# appsec.guide — Trail of Bits Testing Handbook

`appsec.guide` is the public-facing [[trail-of-bits|Trail of Bits]] Testing Handbook. It's a multi-author, vendor-neutral-within-its-scope guide to security-relevant testing techniques, organized by topic chapter and by programming language within each topic. The fuzzing chapter is the most-developed section; static analysis, cryptography, and web-application chapters round out the rest.

Distinct from the Trail of Bits blog (`blog.trailofbits.com`):
- Blog: time-ordered, single-author posts on engagements, new tooling, novel bugs
- Handbook: reference material — terminology, technique catalogs, walkthroughs — meant to be linked at, not just read once

## Chapters of interest

- **Fuzzing** — see [[appsec-guide-fuzzing-handbook]] for the chapter index summary; sub-chapters cover libFuzzer, AFL++, [[libafl|LibAFL]], cargo-fuzz, Go/Python/Ruby specifics, and cross-cutting techniques
- **Static analysis** — CodeQL, Semgrep
- **Cryptographic testing**
- **Web application testing**

## Ingested chapters

- [[appsec-guide-fuzzing-handbook]] — fuzzing chapter overview: terminology, mutation-based evolutionary algorithm, bug-class taxonomy