SOURCE DIRECTORY
Technical sources
Every guide lists its own references. This directory brings together platform documentation, standards and official project sources.
- angr.io
- apktool.org
- appium.io — latest
- approov.io — how does approov work
- attack.mitre.org — mobile
- aws.amazon.com — timeouts retries and backoff with jitter
- bandit.readthedocs.io — latest
- binary.ninja
- capacitorjs.com — docs
- cheatsheetseries.owasp.org
- cheatsheetseries.owasp.org — Authentication Cheat Sheet.html
- cheatsheetseries.owasp.org — Authorization Cheat Sheet.html
- cheatsheetseries.owasp.org — Cryptographic Storage Cheat Sheet.html
- cheatsheetseries.owasp.org — Error Handling Cheat Sheet.html
- cheatsheetseries.owasp.org — File Upload Cheat Sheet.html
- cheatsheetseries.owasp.org — Forgot Password Cheat Sheet.html
- cheatsheetseries.owasp.org — GraphQL Cheat Sheet.html
- cheatsheetseries.owasp.org — Key Management Cheat Sheet.html
- cheatsheetseries.owasp.org — Logging Cheat Sheet.html
- cheatsheetseries.owasp.org — Multifactor Authentication Cheat Sheet.html
- cheatsheetseries.owasp.org — Password Storage Cheat Sheet.html
- cheatsheetseries.owasp.org — REST Security Cheat Sheet.html
- cheatsheetseries.owasp.org — Secrets Management Cheat Sheet.html
- cheatsheetseries.owasp.org — Session Management Cheat Sheet.html
- cheatsheetseries.owasp.org — Transaction Authorization Cheat Sheet.html
- cheatsheetseries.owasp.org — Transport Layer Security Cheat Sheet.html
- cheatsheetseries.owasp.org — WebSocket Security Cheat Sheet.html
- cloud.google.com — envelope encryption
- cloud.google.com — hsm
- codeql.github.com — docs
- cordova.apache.org — security
- cryptography.io — latest
- cryptography.io — aead
- csrc.nist.gov — ssdf
- csrc.nist.gov — final
- csrc.nist.gov — final
- csrc.nist.gov — final
- cutter.re
- cwe.mitre.org
- cyclonedx.org
- developer.android.com — build variants
- developer.android.com — configure app module
- developer.android.com — shrink code
- developer.android.com — broadcasts
- developer.android.com — bound services
- developer.android.com — location
- developer.android.com — notifications
- developer.android.com — copy paste
- developer.android.com — classic
- developer.android.com — overview
- developer.android.com — standard
- developer.android.com — verdicts
- developer.android.com — app bundle
- developer.android.com — tasks and back stack
- developer.android.com — feature delivery
- developer.android.com — page sizes
- developer.android.com — uses sdk element
- developer.android.com — defining
- developer.android.com — content provider basics
- developer.android.com — accessibility
- developer.android.com — credential manager
- developer.android.com — autobackup
- developer.android.com — biometric auth
- developer.android.com — user data ids
- developer.android.com — drm
- developer.android.com — guides
- developer.android.com — abis
- developer.android.com — cryptography
- developer.android.com — keystore
- developer.android.com — android debuggable
- developer.android.com — android exported
- developer.android.com — cleartext communications
- developer.android.com — dynamic code loading
- developer.android.com — insecure webview native bridges
- developer.android.com — intent redirection
- developer.android.com — log info disclosure
- developer.android.com — pending intent
- developer.android.com — secure clipboard handling
- developer.android.com — tapjacking
- developer.android.com — unsafe deserialization
- developer.android.com — webview unsafe file inclusion
- developer.android.com — zip path traversal
- developer.android.com — security best practices
- developer.android.com — security config
- developer.android.com — security key attestation
- developer.android.com — KeyPermanentlyInvalidatedException
- developer.android.com — WindowManager.LayoutParams
- developer.android.com — app signing
- developer.android.com — emulator
- developer.android.com — adb
- developer.android.com — apksigner
- developer.android.com — datastore
- developer.android.com — benchmarking overview
- developer.android.com — power
- developer.android.com — vitals
- developer.android.com — anr
- developer.android.com — launch time
- developer.android.com — app links
- developer.android.com — data storage
- developer.android.com — room
- developer.android.com — documents files
- developer.android.com — location
- developer.android.com — connectivity status type
- developer.android.com — package visibility
- developer.android.com — explaining access
- developer.android.com — requesting
- developer.android.com — secure file sharing
- developer.android.com — espresso
- developer.android.com — ui automator
- developer.android.com — work
- developer.android.com — managed profiles
- developer.apple.com — app extensions
- developer.apple.com — app analytics
- developer.apple.com — app previews
- developer.apple.com — app privacy details
- developer.apple.com — custom product pages
- developer.apple.com — discoverability
- developer.apple.com — product page optimization
- developer.apple.com — product page
- developer.apple.com — ratings and reviews
- developer.apple.com — guidelines
- developer.apple.com — app icons
- developer.apple.com — appclip
- developer.apple.com — backgroundtasks
- developer.apple.com — entitlements
- developer.apple.com — privacy manifest files
- developer.apple.com — cloudkit
- developer.apple.com — cryptokit
- developer.apple.com — devicecheck
- developer.apple.com — establishing your app s integrity
- developer.apple.com — validating apps that connect to your server
- developer.apple.com — fileprotectiontype
- developer.apple.com — urlcache
- developer.apple.com — isexcludedfrombackup
- developer.apple.com — urlsession
- developer.apple.com — localauthentication
- developer.apple.com — lacontext
- developer.apple.com — network
- developer.apple.com — objective c runtime
- developer.apple.com — security
- developer.apple.com — keychain services
- developer.apple.com — preventing insecure network connections
- developer.apple.com — protecting keys with the secure enclave
- developer.apple.com — sharing access to keychain items among a collection of apps
- developer.apple.com — managing your app s life cycle
- developer.apple.com — scenes
- developer.apple.com — uipasteboard
- developer.apple.com — uiscreen
- developer.apple.com — uitextinputtraits
- developer.apple.com — usernotifications
- developer.apple.com — wkwebsitedatastore
- developer.apple.com — wkwebview
- developer.apple.com — widgetkit
- developer.apple.com — xcode
- developer.apple.com — adding identifiable symbol names to a crash report
- developer.apple.com — configuring app groups
- developer.apple.com — defining a custom url scheme for your app
- developer.apple.com — diagnosing issues using crash reports and device logs
- developer.apple.com — distributing your app for beta testing and releases
- developer.apple.com — running your app in simulator or on a device
- developer.apple.com — supporting associated domains
- developer.apple.com — supporting universal links in your app
- developer.apple.com — xctest
- developer.apple.com — create an app store provisioning profile
- developer.apple.com — localize app information
- developer.apple.com — screenshot specifications
- developer.apple.com — Share.html
- developer.apple.com — passkeys
- developer.apple.com — offering account deletion in your app
- developer.apple.com — third party SDK requirements
- developer.apple.com — xcode
- developer.apple.com — testflight
- developer.apple.com — xcode
- developers.google.com — seo starter guide
- developers.google.com — tink
- digital.ai — application security
- doc.libsodium.org
- docs.astral.sh — ruff
- docs.aws.amazon.com — using presigned url.html
- docs.aws.amazon.com — welcome.html
- docs.fastlane.tools
- docs.flutter.dev — obfuscate
- docs.github.com — actions
- docs.github.com — using secrets in github actions
- docs.gradle.org — dependency locking.html
- docs.gradle.org — dependency verification.html
- docs.gradle.org — userguide.html
- docs.maestro.dev
- docs.projectdiscovery.io — overview
- docs.pwntools.com — latest
- docs.pytest.org — stable
- docs.python.org — hashlib.html
- docs.python.org — hmac.html
- docs.semgrep.dev
- docs.sigstore.dev
- docs.sonarsource.com — sonarqube server
- docs.unity3d.com — scripting backends il2cpp.html
- doverunner.com
- eur-lex.europa.eu — oj
- fidoalliance.org — passkeys
- firebase.google.com — test lab
- frida.re — home
- github.com — wycheproof
- github.com — scrcpy
- github.com — smali
- github.com — Mobile Security Framework MobSF
- github.com — ghidra
- github.com — ASVS
- github.com — grype
- github.com — syft
- github.com — androguard
- github.com — TrustKit
- github.com — pyelftools
- github.com — gitleaks
- github.com — bundletool
- github.com — libusbmuxd
- github.com — spec
- github.com — dex2jar
- github.com — pip audit
- github.com — radare2
- github.com — radare2 r2pipe
- github.com — rootbeer
- github.com — IOSSecuritySuite
- github.com — objection
- github.com — jadx
- github.com — Free RASP Community
- github.com — tcpdump
- github.com — trufflehog
- google.github.io — osv scanner
- google.play — store listing experiments
- grpc.io — auth
- hex-rays.com — ida pro
- httptoolkit.com
- hypothesis.readthedocs.io — latest
- kotlinlang.org — multiplatform.html
- learn.microsoft.com — circuit breaker
- libimobiledevice.org
- lief.re
- mas.owasp.org — MASTG KNOW 0118
- mas.owasp.org — MASTG
- mas.owasp.org — MASVS
- mas.owasp.org — 05 MASVS STORAGE
- mas.owasp.org — 06 MASVS CRYPTO
- mas.owasp.org — 07 MASVS AUTH
- mas.owasp.org — 08 MASVS NETWORK
- mas.owasp.org — 10 MASVS CODE
- mas.owasp.org — 11 MASVS RESILIENCE
- mas.owasp.org — 12 MASVS PRIVACY
- mas.owasp.org — MASVS RESILIENCE 1
- mas.owasp.org — MASVS RESILIENCE 2
- mas.owasp.org — MASVS RESILIENCE 3
- mas.owasp.org — MASVS RESILIENCE 4
- mas.owasp.org — MASWE
- mas.owasp.org — checklists
- openid.net — openid connect core 1 0.html
- opentelemetry.io — collector
- opentelemetry.io — signals
- ostorlab.co
- oversecured.com
- owasp.org — API Security
- owasp.org — 0xa1 broken object level authorization
- owasp.org — 0xa3 broken object property level authorization
- owasp.org — 0xa4 unrestricted resource consumption
- owasp.org — 0xa5 broken function level authorization
- owasp.org — Fail securely
- owasp.org — Source Code Analysis Tools
- owasp.org — Threat Modeling
- owasp.org — Vulnerability Scanning Tools
- owasp.org — Web Application Firewall
- owasp.org — Certificate and Public Key Pinning
- owasp.org — www project automated threats to web applications
- owasp.org — www project dependency check
- owasp.org — www project mobile top 10
- owasp.org — www project software component verification standard
- perfetto.dev — docs
- portswigger.net — burp
- promon.io
- promon.io — white box cryptography
- protobuf.dev
- proxyman.com
- reactnative.dev — security
- reproducible-builds.org — definition
- requests.readthedocs.io — latest
- rizin.re
- scapy.net
- scorecard.dev
- slsa.dev
- slsa.dev — spec
- source.android.com — apksigning
- source.android.com — verifiedboot
- spdx.dev
- sre.google — handling overload
- sre.google — monitoring distributed systems
- sre.google — postmortem culture
- sre.google — release engineering
- sre.google — service level objectives
- sre.google — testing reliability
- support.apple.com — web
- support.apple.com — web
- support.apple.com — web
- support.apple.com — web
- support.google.com — 10787469
- support.google.com — 9898842
- trivy.dev
- virustotal.github.io — yara
- wix.github.io — Detox
- aicpa-cima.com — system and organization controls soc suite of services
- appdome.com
- appknox.com
- caido.io
- capstone-engine.org
- charlesproxy.com
- corellium.com
- first.org — specification document
- guardsquare.com — appsweep mobile application security testing
- guardsquare.com — dexguard
- guardsquare.com — introducing mobile app attestation
- guardsquare.com — ixguard
- guardsquare.com — home
- guardsquare.com — mobile application shielding
- guardsquare.com — proguard
- guardsquare.com — threatcast mobile threat defense
- hopperapp.com
- iso.org — 27001
- kvkk.gov.tr — Veri Guvenligine Iliskin Yukumlulukler
- mitmproxy.org
- nist.gov — cyberframework
- nowsecure.com
- pcisecuritystandards.org — mobile payments on cots mpoc
- pcisecuritystandards.org — pci dss
- pnfsoftware.com — jeb
- quokka.io
- rfc-editor.org — rfc2104
- rfc-editor.org — rfc5869
- rfc-editor.org — rfc6238
- rfc-editor.org — rfc7515
- rfc-editor.org — rfc7516
- rfc-editor.org — rfc7519
- rfc-editor.org — rfc7636
- rfc-editor.org — rfc8252
- rfc-editor.org — rfc8439
- rfc-editor.org — rfc8446
- rfc-editor.org — rfc8705
- rfc-editor.org — rfc8725
- rfc-editor.org — rfc8785
- rfc-editor.org — rfc9110
- rfc-editor.org — rfc9111
- rfc-editor.org — rfc9421
- rfc-editor.org — rfc9449
- rfc-editor.org — rfc9700
- talsec.app — appicrypt
- talsec.app — rasp
- unicorn-engine.org
- wireshark.org
- zaproxy.org
- zetetic.net — sqlcipher
- zimperium.com