What is appsec-forge?
appsec-forge is a GitHub-hosted security engineering knowledge base built around realistic production-inspired cases for Developers, DevOps, AppSec, DevSecOps, and Security Engineers. The Public Edition is also mirrored on GitLab, while the Pro Edition is available exclusively as a private GitHub repository.
Each case is completely self-contained. It starts with a vulnerable implementation, explains the underlying engineering problem, demonstrates how it can be exploited, walks through remediation, and connects the solution to practical DevSecOps workflows. Every case can be studied independently, allowing you to start with the languages, frameworks, infrastructure, or supply-chain technologies you already use.
Version 1 establishes the foundation for this long-term engineering knowledge base.
Version 1 is the current development branch of appsec-forge. New production-inspired cases are added continuously as the repository grows across languages, infrastructure, supply-chain security, AI, and DevSecOps topics.
A concise overview of every release is maintained in the project Changelog, making it easy to see what has been added over time.
Why Version 1 Exists
Security knowledge is everywhere, but production-oriented engineering knowledge is surprisingly fragmented. Blog posts often focus on individual vulnerabilities, documentation explains tools in isolation, and training platforms simplify problems to make them easier to complete.
Real engineering rarely works that way.
Production incidents usually emerge from a chain of decisions involving application code, infrastructure, CI/CD pipelines, dependencies, cloud services, and operational practices. Understanding those connections is what helps engineers make better security decisions before software reaches production.
appsec-forge was created to collect those engineering patterns in one consistent repository.
The Learning Philosophy
appsec-forge follows a simple idea: learn security the same way engineers work.
Instead of progressing through chapters or predefined courses, you navigate the repository naturally. Start with a language, framework, infrastructure technology, or supply-chain component that is already familiar, then explore realistic cases that explain vulnerabilities, remediation strategies, and the engineering decisions behind them.
There are no environments to provision, no exercises to complete, and no hidden progression. Everything is available directly inside GitHub, making the repository a practical reference you can revisit throughout your career.
What Version 1 Includes
Version 1 introduces the complete repository structure together with a growing collection of production-inspired security cases covering application security, infrastructure, DevSecOps, supply-chain security, and AI-related topics.
Every case follows the same engineering workflow:
- understand the feature;
- identify the vulnerability;
- analyze the exploit;
- review the remediation;
- understand the engineering rationale;
- understand the AppSec perspective;
- connect the solution to DevSecOps practices.
The consistency of this structure makes every new case easier to study while gradually building a coherent mental model of secure engineering.
Following the Evolution
appsec-forge is continuously expanded with new production-inspired security cases, technologies, and engineering patterns.
For a concise overview of repository updates, additions, and milestones, see the project Changelog.
Public First
The Public Edition exists because practical security knowledge should be accessible.
It provides realistic vulnerability walkthroughs, exploits, engineering rationale, baseline remediation and DevSecOps implementation guidance directly inside an open GitHub repository. The Pro Edition builds on the exact same cases by expanding them with production-oriented remediation, layered defenses, threat modeling, hardening guidance, detection guidance and scripts, verification scripts, production-oriented DevSecOps configurations, and reusable security checklists.
The goal is not to separate beginners from professionals. The goal is to let every engineer choose the level of depth they need.
Built for Continuous Growth
Unlike traditional learning resources, appsec-forge is designed as a living engineering repository rather than a finished course. New cases continuously expand the library, new technologies broaden its coverage, and every update strengthens the knowledge base without changing its core philosophy.
Version 1 is the foundation of that vision — a repository intended to grow alongside the engineers who use it, one realistic production-inspired case at a time. Future versions will continue expanding the repository while preserving the same learning philosophy, structure, and engineering focus.