Issues

• docs: testing.md lists Maven 3.x, but the build needs 3.9.2 or newer

  Documentation
  OWASP/SecurityShepherd#1097 · Filter by author ismisepaul opened on Nov 1, 2026

• docs: note that Spotless fails on JDK 25 in CONTRIBUTING.md

  OWASP/SecurityShepherd#1094 · Filter by author HusainMain opened on Oct 31, 2026

• Reassess the "Project Sponsors" section: do any of the orgs sponsor the project today

  PlatformWebApp
  OWASP/SecurityShepherd#1087 · Filter by author ismisepaul opened on Oct 29, 2026
  1

• Docs: generated level catalogue, CTF runbook and other site improvements

  DocumentationEnhancement
  OWASP/SecurityShepherd#1086 · Filter by author ismisepaul opened on Oct 28, 2026

• Docs: publish versioned documentation with mike, and move the 3.1 wiki into it

  Documentationgithub_actions
  OWASP/SecurityShepherd#1085 · Filter by author ismisepaul opened on Oct 28, 2026

• Move to a single main branch and retire dev and master

  Distributiongithub_actions
  OWASP/SecurityShepherd#1084 · Filter by author ismisepaul opened on Oct 28, 2026

• Setup fails with "No suitable driver found" when Tomcat started without database.properties

  BugPlatform
  OWASP/SecurityShepherd#1082 · Filter by author ismisepaul opened on Oct 28, 2026
  1

• Docs: organise the documentation site by audience and fill the gaps

  Documentation
  OWASP/SecurityShepherd#1081 · Filter by author ismisepaul opened on Oct 28, 2026

• Rewrite and re-enable SetupIT's disabled testNoCoreDatabase / testNoMysqlResource

  PlatformTest Automation
  OWASP/SecurityShepherd#1073 · Filter by author ismisepaul opened on Oct 26, 2026
  1

• Re-enable GetterIT.testAuthUserCorrectEmojiUsername (disabled since 2019)

  PlatformTest Automation
  OWASP/SecurityShepherd#1072 · Filter by author ismisepaul opened on Oct 26, 2026
  1

• [BUG] DatabaseLifecycleListenerTest database tests always skipped in CI (no DB in unit-tests job)

  BugTest Automation
  OWASP/SecurityShepherd#1071 · Filter by author ismisepaul opened on Oct 26, 2026
  1

• DirectObjectBankLogin holds a challenge-pool connection while bankForm() borrows a second one

  BugLevels
  OWASP/SecurityShepherd#1063 · Filter by author ismisepaul opened on Oct 26, 2026
  1

• Set up the databases with scripts on stock MariaDB/MongoDB images instead of custom images

  DistributionEnhancementPlatform
  OWASP/SecurityShepherd#1046 · Filter by author ismisepaul opened on Oct 25, 2026 · 4.0.0
  1

• Test the published Tomcat image: smoke test, build once/test/push, digest-pinned base image

  Distributiongithub_actionsTest Automation
  OWASP/SecurityShepherd#1039 · Filter by author ismisepaul opened on Oct 25, 2026

• Dependency audit: what we can remove or consolidate (follows trim-reaper)

  dependenciesjavaPlatform
  OWASP/SecurityShepherd#1022 · Filter by author ismisepaul opened on Oct 25, 2026
  2

• Docs: make clear the Docker Compose setup is a quick start, not a production deployment

  DistributionDocumentation
  OWASP/SecurityShepherd#1020 · Filter by author ismisepaul opened on Oct 25, 2026 · 4.0.0

• CsrfChallengeSixGetToken is unreachable and its database user and schema don't exist

  Levels
  OWASP/SecurityShepherd#1006 · Filter by author ismisepaul opened on Oct 25, 2026

• [Security] jtidy r938 in FindXSS loops forever on some short XSS submissions (one request pins a CPU core)

  BugdependenciesPlatform
  OWASP/SecurityShepherd#1002 · Filter by author ismisepaul opened on Oct 25, 2026 · 4.0.0
  2

• Code scanning: redundant new String("...") constructors across src/main/java

  java
  OWASP/SecurityShepherd#999 · Filter by author ismisepaul opened on Oct 25, 2026
  1

• Record the version and source of the vendored clipboard.js, or replace it

  dependenciesWebApp
  OWASP/SecurityShepherd#997 · Filter by author ismisepaul opened on Oct 24, 2026

• lessons/adminOnly/resultKey.jsp loads its script from a path that 404s

  BugWebApp
  OWASP/SecurityShepherd#996 · Filter by author ismisepaul opened on Oct 24, 2026

• index.jsp: CTF countdown never clears, malformed deletePlayers error HTML, debug alert on success messages

  BugWebApp
  OWASP/SecurityShepherd#995 · Filter by author ismisepaul opened on Oct 24, 2026
  1

• [BUG] NoSQL Injection 1 only answers once per Tomcat run: the servlet closes the shared MongoClient

  BugLevels
  OWASP/SecurityShepherd#992 · Filter by author ismisepaul opened on Oct 24, 2026 · 4.0.0

• [BUG] SQL Injection 5 coupon check throws MissingResourceException on a failed query

  BugLevels
  OWASP/SecurityShepherd#990 · Filter by author ismisepaul opened on Oct 24, 2026
  1

• docs/database-configuration.md documents the wrong Mongo pool property names

  Documentation
  OWASP/SecurityShepherd#989 · Filter by author ismisepaul opened on Oct 24, 2026