Web and API security
OWASP Top 10 Explained for Developers
What the OWASP Top 10 is, what each 2025 category means, how to defend it, and how to map Juice Shop challenges to it.
Beginner13 min read
Web and API security
Injection, access control, authentication and the rest of the OWASP list, tested by hand.
Web and API security
SQL Injection Explained with OWASP Juice Shop
How SQL injection changes a query's meaning, why parameterized queries fix it, and a Juice Shop login lab with a Python sqlite3 demo.
Intermediate10 min read
Web and API security
Cross-Site Scripting (XSS) Explained: Types and Defences
Learn reflected, stored and DOM-based XSS, why output encoding depends on context, and how CSP adds defence in depth, in a local lab.
Intermediate11 min read
Web and API security
What Is CSRF and How SameSite Cookies Help
Cross-site request forgery uses your browser's cookies against you. Learn the defences in order of strength and test SameSite with a Flask lab.
Intermediate12 min read
Ask anything your scope allows.
Create an account, add credits from $10 and ask the first question in the chat or the terminal.
- 1/3
Create the account
Individual or company. You can switch to a company later without losing balance or keys.
IndividualCompany - 2/3
Add credits
By card, from $10. Pay per token, no subscription.
$10.00minimum deposit - 3/3
Ask
In the chat, or install the CLI and run notholy login in your terminal.
$ notholy login