Welcome to this repository containing vulnerable code snippets for various security vulnerabilities. The purpose of this repository is to help educate developers and security enthusiasts about common security flaws and how to mitigate them. 😈
https://securitycipher.com/docs/security/secure-code-explain/
This repository is the source collection for SecurityCipher's Secure Code Explain documentation. Each article follows the same compact format:
- A short introduction
## 🥺 Vulnerable Code- An explanation of why the code is vulnerable
## 😎 Secure Code- An explanation of the security controls in the fixed version
The collection now includes 60 examples across web applications, APIs, authentication, cryptography, secure configuration, and AI security.
The AI collection contains code-level examples for all ten OWASP Top 10 for LLM Applications categories:
- LLM01: Prompt Injection
- LLM02: Sensitive Information Disclosure
- LLM03: Supply Chain Vulnerabilities in AI Systems
- LLM04: Data and Model Poisoning
- LLM05: Improper Output Handling
- LLM06: Excessive Agency in AI Agents
- LLM07: System Prompt Leakage
- LLM08: Vector and Embedding Weaknesses
- LLM09: Misinformation and Overreliance
- LLM10: Unbounded Consumption
This project is developed and maintained by Piyush Kumawat. Feel free to reach out to me for any issues, concerns, or contributions. Your feedback and contributions are highly appreciated!
Feel free to contribute additional code snippets for different security vulnerabilities or improvements to the existing ones. Keep the vulnerable and secure examples directly comparable, explain the exact weakness and control, use fenced code blocks with the correct language, and never include working credentials or private targets.