A deliberately vulnerable web app for practicing security testing - the most effective way to actually understand OWASP Top 10 vulnerabilities is to exploit them yourself, safely.
Where juice-shop fits, based on its real tags and topics.
git clone https://github.com/juice-shop/juice-shop.gitSee the repository's README for language-specific setup steps.
[](https://owasp.org/projects/#sec-flagships) [](https://github.com/juice-shop/juice-shop/releases/latest) [](https://twitter.com/owasp_juiceshop) [](https://reddit.com/r/owasp_juiceshop)
[](https://github.com/juice-shop/juice-shop/actions/workflows/ci.yml) [](https://github.com/juice-shop/juice-shop/actions/workflows/release.yml) [](https://coveralls.io/github/juice-shop/juice-shop?branch=develop) [](https://dashboard.cypress.io/projects/3hrkhu/runs) [](https://www.bestpractices.dev/projects/223)
> The most trustworthy online shop out there. > (@dschadow) — > The best juice shop on the whole internet! > (@shehackspurple) — > Actually the most bug-free vulnerable application in existence! > (@vanderaj) — > First you 😂😂then you 😢 > (@kramse) — > But this doesn't have anything to do with juice. > (@coderPatros' wife)
Category: 🔒 Security
Difficulty: Beginner
“The default choice for production React today - server components, file-based routing, and first-class deployment story make it the fastest path from idea to shipped app.”
The Postgres development platform. Supabase gives you a dedicated Postgres database to build your web, mobile, and AI applications.
“A genuinely open-source Firebase alternative - real Postgres underneath, with auth, storage, and realtime built in rather than a proprietary database.”
“Utility-first CSS that's become the default styling approach for new projects - fast to write, easy to keep consistent, no dead CSS to prune later.”
“An all-in-one JavaScript runtime, bundler, test runner, and package manager - genuinely faster than the Node.js equivalents it replaces.”
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
“A fast, all-in-one vulnerability scanner - containers, filesystems, git repos, and Terraform/IaC misconfigurations all covered by one CLI tool.”
“The most practical secure-coding reference that exists - concrete, actionable guidance per vulnerability class, not a wall of theory.”
“The standard penetration testing framework - essential for offensive security work, strictly for authorized testing on systems you own or have permission to test.”
“The most widely used free web app security scanner (OWASP ZAP) - a solid first line of defense for catching common web vulnerabilities pre-release.”
“Static analysis that's actually fast enough to run on every pull request - the rule syntax is simple enough that teams write their own custom checks instead of just accepting defaults.”
“Scans commits (and full git history) for leaked secrets - the cheapest insurance policy against an accidental key leak turning into an incident.”
“The industry-standard container orchestrator - not always necessary at small scale, but the default assumption for any serious cloud-native platform team.”
“The most capable open-source relational database available - strong standards compliance, extensions for nearly everything (including full-text search and vectors), and a default choice for good reason.”
“Unifies dozens of LLM providers behind a single API, making model switching almost effortless in production.”
“The standard library for working with open-weight models - thousands of pretrained models are one line of code away.”
“The modern default frontend build tool - native ESM in dev means a dev server that starts and reloads almost instantly, even on large apps.”
“The open-source engine behind Docker - understanding containers here pays off no matter which orchestrator sits on top later.”
