Application Security & Threat Modeling for Engineers

OWASP Top 10, Cryptography, OAuth2 Pitfalls & Zero-Trust

6 modules, 28 lessons: The Security Mindset; Secrets And Identity; Web Vulnerabilities; API Security; The Supply Chain; Scanning And The Pipeline.

Advanced · 3 hours · 28 lessons · 126 labs

Who it is for

Advanced level.

For backend and API developers who want to find and fix security flaws in their own services, from threat models and secrets to injection, supply chain and pipeline scanning.

What you don't need yet:

What helps:

Before you start:

Take first:

Take next:

Learning paths:

Nobody needs to know everything before they start. Each course builds on the one before, so a learning path takes you there step by step.

Labs

126 labs, 95 of them graded: you write the code, it runs, and graded labs check the result. The outline lists each lesson's labs.

What is free

Start free: First module free with an account. Pro: Every course, lab, handbook, practice exam and certificate.

Course outline

The Security Mindset

  1. The Threat Model Habit (3 labs): You can threat model a change in a few minutes by naming its data flows, its trust boundaries and its entry points, walking STRIDE over each one, and writing down only the answers that change what you build.
  2. Authentication Versus Authorisation (5 labs): You can say which of the two questions a piece of code is answering, verify a password safely with a memory-hard hash and a constant-time compare, and spot the two classic authorisation mistakes: no ownership check, and trusting a role the client sent.
  3. Least Privilege In IAM And RBAC (6 labs): You can read a cloud identity policy and a Kubernetes role for what they actually permit, name the permissions that let a principal grant itself more, and narrow both to the actions and resources a workload really uses.
  4. Secure Defaults (4 labs): You can tell a permissive default from a safe one, make the unsafe setting the one that has to be asked for and refused in production, and design interfaces that fail closed so a new route or a new caller is denied rather than served.

Secrets And Identity

  1. Why Secrets Leak (5 labs): You can name the ordinary routes a secret takes out of a system, prove that deleting a committed file does not remove it, and stop a configuration object or a request logger from printing a live credential.
  2. The Environment Variable Trap (5 labs): You can explain why an environment variable beats a hardcoded credential and still is not a secret store, narrow what a child process inherits, and read a secret from a permission restricted file instead.
  3. Moving To A Secret Manager (6 labs): You can name the five properties a secret manager adds over an environment variable, and build or drive one that enforces a per caller policy, records every read, versions values for rotation, and hands out short leases.
  4. Workload Identity (4 labs): You can explain how workload identity replaces a stored cloud key, verify a short lived exchange for an allowed service, and reject a caller whose identity or audience is wrong.

Web Vulnerabilities

  1. Injection In All Its Forms (4 labs): You can recognise injection as one bug in many interpreters, name the interpreter a piece of code is talking to, and choose the strongest defence available: parameters first, an allowlist where the grammar has no parameters, and escaping only as a last resort.
  2. SQL Injection: The Exploit (4 labs): You can trace a request value into a string-built query, show it changing which rows the database returns, capture that as a failing regression test, and explain how the database account and error handling decide the damage.
  3. SQL Injection: The Fix (4 labs): You can rewrite a string-built query with bound parameters, handle lists and identifiers without concatenating request text, keep the safe form enforced with lint and review, narrow the database account, and prove the fix with a regression test.
  4. Cross-Site Scripting (4 labs): You can find where user text is written into a page, encode it for the exact context with the template engine's escaping and the html module, review the opt-outs, add a Content Security Policy as a second layer, and pin the fix with a rendering test.
  5. Cross-Site Request Forgery (5 labs): You can explain why a session cookie alone cannot prove a request was intended, protect state-changing routes with a session-bound anti-forgery token compared in constant time, add SameSite cookies and Origin checks as layers, and test that a forged request is rejected.
  6. Server-Side Request Forgery (5 labs): You can recognise features where the server fetches a user-supplied URL, restrict them with a parsed scheme and host allow-list, resolve and check the address the server will connect to, refuse unapproved redirects, add network layers, and record destination decisions in a table-driven test.

API Security

  1. TLS And The Handshake (5 labs): You can say exactly what a completed handshake proves and what it leaves open, read a certificate verification error and name the reason, and tell the difference between a client that checks a chain and a client that only encrypts.
  2. Broken Object Level Authorization (5 labs): You can spot an endpoint that trusts an identifier from the caller, move the ownership test inside the data lookup so no route can skip it, answer not found rather than forbidden, and recognise the nested route where the parent is checked and the child is not.
  3. Mass Assignment (5 labs): You can recognise a handler that copies a request body into a model, replace it with a per-operation allowlist that rejects unknown fields loudly, and serialise responses from a named field list so private columns never reach a client.
  4. Rate Limiting And Resource Consumption (3 labs): You can demonstrate an unlimited guessing path and an unbounded page size, then add limits with clear responses and account aware backoff.

The Supply Chain

  1. Dependency Risk And Typosquatting (5 labs): You can describe the trust surface a single install command opens, detect a name that is one edit away from a package you meant, and name the four defences that shrink the surface without stopping delivery.
  2. Lockfiles And Reproducible Builds (5 labs): You can explain what a lockfile pins and what it leaves open, verify delivered artefacts against recorded digests, and describe the three separate things that have to be fixed before a build is reproducible.
  3. Software Bill Of Materials (4 labs): You can generate a machine readable bill of materials for a build, answer whether a new advisory affects you by querying it with a correct version comparison, and say what such a document does not cover.
  4. Provenance And Signing (5 labs): You can explain what provenance records, verify that a release was signed by the expected builder, and reject an artefact whose bytes or origin no longer match the release policy.
  5. Container Security: Minimal Bases And Non Root (5 labs): You can reduce an image attack surface with a minimal base and a non root user, inspect those properties in a Dockerfile, and place an image scan where it can block an unsafe release.

Scanning And The Pipeline

  1. Static Application Security Testing (5 labs): You can explain what static analysis can and cannot see, run a small syntax aware scanner against vulnerable code, and tune a pipeline gate so useful findings stop the build without turning every warning into an emergency.
  2. Dynamic Scanning (4 labs): You can use a running service as a test target, demonstrate a reflected injection and an unauthorised state change, and turn those probes into a repeatable dynamic scan against the fixed service.
  3. Image Scanning And Trivy (3 labs): You can explain why image scanning sees risks a lockfile misses, compare findings across base and application layers, and assign each finding to the team that can fix it.
  4. Secret Scanning (4 labs): You can detect common credential shapes and high entropy strings, explain why scanning history matters, and stop a new secret before it reaches the repository.
  5. How To Stop Drowning In Findings (4 labs): You can turn scanner output into a small risk ranked queue, baseline existing debt, choose useful release gates, and keep exceptions from becoming permanent blind spots.

Certification courses