Product Security Knowledge Base
Product Security Knowledge Base is a curated field library for Product Security, Application Security, DevSecOps, API Security, Cloud Security, Kubernetes security, software supply chain controls, architecture review, security leadership, and practical engineering execution.
The goal is simple: make security work easier to explain, easier to review, and harder to ignore.
Start here
| Goal | Fastest path |
|---|---|
| Browse the full structure | Summary / section tree |
| Get productive quickly | Reading Paths |
| Jump to visual material | Diagram Index |
| Find reusable diagrams, reports, templates, and workbooks | Assets and Reusable Artifact Guide |
| Check terminology | Glossary |
| See design conventions | Visual Style Guide |
Core entry zones
| Section | Why start there |
|---|---|
| Strategy, Governance, and Leadership | operating models, ownership, metrics, executive narratives, staffing, and Product Security leadership patterns |
| Application Security and Secure SDLC | threat modeling, AppSec review playbooks, SAST, secrets, frontend security, business logic abuse, and stack-specific engineering guidance |
| DevSecOps, CI/CD, and Supply Chain | pipelines, runners, approvals, scanning, SBOMs, signing, attestations, release evidence, and secure delivery patterns |
| Cloud, Kubernetes, and Infrastructure Security | IAM, cloud baselines, Terraform, Ansible, Vault, Docker, Kubernetes, runtime controls, and platform hardening |
| Architecture, API, Crypto, and Identity | API authorization, abuse resistance, GraphQL, service identity, mTLS, crypto design, data protection, and secure architecture patterns |
| Attack Paths, Testing, Detection, and Hardening | cloud/Kubernetes attack chains, detection engineering, runtime response, investigation playbooks, and hardened review paths |
| Metrics, Audit, Risk, Evidence, and Compliance | SOC 2-style evidence, compliance mapping, maturity models, governance artifacts, audit narratives, and risk translation |
| Learning, Labs, Interviews, and Reusable Artifacts | hands-on labs, interview packs, scorecards, self-study tracks, reusable templates, snippets, and field-ready examples |
Reading bias
This KB favors defensive engineering, operator judgment, reviewable controls, and plain American-English technical writing over vendor hype or abstract compliance theater.
Expect short decision frameworks, concrete review questions, configuration snippets, checklists, diagrams, and leadership-ready translation where the engineering work needs to be understood by non-security stakeholders.
Included sample artifacts
- Quarterly Product Security Review — PDF Sample
- DAST Executive Summary — PDF Sample
- Web Scanner Header Findings — PDF Sample
- OWASP SAMM Self-Assessment Example — DOCX
- BSIMM Self-Assessment Example — DOCX
- OWASP SAMM Self-Assessment Example — HTML
- BSIMM Self-Assessment Example — HTML
- Product Security Self-Assessment Workbook — XLSX
- Product Security Tool Inventory Workbook — XLSX
Current release snapshot
The current structure is organized as a practical Product Security operating library: strategy and governance at the top, engineering execution in the middle, and reusable artifacts, labs, snippets, and assessment material close enough to support day-to-day work.
It is intended for engineers, architects, AppSec and DevSecOps practitioners, cloud/platform teams, security managers, and senior leaders who need to connect technical controls with delivery reality.
