Secure coding guides by language¶
Choose the language or platform you work with to see a focused unsafe/safer example, an explanation of the fix and a benign regression check. Each guide names the relevant runtime or framework so you can adapt the example to your own application. These are learning paths, not a promise that every documented pattern is detected by every scanner.
Web applications and services¶
| Guide | Start with |
|---|---|
| C# and .NET | Typed SQL parameters in an ASP.NET Core service |
| Java | JDBC prepared statements and request boundaries |
| JavaScript | Plain-text DOM output and XSS prevention |
| TypeScript | Runtime JSON validation and resource limits |
| Python | sqlite3 placeholders and safe query construction |
| PHP | PDO binding and scoped database access |
| Go | database/sql arguments and request cancellation |
| Ruby and Rails | Active Record conditions and authorized relations |
Mobile, native and enterprise applications¶
| Guide | Start with |
|---|---|
| Kotlin and Android | Internal activities and manifest exposure |
| Swift and iOS | App Transport Security configuration |
| Objective-C | Constant format strings in Foundation |
| Dart and Flutter | HttpClient certificate validation |
| C and C++ | Bounds checks and safe formatting |
| Apex and Salesforce | SOQL binding, sharing and user-mode access |
| Oracle Forms and PL/SQL | Source exports and dynamic SQL binding |
Additional educational guides¶
Infrastructure as code covers Kubernetes privilege configuration and Terraform secret handling. Rust covers process arguments and application trust boundaries. Product-adapter support for these educational guides is not verified here; confirm available checks before relying on scan results.
Turn an example into a tested fix¶
Read the preconditions before copying code. Preserve the intended behavior, apply the fix at the actual trust boundary, and run the suggested check with local fictional data. Then test the application's permissions and error handling separately. Query parameterization cannot establish record ownership, and text escaping cannot authorize an API request.
Use the language and analysis scope reference to distinguish source, mobile package and dependency review. Browse SQL injection, XSS and command injection when you need the same weakness explained across languages.