appsec.fyi valid

appsec.fyi

A curated application security resource library covering 25 topics across 6,685+ resources — articles, tools, writeups, and conference talks. Each resource is summarized and indexed by topic, source publisher, primary tool (if applicable), and difficulty level (beginner / intermediate / advanced / news).

For agents: Curated application security library of 6,685+ articles, tools and talks across 25 topics such as XSS, SSRF, SQLi and AI security, with difficulty levels.

application securityweb vulnerabilitiesowasp topicsappsec resourcesllm security

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-25T23:22:33.435Z. Cached copy · Source on appsec.fyi

# appsec.fyi

> A curated application security resource library covering 25 topics across 6,685+ resources — articles, tools, writeups, and conference talks. Each resource is summarized and indexed by topic, source publisher, primary tool (if applicable), and difficulty level (beginner / intermediate / advanced / news).

Content is curated by Carl Sampson (https://chs.us). The site is free, no signup, no ads. A weekly digest goes out via Buttondown. A native app for iOS, iPadOS, and macOS is on the App Store.

## Topics

- [IDOR](https://appsec.fyi/idor.html): Access control flaws via predictable object references (101 resources)
- [XSS](https://appsec.fyi/xss.html): Client-side injection through untrusted input in web pages (385 resources)
- [AI Security](https://appsec.fyi/ai.html): LLM security, prompt injection, and AI-powered attacks (693 resources)
- [XXE](https://appsec.fyi/xxe.html): XML parser exploitation for file read and SSRF (86 resources)
- [SSRF](https://appsec.fyi/ssrf.html): Server-side requests to unintended internal targets (1091 resources)
- [SQL Injection](https://appsec.fyi/sqli.html): Database injection through unsanitized query parameters (155 resources)
- [CSRF](https://appsec.fyi/csrf.html): Forged authenticated requests from cross-origin pages (78 resources)
- [OSINT](https://appsec.fyi/osint.html): Public intelligence gathering for attack surface mapping (128 resources)
- [Python Security](https://appsec.fyi/python.html): Security tools, scripting, and secure coding in Python (217 resources)
- [Burp Suite](https://appsec.fyi/burp.html): Web security testing with Burp Suite proxy and scanner (181 resources)
- [RCE](https://appsec.fyi/rce.html): Arbitrary code execution on remote target systems (822 resources)
- [Bug Bounty](https://appsec.fyi/bugbounty.html): Finding and reporting vulnerabilities for rewards (394 resources)
- [Talks](https://appsec.fyi/talks.html): Security conference presentations and workshops (87 resources)
- [Recon](https://appsec.fyi/recon.html): Subdomain, port, and service discovery techniques (237 resources)
- [Fuzzing](https://appsec.fyi/fuzzing.html): Automated input mutation to discover crashes and bugs (122 resources)
- [GraphQL](https://appsec.fyi/graphql.html): API security risks unique to GraphQL endpoints (115 resources)
- [AuthZ](https://appsec.fyi/authz.html): Broken access control and privilege escalation flaws (262 resources)
- [API Security](https://appsec.fyi/apisec.html): REST and API-specific vulnerability patterns (313 resources)
- [Mobile Security](https://appsec.fyi/mobile.html): iOS and Android application security testing (162 resources)
- [Supply Chain](https://appsec.fyi/supplychain.html): Dependency, build pipeline, and package attacks (777 resources)
- [Secrets](https://appsec.fyi/secrets.html): Credential leaks, secret scanning, and key management (269 resources)
- [Deserialization](https://appsec.fyi/deser.html): Insecure deserialization and gadget chain exploits (101
…

Related sites

Explore similar publishers →

Similar publisher descriptions and documentation. Similarity does not imply affiliation or equivalent capabilities.

Machine-readable: GET /v1/resolve?q=appsec.fyi · GET /v1/domain/appsec.fyi · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for appsec.fyi:
1. POST https://agentwebmap.com/v1/sites/appsec.fyi/claims and keep claim_id and claim_secret private.
2. Publish the verification line "AgentWebMap verification: <token>" (token from step 1) in https://appsec.fyi/llms.txt, or use the DNS, meta-tag or well-known method the response describes. This only verifies the listing; your website and domain remain yours.
3. POST https://agentwebmap.com/v1/sites/appsec.fyi/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/appsec.fyi).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.