A couple things recently released by the Open Web Application Security Project: