/
Secure Development in OpenMRS

Secure Development in OpenMRS

OpenMRS manages sensitive patient health records across a wide range of clinical environments. Security is not a separate workstream. It is part of how we build, deploy, and maintain the platform.

This space brings together the community's security documentation for anyone who develops, extends, or deploys OpenMRS.

What's Here

OWASP Top 10 for OpenMRS

The ten most critical web application security risks, explained in the context of OpenMRS. Each page covers what the risk is, why it matters for a system handling patient data, where it can appear in the OpenMRS codebase and deployment stack, and how to test for it. Useful for developers, implementers, reviewers, and administrators.

Covers: Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions.

Secure Coding Guidelines for Module Developers

Practical, language-specific guidance for developers writing OpenMRS modules. Organized around what you are building (service methods, REST resources, React components, API calls) rather than vulnerability categories. These translate the OWASP Top 10 risks into concrete patterns, code examples, and review checklists.

Two guides:

  • Java -- backend modules, service layer, DAOs, REST resources, module configuration

  • React/TypeScript -- O3 frontend modules, components, browser-side data handling, dependency management

Where to Start

If you are building a module, go to the Secure Coding Guidelines and pick the guide for your language. The Design Checklist at the end of the Java guide is a good starting point for new modules.

If you are reviewing code or triaging a security concern, the OWASP Top 10 pages give you the conceptual framework, and the Quick Reference tables at the end of each coding guide tell you what to search for.

If you are deploying or administering an OpenMRS instance, the OWASP Top 10 pages cover deployment-level risks like default credentials, misconfigured headers, exposed Swagger docs, and missing HTTPS.