Secure development

OWASP, OpenSAMM and related

Security by Design - principles
ASVS - Application Security Verification Standard
API check - understand and mitigate the vulnerabilities and security risks of APIs
OWASP top-10 application vulnerabilities
WebGoat- deliberately insecure web application
Zed - attack proxy
WebScarab - interceptor/modifier for http(s), legacy, replaced by Zed
DependencyCheck - known vulnerabilities and dependencies
DefectDojo - tracking vulnerabilities

BSIMM- Building Security In Maturity Model, a study of existing software security initiatives

Mittn - an evolving suite of security testing tools to be run in Continuous Integration context that uses Python and Behave.
Gauntlt
BDD security- publications