Open Web Application Security Project. Maintains cheat-sheet series and guidance on everything web-application-security related. Recommended by Rafał Rothenberger as a go-to reference; its password-hashing guidance recommends Argon2id.