no tooling for that. It also won't replace a full security architecture review or penetration test; it's reference material, not a testing framework. If you need cheat sheets embedded programmatically into an app or CI pipeline, you'll have to build that integration yourself since the project ships as a static documentation site.

Installation

The simplest way to read the cheat sheets is through the official website. If you want to build and run the site locally, clone the repository and use the provided Makefile:

make install-python-requirements
make generate-site
make serve  # Binds port 8000

To check markdown formatting and terminology consistency before contributing:

npm run lint-markdown
npm run lint-terminology

Auto-fix common issues with:

npm run lint-markdown-fix
npm run lint-terminology-fix

For a containerized build, use Docker:

docker build -t cheatsheetseries .
docker run --name cheatsheetseries -p 8000:8000 cheatsheetseries

or Podman:

podman build -t cheatsheetseries .
podman run --name cheatsheetseries -p 8000:8000 localhost/cheatsheetseries

You can also grab a prebuilt, offline copy of the site as a ZIP archive from the automated build link without building anything yourself.