appsec.guide — Trail of Bits Testing Handbook
- title
- appsec.guide — Trail of Bits Testing Handbook
- type
- entity
- summary
- Trail of Bits' open testing handbook; security-testing guidance organized by language and technique, covering fuzzing, static analysis, cryptographic testing, web app testing
- tags
- security, testing, reference, trail-of-bits
- created
- 2026-05-12
- updated
- 2026-05-12
appsec.guide is the public-facing Trail of Bits Testing Handbook. It's a multi-author, vendor-neutral-within-its-scope guide to security-relevant testing techniques, organized by topic chapter and by programming language within each topic. The fuzzing chapter is the most-developed section; static analysis, cryptography, and web-application chapters round out the rest.
Distinct from the Trail of Bits blog (blog.trailofbits.com):
- Blog: time-ordered, single-author posts on engagements, new tooling, novel bugs
- Handbook: reference material — terminology, technique catalogs, walkthroughs — meant to be linked at, not just read once
Chapters of interest
- Fuzzing — see appsec-guide-fuzzing-handbook for the chapter index summary; sub-chapters cover libFuzzer, AFL++, LibAFL, cargo-fuzz, Go/Python/Ruby specifics, and cross-cutting techniques
- Static analysis — CodeQL, Semgrep
- Cryptographic testing
- Web application testing
Ingested chapters
- appsec-guide-fuzzing-handbook — fuzzing chapter overview: terminology, mutation-based evolutionary algorithm, bug-class taxonomy
Linked from