I am reading that ESAPI is no longer under development. Also I am finding it difficult to find a robust ESAPI documentation that guides on how to integrate it step by step.
Is there any alternate library or project I can use to secure my application following lets say top 10 vulnerabilities OWASP. Note: I am kind of working on a POC which might later be transformed into an enterprise application
I have been one of the ESAPI project co-leads for the past 10+ years. We have just released two versions (2.3.0.0 and 2.4.0.0) so far this year and there likely will be another release in July, so it definitely is still under development. (If it's not, someone forgot to tell me.) So either you are reading some very old news (there was a long period of a couple of years without any new releases, not because of lack of activity, but because the process to deploy to Maven Central was never documented), or is it just misinformed news that maybe people retweeted or took out of context by only selecting quoting things.
That said, I don't think ESAPI should necessarily be everyone's go to choice for all security controls. In that vein, years ago, I wrote "Should I use ESAPI?" where I did a very honest evaluation of ESAPI and looked briefly at some of the alternatives.
Since the time I wrote that semi-heretical piece, there has been a lot of ESAPI documentation produced. If it is not exactly what you are looking for, please elaborate and be specific as to what is lacking. It's not perfect, but it's way better than it was...especially the Javadoc.
Also, feel free to reach out to either Matt Seil or myself via email (our emails are on the OWASP ESAPI Project wiki page in the right-hand margin under "Leaders") or pose a question on the new GitHub ESAPI Discussions board and we will be more than willing to follow-up in any way that may be helpful to you.
