Start for Free

Learning

Learn secure development workflows

Practical guides for developers, AppSec, and platform teams.

Showing 20 of 39 resources

GitHub npm v12 Security Changes: What Teams Need to Know

npm v12 turns Git dependencies, remote URLs, and install scripts into explicit opt-ins. Learn what is changing, why GitHub made these defaults, and how to prepare before the July 2026 release.

Corgea Security Team Corgea Security Team
intermediate • 10 min read
Supply Chain SecuritynpmNode.js

Application Security Testing: The Complete Guide (2026)

A complete guide to application security testing (AST): the 5 core types (SAST, DAST, IAST, SCA, RASP), a tools comparison table, where each test fits in the SDLC, how to choose, and best practices.

Corgea Security Team Corgea Security Team
intermediate • 14 min read
application-securityappsecsast

How to secure developer machines against supply chain attacks

A pragmatic developer machine security checklist for supply chain attacks, covering package installs, extensions, credentials, OS hardening, CI/CD trust boundaries, and incident response.

Corgea Security Team Corgea Security Team
intermediate • 12 min read
Supply Chain SecurityDeveloper WorkstationsOpen Source Security

C# Security Best Practices

A practical C# and .NET security guide covering ASP.NET Core validation, authorization, EF Core, secrets, NuGet risk, and Corgea scanning.

Corgea Security Team Corgea Security Team
intermediate • 7 min read
C#.NETASP.NET Core

CI/CD Security Guide: Best Practices for Secure Pipelines

A platform-agnostic CI/CD security guide covering tokens, secrets, OIDC, runners, artifacts, caches, release workflows, scanning, and Corgea.

Corgea Security Team Corgea Security Team
intermediate • 8 min read
CI/CD SecurityDevSecOpsSupply Chain Security

Docker Security Best Practices

A 2026 Docker security guide covering image hardening, non-root containers, secrets, SBOMs, Compose, runtime controls, CI/CD scanning, and Corgea.

Corgea Security Team Corgea Security Team
intermediate • 7 min read
DockerContainer SecuritySupply Chain Security

Put these guides into practice

Scan your repos with Corgea's AI-powered security platform — free to start.

Get Demo Start for Free

Kubernetes Security Checklist 2026

A practical Kubernetes security checklist for 2026 covering RBAC, Pod Security, network policies, secrets, images, admission controls, IaC, and Corgea scanning.

Corgea Security Team Corgea Security Team
intermediate • 7 min read
KubernetesContainer SecurityCloud Security

Node.js Security Best Practices 2026

A practical Node.js security checklist for 2026 covering validation, auth, npm dependencies, secrets, Express hardening, CI/CD, and Corgea scanning.

Corgea Security Team Corgea Security Team
intermediate • 8 min read
Node.jsJavaScriptApplication Security

PHP Security Best Practices

A modern PHP security checklist covering input validation, PDO, sessions, file uploads, Composer dependencies, secrets, frameworks, and Corgea scanning.

Corgea Security Team Corgea Security Team
beginner • 7 min read
PHPWeb SecuritySecure Coding

Terraform Security Best Practices

A practical Terraform security guide covering state protection, secrets, provider pinning, module trust, cloud IAM, policy-as-code, CI/CD, and Corgea IaC scanning.

Corgea Security Team Corgea Security Team
intermediate • 7 min read
TerraformInfrastructure as CodeCloud Security

GitHub Actions Security Checklist for Supply Chain Attacks

Use this GitHub Actions security checklist to lock down workflow permissions, secrets, third-party actions, runners, artifacts, and release pipelines after recent CI/CD supply chain attacks.

Ahmad Ahmad
intermediate • 10 min read
GitHub ActionsCI/CD SecuritySupply Chain Security

What Is SAST? Static Application Security Testing Explained

Learn what SAST stands for, what it means, how static application security testing works, what vulnerabilities it finds, and how to implement it effectively in your SDLC.

Corgea Security Team Corgea Security Team
beginner • 20 min read
sastapplication-securitystatic-analysis

Best SAST Tools in 2026: Compared & Ranked

Compare the 10 best SAST tools in 2026 side by side. Includes feature matrix, AI capabilities, false-positive rates, language support, and guidance on choosing the right static analysis tool for your team.

Corgea Security Team Corgea Security Team
beginner • 17 min read
sastapplication-securitystatic-analysis

Must-Have Cursor Rules for TypeScript Developers

A practical set of Cursor rules for TypeScript teams that helps block unsafe code patterns, secret leaks, missing auth checks, and other common security mistakes.

Ahmad Ahmad
beginner • 7 min read

All You Need to Know About DAST in 2025 - Comprehensive Guide

Dynamic Application Security Testing (DAST) is a black-box security testing technique that evaluates a web application while it is running. Instead of analyzing source code, DAS...

Ahmad Ahmad
beginner • 3 min read

Angular Security Best Practices 2025

Angular is one of the most widely used frameworks for building modern web applications. But with its popularity comes increased attention from attackers. A single overlooked vul...

Ahmad Ahmad
beginner • 4 min read

Credential Stuffing

In the rapidly evolving digital landscape, businesses grapple with a myriad of cybersecurity threats. Among these, credential stuffing emerges as a serious challenge, especially...

Ahmad Ahmad
beginner • 3 min read

Django Security Best Practices: A Comprehensive Guide for Software Engineers

Django, the robust and versatile Python web framework, is a favorite among developers for its "batteries-included" philosophy. However, with great power comes great responsibili...

Ahmad Ahmad
beginner • 5 min read

Denial of Service Attacks

A Denial of Service (DoS) attack is when an attacker tries disrupting the normal functioning of a targeted server, service, or network. The primary goal is to make the targeted...

Ahmad Ahmad
beginner • 3 min read

Security Teams: Don't fall for this LLM trap

I'm Ahmad, the founder of Corgea. We're building an application security platform that automatically finds, triages, and fixes insecure code. Corgea uncovers vulnerabilities oth...

Ahmad Ahmad
beginner • 4 min read