Appsec person here with a potentially unpopular opinion.<p>I find OWASP guidance generally lags behind latest research by at least a couple of years.<p>All too commonly the projects seem like CV padding pieces that get abandoned and not updated (I re-iterate, not all OWASP projects, just a lot of them).<p>If you are developer who wants to learn more about appsec, I’d recommend checking out pentesterlab.com and working through the exercises there.