1. SECURE DEVELOPMENT

2. SEI CERT TOP 10 SECURE CODING PRACTICES Validate input Use strict compiler settings and resolve warnings Architect and design for security policies Keep it simple Default deny Adhere to principle of least privilege Sanitize data sent to other systems (especially the client!) Practice defense in depth Use good quality assurance techniques (including security testing) Adopt a secure coding standard (standard development stack/libraries) https://www.securecoding.cert.org/confluence/display/seccode/Top+10+Secure+Coding+Practices

3. OWASP TOP 10 Injection flaws Broken authentication and session management Cross-site scripting (XSS) Insecure direct object references Security misconfiguration Sensitive data exposure Missing function level access control Cross-site request forgery (CSRF) Using components with known vulnerabilities Unvalidated redirects and forwards https://www.owasp.org/index.php/Top_10_2013-Top_10

4. MOZILLA WEBAPPSEC SECURE CODING GUIDELINES Authentication Session Management Access Control Input Validation Output Encoding Cross Domain Secure Transmission Content Security Policy Logging Admin login pages Uploads Error Handling https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines