CheatSheetSeries

The reference security engineers actually keep open: concise, specific guidance on authentication, session management, input validation, cryptographic storage, and roughly ninety other topics, maintained by OWASP. Not theory — each sheet says what to do, what to avoid, and why. This belongs in a directory of tools because it functions as one. Before you implement password storage, file upload handling or JWT validation, the relevant sheet takes ten minutes and prevents the class of bug that shows up in a breach report. CC-BY-SA-4.0, so you can quote it in internal documentation. The tradeoff is that it is documentation, not enforcement: nothing checks that you followed it.