OWASP Alchemist Project

Main
While there are extensive resources on the Internet about security architecture and security practices that when implemented effectively across an SDLC produce highly secure and defensible applications. It is easier said than done. Notably, most of the popular programming languages and frameworks contain many security technologies, yet it is not easy to produce an application without security vulnerabilities.

Alchemist aims to bridge these gaps. Alchemist is a free, open source, web application security resource that enables software development teams build high secure and defensible applications. Alchemist is structured for easier adoption and learning of software architects, analysts and programmers, allowing them implement strong security practices into their own web applications.

The current focus is on achieving this objective by architecting and developing a highly secure and defensible application in J2EE on top of Spring framework. The outcome of this exercise is targeted as a reference implementation. The overall objective is to be independent of programming language, yet show-case a real-life application in each of the popular programming languages and frameworks.

OWASP lists a number of common application security vulnerabilities. These apply to most of the programming languages and platforms. The notable exception being buffer overflow and related issues that do not apply to J2EE. .Net and the likes. Alchemist is designed to demonstrate effective mitigation of most of these issues in its reference implementations.

More details on the project, including the high level road-map can be found in the Project About tab. If you'd like to contribute join the mailing list and share your ideas and suggestions on the ongoing progress, and of course your proposal for contribution for the ongoing work or work for other programming languages.