Security Knowledge Center
An engineering reference for application security — organized by the kind of problem you're actually working on, not by product feature. Every article teaches the underlying concept first and links to where Strata applies it, not the other way around.
Search the Knowledge Center
One search across every article, category, reference collection, reference entry, Decision Center tool, and learning path.
Application Security Reference Database
Look Up a Standard: OWASP, CWE, ATT&CK, CVSS, EPSS, CISA KEV
21 entries across 7 collections — searchable by keyword, collection, and tag. Each one explains the concept in plain terms and links to the official source.
Reference Collections
Technical Articles
How Engineering Managers Quantify Application Security Risk
CI/CD Security Controls Every Engineering Team Should Have
Repository Security Assessment Checklist
APK Static Analysis, Explained
IPA Security Testing, Explained
Vulnerability Prioritization Beyond CVSS
How to Secure AI-Generated Code Before You Ship It
Hardcoded Secrets: Why They Still Reach Production and How Attackers Find Them
Categories at a Glance
| Category | Focus | Featured resources |
|---|---|---|
| Mobile Application Security | Static and dynamic analysis of Android and iOS applications, and the OWASP Mobile Top 10 framework findings map to. | 2 |
| Repository Security | Secret detection, dependency review, SAST patterns, and the access-control practices that keep a codebase auditable. | 2 |
| CI/CD Security | Pipeline trust boundaries, branch protection, artifact integrity, and deployment gating for GitHub Actions and GitLab CI. | 1 |
| Secure SDLC | Treating security requirements as a design constraint from the start, not a review gate at the end. | 1 |
| Vulnerability Management | Turning raw findings into a prioritized, trackable backlog — beyond what a severity score alone can tell you. | 2 |
| Reverse Engineering | Manual analysis of compiled binaries — the toolchain and reasoning static analysis automates a subset of. | 2 |
| Software Supply Chain | Dependency provenance, build artifact integrity, and the trust boundaries every third-party package introduces. | 2 |
| Engineering Leadership | Making application security legible to the people who manage teams and answer for organizational risk. | 1 |
Not Sure Which Category You Need?
How this library is organized
Categories aren't mutually exclusive — an article on CI/CD security controls also appears under Software Supply Chain, because the same content genuinely serves both search intents. Each category page links to the specific articles most central to it and the existing product pages relevant to the topic, so you can go as deep or as product-specific as you need from any entry point.
All Categories
Mobile Application Security
Static and dynamic analysis of Android and iOS applications, and the OWASP Mobile Top 10 framework findings map to.
Repository Security
Secret detection, dependency review, SAST patterns, and the access-control practices that keep a codebase auditable.
CI/CD Security
Pipeline trust boundaries, branch protection, artifact integrity, and deployment gating for GitHub Actions and GitLab CI.
Secure SDLC
Treating security requirements as a design constraint from the start, not a review gate at the end.
Vulnerability Management
Turning raw findings into a prioritized, trackable backlog — beyond what a severity score alone can tell you.
Reverse Engineering
Manual analysis of compiled binaries — the toolchain and reasoning static analysis automates a subset of.
Software Supply Chain
Dependency provenance, build artifact integrity, and the trust boundaries every third-party package introduces.
Engineering Leadership
Making application security legible to the people who manage teams and answer for organizational risk.