The WordPress Security White Paper, available directly on the WordPress.org site at https://wordpress.org/about/security/ - View it on GitHub