Secure Coding Guidelines¶
Introduction¶
This section is the entry point to the Secure Coding Guidelines that WSO2 Engineers follow while implementing WSO2 products and applications. The guidelines exist to make sure WSO2 products and applications are inherently secure, by codifying the practices that apply throughout the Software Development Life Cycle.
The guide is a single document with stack-specific content in tabs. Each section starts with shared principles, references, and rules that apply across all WSO2 products, then provides Java-stack and Go-stack implementation details in tabs. Click the tab for the stack you work in — Material remembers the choice across the site.
-
The canonical secure coding guide. Covers the OWASP Top 10 - 2025 categories with shared principles + stack-specific implementation for the established Java/Carbon-based products and the new Go-based products.
-
General Recommendations for React Secure Coding
Secure coding best practices for React frontends.
-
OWASP Top 10 - 2025 Prevention
Maps the OWASP Top 10 - 2025 categories to the matching sections in the Java and Go stack guides.
-
OWASP API Security Top 10 - 2023 Prevention
Maps the OWASP API Security Top 10 - 2023 categories to the matching sections in the Java and Go stack guides.
-
Tooling Recommendations for Secure Coding
Documentation on security-related tooling used within WSO2 and recommendations for such tools in the engineering process.