The Secure-by-Design Principles & Recommendations provide detailed, design-time guidance for building security directly into system architecture. This content focuses exclusively on decisions made during the design phase—well before coding or testing begins.
It does not cover secure coding standards (such as OWASP ASVS), automated scanning, or vulnerability triage. Instead, it presents architecture-level controls that eliminate entire classes of flaws—for example, applying least privilege, enforcing strong isolation, ensuring idempotency, maintaining disciplined schema management, and using mutual TLS (mTLS).
These principles form the foundation for the Secure-by-Design review process and are applied across domains such as architecture, data protection, resilience, access control, and monitoring.
How to Use:
The guidance is organized into six domains as follows.
You can also download the full Secure-by-Design Framework (PDF) for easy offline use.
Project Resources
Project Leaders
ization approaches
secure channel enforcement
secret/key management
policy enforcement mechanisms
ization
Permissions
ization denials
rate-limit behavior)
incident readiness
data protection
resilience
observability—are put into practice
Project Information
Incubator Project
Classification
Other
Language
HTML
Contributors
5
GitHub Stars
11
Downloads
0
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.