OWASP / wrongsecrets

Vulnerable app with examples showing how to not use secrets

OWASP / www-community

OWASP Community Pages are a place where OWASP can accept community contributions for security-related content.

zaproxy / zap-extensions

ZAP Add-ons

w3c / webappsec

Web Application Security Working Group repo

m0m0x01d / strata

See why a web vulnerability works, not just how to trigger it — a single-file, zero-dependency security lab that renders a vulnerable app as a 7-layer cross-section. 17 labs, attacker & defender modes, AI-authorable.