Skip to content

Security

Think like an attacker, build like a defender.

authenticationauthorizationOAuthOIDCJWTSQL injectionXSSCSRFSSRFrate limitingDDoSpassword hashingencryptionIAMzero trust

Lessons

  1. 17.1Authentication vs authorization: RBAC, ABAC, least privilege and IDOR"Who are you?" and "Are you allowed?" sound similar. Mixing them up is one of the most common security bugs on the web. 30 min Booking API playground
  2. 17.2OAuth 2.0 and OpenID Connect: “Sign in with Google”, properlyHow can an app use your Google Calendar without ever seeing your Google password? That's OAuth, and "Sign in with Google" builds on it. 30 min OAuth 2.0 flow
  3. 17.3OWASP Top 10: injection, XSS, CSRF and SSRFFour classic web weaknesses share one root cause. Once you see it, you'll spot them in code reviews and know the proper fix. 30 min SQL injection lab (safe)
  4. 17.4Secrets, hashing and encryptionEncoding, hashing and encryption sound alike but do very different jobs. Plus: where your app's passwords and keys should live. 30 min CI/CD pipeline
  5. 17.5Zero trust: identity over network locationBeing "inside the network" used to mean being trusted. Zero trust checks who you are on every request instead. 30 min

On the job: try it on your own project

Ask Claude Code to run a read-only security review of your app: how users log in, where permissions are checked, any raw SQL or unescaped HTML, how secrets are stored, and which dependencies have known issues. Verify its top findings yourself. Write a ranked list of your top five security risks with an owner and a fix for each.

Can you do this now?

0/4. Anything you can't tick yet: reopen that lesson's practice ladder.