OWASP/SecurityShepherd

View on GitHub

Web and mobile application security training platform

Stars: 1.5k
Forks: 515
Open beginner issues: 0
Indexed issues: 127
Avg merge: 3h 46m
Merged PRs (30d): 1

Dominant language: Java
License: GPL-3.0
Last GitHub push: Sep 2, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: No code of conduct
Beginner labels: good first issue help wanted

Beginner friendly Everything

Open All

127 open issues indexed

Replace iframes on Web Application Open

Enhancement Help Wanted Platform

OWASP/SecurityShepherd#914 · 4 comments · 1 assignee · Opened Aug 28, 2026
Mobile - Test mobile Lessons + Challenges Open

Levels Mobile

OWASP/SecurityShepherd#896 · 1 assignee · Opened Jun 12, 2026
Mobile - Update JSP pages for all mobile lessons and challenges Open

Levels

OWASP/SecurityShepherd#895 · 1 assignee · Opened Jun 12, 2026
Modernize JSTL taglib URIs to jakarta.tags.* (post-jakarta migration) Open

Difficulty 1/5 1-3 hours Newbie friendliness 88/100

OWASP/SecurityShepherd#880 · Opened Jun 5, 2026
Add test coverage for SLS and ACS SAML auth servlets Open

java Test Automation

Difficulty 4/5 3-5 days Newbie friendliness 55/100

OWASP/SecurityShepherd#879 · Opened Jun 4, 2026
Modernize MongoDatabase off legacy com.mongodb.DB API + Testcontainers; rescue disabled MongoDatabaseIT tests Open

Enhancement java Test Automation

Difficulty 5/5 Over a week Newbie friendliness 42/100

OWASP/SecurityShepherd#876 · Opened Jun 4, 2026
ci: least-privilege GITHUB_TOKEN and no long-lived tokens Open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

OWASP/SecurityShepherd#865 · Opened May 31, 2026
perf: parallelize integration tests via GitHub Actions matrix sharding (4 shards) Open

Enhancement github_actions Test Automation

Difficulty 4/5 3-5 days Newbie friendliness 68/100

OWASP/SecurityShepherd#863 · Opened May 29, 2026
Migrate from javax.* (Java EE) to jakarta.* (Jakarta EE 9+) to enable Spring 6 / modern stack Open

Enhancement java

Difficulty 5/5 Over a week Newbie friendliness 30/100

OWASP/SecurityShepherd#861 · 3 comments · Opened May 29, 2026
Replace inefficient new String() constructors in GetterIT.testSSOAuthExistingUserRelogin Open

Difficulty 1/5 Under an hour Newbie friendliness 55/100

OWASP/SecurityShepherd#859 · 1 comment · Opened May 29, 2026
Review/dismiss CodeQL double-checked-locking flag on MongoDatabase.baseMongoClient Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

OWASP/SecurityShepherd#858 · Opened May 29, 2026
Convert challenge/lesson servlets to try-with-resources (connection-leak cleanup) Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

OWASP/SecurityShepherd#857 · 1 comment · Opened May 29, 2026
Refactor remaining Getter.java JDBC sites to try-with-resources Open

Difficulty 4/5 3-5 days Newbie friendliness 68/100

OWASP/SecurityShepherd#855 · Opened May 29, 2026
Replace brittle Tomcat server.xml/web.xml patches with a robust mechanism Open

Difficulty 5/5 Over a week Newbie friendliness 45/100

OWASP/SecurityShepherd#848 · Opened May 29, 2026
Refactor remaining Setter.java JDBC sites to try-with-resources (structural cases) Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

OWASP/SecurityShepherd#846 · 1 comment · Opened May 29, 2026
Timezone bug: suspended user can authenticate on non-UTC JVM deployments Open

Bug

Difficulty 4/5 3-5 days Newbie friendliness 55/100

OWASP/SecurityShepherd#841 · Opened May 11, 2026
Convert ResultSet-returning Getter methods to bounded collections (DAO refactor follow-up) Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

OWASP/SecurityShepherd#839 · Opened May 10, 2026
Add Mobile Lessons / Challenges to platform Open

Levels Mobile Platform

OWASP/SecurityShepherd#830 · 1 assignee · Opened Apr 1, 2026
Remove old mobile content + Replace with new unified app Open

Mobile

OWASP/SecurityShepherd#829 · 1 assignee · Opened Mar 31, 2026
Wire up userLock brute-force protection (stored procedure exists but is unused) Open

OWASP/SecurityShepherd#824 · 1 assignee · Opened Mar 31, 2026
authUserSSO result array: result[3] unset, result[5] double-assigned, wrong log message Open

Bug

OWASP/SecurityShepherd#820 · 1 assignee · Opened Mar 29, 2026
Refactor Getter.java and Setter.java into DAO pattern Open

Difficulty 5/5 Over a week Newbie friendliness 38/100

OWASP/SecurityShepherd#815 · Opened Mar 29, 2026
Move database configuration from build-time to runtime environment variables Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

OWASP/SecurityShepherd#814 · Opened Mar 29, 2026
Publish Mobile App Open

Mobile

OWASP/SecurityShepherd#784 · 1 assignee · Opened Jan 22, 2026
[BUG] Building Web Container Image fails: "Can't rename file ... server.xml ... Invalid argument Open

Bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

OWASP/SecurityShepherd#753 · Opened Mar 24, 2023
[BUG] Mobile apps cannot be built Open

Bug

OWASP/SecurityShepherd#752 · 1 assignee · Opened Mar 15, 2023
[BUG] Integration Tests are not running Open

Bug

OWASP/SecurityShepherd#739 · 1 comment · 1 assignee · Opened Dec 8, 2022
[LOG] regular fatal errors reported in log Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

OWASP/SecurityShepherd#735 · Opened Dec 2, 2022
[BUG] Misleading checkbox "Enable unsafe levels" on page "Get Started" Open

Bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/SecurityShepherd#712 · Opened Nov 10, 2022
[Enhancement] See user email in Admin -> User Management -> Reset Password + Upgrade Player to Admin + Assign Players to Class + Add / Deduct Player Points Open

Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 30/100

OWASP/SecurityShepherd#683 · Opened Jul 21, 2022
[Enhancement] Order level by level name in Admin -> Module Management -> Open / Close Modules (currently ordered by moduleID) - [ ] in fact make this UI better - [ ] drag and drop maybe? Open

Enhancement

Difficulty 3/5 1-2 days Newbie friendliness 35/100

OWASP/SecurityShepherd#681 · Opened Jul 21, 2022
[Enhancement] Turn on and off gold, silver, bronze awards Open

Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/SecurityShepherd#680 · 1 comment · Opened Jul 21, 2022
[Enhancement] Add ability to create an achievement table Open

Enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/SecurityShepherd#679 · Opened Jul 21, 2022
[Enhancement] Make it more obvious where you go to register an account Open

Enhancement

Difficulty 3/5 1-2 days Newbie friendliness 25/100

OWASP/SecurityShepherd#678 · Opened Jul 21, 2022
[Enhancement] Add ability to see a user's email as well as their username from the UI Open

Enhancement

Difficulty 3/5 1-2 days Newbie friendliness 35/100

OWASP/SecurityShepherd#677 · Opened Jul 21, 2022
[Enhancement] Add ability to show CTF rules on the login page Open

Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/SecurityShepherd#676 · Opened Jul 21, 2022
[Enhancement] Add points breakdown when you have the platform in Tournament Mode Open

Enhancement

Difficulty 3/5 1-2 days Newbie friendliness 35/100

OWASP/SecurityShepherd#675 · Opened Jul 21, 2022
[Enhancement] Add timer to open pre-selected levels on the platform Open

Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/SecurityShepherd#674 · Opened Jul 21, 2022
[Enhancement] Add countdown timer to platform Open

Enhancement

Difficulty 3/5 1-2 days Newbie friendliness 35/100

OWASP/SecurityShepherd#673 · Opened Jul 21, 2022
[Enhacement] Add total number of users on platform and total number of users who've completed at least one module Open

Enhancement

Difficulty 3/5 1-2 days Newbie friendliness 35/100

OWASP/SecurityShepherd#672 · Opened Jul 21, 2022
[Enhancement] Add column numbers for Admin -> Module Management -> View Progress Open

Enhancement

Difficulty 3/5 1-2 days Newbie friendliness 35/100

OWASP/SecurityShepherd#671 · 2 comments · Opened Jul 21, 2022
[BUG] XXE levels don't create solution file when opened Open

Bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

OWASP/SecurityShepherd#654 · 1 comment · Opened May 26, 2022
[Epic] UX Improvements for Admins Open

Enhancement

Difficulty 5/5 Over a week Newbie friendliness 20/100

OWASP/SecurityShepherd#653 · 5 comments · Opened May 25, 2022
Replace local JavaScript Libraries with Webjars Open

Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/SecurityShepherd#647 · Opened May 20, 2022
Change Admin Password Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

OWASP/SecurityShepherd#578 · 2 comments · Opened Apr 7, 2021
Tagging challenges with ASVS, CWE, etc Open

Enhancement Levels Platform

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/SecurityShepherd#576 · Opened Feb 1, 2021
Create OWASP API Top Ten Level Tickets Open

Good First Issue Help Wanted Levels

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/SecurityShepherd#575 · 2 comments · Opened Feb 1, 2021
[BUG] New Password Logged in Admin Password Reset Flow Open

Bug

OWASP/SecurityShepherd#571 · 1 assignee · Opened Feb 1, 2021
[Question] is it possible to implement SAML authentication mechanism ? Open

Difficulty 5/5 Over a week Newbie friendliness 15/100

OWASP/SecurityShepherd#564 · 1 comment · Opened Nov 13, 2020
Docker build passes even though landing page does not load Open

Test Automation

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/SecurityShepherd#554 · Opened Mar 6, 2020

OWASP/SecurityShepherd

Get new issues in your inbox