Vulnerabilities, attack techniques, and defenses for web applications, including OWASP Top 10, XSS, SQL injection, CSRF, authentication and authorization, session management, API security, Content Security Policy, HTTPS, cookie security, and client-side and server-side protection.