# tencent/secguide

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/tencent-secguide).**

13,490 stars · 1,951 forks · NOASSERTION

## Links

- GitHub: https://github.com/Tencent/secguide
- awesome-repositories: https://awesome-repositories.com/repository/tencent-secguide.md

## Topics

`guide` `security`

## Description

Secguide is an API security hardening framework and a comprehensive knowledge base of secure coding guidelines. It provides a multi-language security standard and a set of static analysis rules designed to identify security flaws and protect application programming interfaces from common exploits.

The project functions as a reference library of security patterns and remediation guides, maintaining consistent security requirements across various programming languages. It utilizes rule-based pattern matching and a static analysis pipeline to detect dangerous API calls and vulnerabilities within source code.

The system integrates a remediation-driven recommendation engine that suggests direct code replacements and secure alternatives for identified vulnerabilities. It further supports a vulnerability prevention workflow by mapping detected code smells to specific security guidelines and language-specific heuristic analysis.

## Tags

### Security & Cryptography

- [API Security Hardening](https://awesome-repositories.com/f/security-cryptography/api-security-hardening.md) — Identifies risks in application programming interfaces and implements secure coding practices to protect data and system integrity.
- [Language Security Patterns](https://awesome-repositories.com/f/security-cryptography/language-security-patterns.md) — Maintains a consistent set of security requirements and coding patterns across different programming languages used in a project.
- [Secure Coding Practices](https://awesome-repositories.com/f/security-cryptography/secure-coding-practices.md) — Identifies API level security risks and applies specific coding patterns to eliminate vulnerabilities across multiple programming languages. ([source](https://github.com/tencent/secguide#readme))
- [Remediation Guides](https://awesome-repositories.com/f/security-cryptography/security-guides/security-guidance-summaries/remediation-guides.md) — Provides direct code replacements and secure alternatives for identified vulnerable patterns to guide developer fixes.
- [Security Knowledge Bases](https://awesome-repositories.com/f/security-cryptography/security-knowledge-bases.md) — Provides a reference library of security patterns and remediation guides to help developers prevent common software vulnerabilities.
- [Security Guidelines](https://awesome-repositories.com/f/security-cryptography/security-standards/security-guidelines.md) — Provides developers with a structured library of rules and patterns to prevent security vulnerabilities during the writing of code.
- [Static Analysis Security Testing](https://awesome-repositories.com/f/security-cryptography/static-analysis-security-testing.md) — Analyzes source code without execution to find potential security flaws during the development or build process.
- [Security Coding Standards Libraries](https://awesome-repositories.com/f/security-cryptography/security-coding-standards-libraries.md) — Maintains a consistent set of security requirements and coding standards across multiple supported programming languages.
- [Development Integration Workflows](https://awesome-repositories.com/f/security-cryptography/vulnerability-scanning-workflows/development-integration-workflows.md) — Integrates security checks into the development process to eliminate common software bugs and exploits before they reach production.

### DevOps & Infrastructure

- [Recommendation Engines](https://awesome-repositories.com/f/devops-infrastructure/service-mesh-control-planes/manifest-generators/manifest-patching/security-auto-remediation/vulnerability-auto-remediation/recommendation-engines.md) — Generates direct code replacements and secure alternatives based on the specific vulnerability pattern identified.

### Software Engineering & Architecture

- [Security Pattern Matching](https://awesome-repositories.com/f/software-engineering-architecture/security-pattern-matching.md) — Identifies security vulnerabilities by comparing source code against a predefined set of dangerous API calls and patterns.

### Testing & Quality Assurance

- [Static Analysis Rules](https://awesome-repositories.com/f/testing-quality-assurance/static-analysis-rules.md) — Provides a collection of predefined patterns and dangerous API calls used to identify security flaws during source code analysis.

### Part of an Awesome List

- [Language Specific Analysis](https://awesome-repositories.com/f/awesome-lists/devtools/language-specific-analysis.md) — Applies tailored security checks based on the unique syntax and common pitfalls of different programming languages.
- [Security and Compliance](https://awesome-repositories.com/f/awesome-lists/security/security-and-compliance.md) — Security coding guidelines and API risk mitigation strategies.
- [Security And Privacy](https://awesome-repositories.com/f/awesome-lists/security/security-and-privacy.md) — Code security guide for Go.

### Business & Productivity Software

- [Security Pattern Mapping](https://awesome-repositories.com/f/business-productivity-software/knowledge-bases/security-pattern-mapping.md) — Links detected code smells to specific security guidelines and remediation patterns via a structured reference library.