Build secure software from day one. This two-day foundation course covers the OWASP Top 10, injection defense, authentication, session management, XSS prevention and how to use AI coding assistants (Claude, GPT) as security-aware partners. Hands-on labs on a deliberately vulnerable application.
A hands-on foundation covering the most common web application vulnerabilities and their defenses. Every module includes code-level exercises. (Times are approximate.)
Set the stage for the course by walking through the current application threat landscape. Understand why secure coding matters, how attackers think and how the OWASP Top 10 frames the most common web application risks. This module grounds every technique that follows in real-world breach data.
A practical walkthrough of every item in the OWASP Top 10 (2021 edition), with code samples showing the vulnerable pattern and the secure pattern side by side. Each item is linked to the ASVS verification requirement that addresses it, giving you both the problem and the measuring stick.
Input validation is the first line of defense. Learn allowlist vs denylist, type/length/range/format checks, canonicalization, and where validation sits relative to encoding and sanitization. Hands-on exercises in Python and Node.js validate user input against strict schemas.
Output encoding prevents injection by making data safe for the context it appears in: HTML body, HTML attribute, JavaScript, CSS, URL. Walk through each context, see what happens when encoding is missing, and implement context-aware encoding using standard libraries.
Build authentication the right way. Hash passwords with bcrypt and Argon2id. Create sessions with cryptographically random tokens. Set secure cookie attributes (HttpOnly, Secure, SameSite). Understand why MD5 and SHA-256 are not password hashing algorithms.
Start by exploiting SQL injection against a vulnerable lab app. Extract data, bypass authentication, and escalate. Then fix every vulnerability using parameterized queries, stored procedures, and ORM patterns. Cover second-order injection and how it bypasses naive input filtering.
Exploit reflected, stored and DOM-based XSS in the lab application. Steal session cookies, redirect users, and deface pages. Then deploy the defenses: context-aware output encoding, Content Security Policy headers, and trusted types. Verify each fix blocks the corresponding attack.
Understand how cross-site request forgery works by forging a state-changing request from an attacker-controlled page. Implement synchronizer token patterns, double-submit cookies, and SameSite cookie attributes. See why CORS alone does not prevent CSRF.
Errors are information leaks. Learn how to handle errors without exposing stack traces, database schemas, file paths or version numbers. Build centralized error handlers that log full detail internally while returning safe messages to the client. Cover custom error pages and error response schemas.
Deploy the full set of security headers: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy. Use browser dev tools to verify each header is active and correctly configured. Understand what each header protects against and what it does not.
AI coding assistants are powerful but they generate insecure patterns by default. Learn how to prompt Claude and GPT for security-aware code generation, how to review AI-generated code for common vulnerability patterns, and how to use the ASVS Secure Coder Prompt Pack to steer output toward verified secure patterns.
Your application is mostly other people's code. Learn how to audit your dependency tree, check for known vulnerabilities using tools like npm audit, pip-audit and Snyk, and set policies for acceptable dependency risk. Understand lockfiles, pinning, and what happens when a maintainer goes rogue.
Exploit unrestricted file uploads to achieve remote code execution. Exploit path traversal to read arbitrary files from the server. Then implement the fixes: file type validation, content inspection, filename sanitization, isolated storage, and chroot-style path containment.
Log the right things and never log the wrong things. Learn what to capture for security monitoring (authentication events, authorization failures, input validation failures) and what to exclude (passwords, tokens, PII). Implement structured logging that feeds into SIEM tools.
Given a deliberately vulnerable web application with at least 15 planted vulnerabilities spanning the full OWASP Top 10, find as many as you can, document each one, and fix it. Scored and debriefed as a group. This is the exercise that proves you can apply everything from the course.
Review the secure coding checklist you will take away. Cover ongoing learning resources, how to integrate secure coding into daily development, and how to use the ASVS as a self-assessment tool after the course.
Two days of hands-on secure coding, covering the full OWASP Top 10, with AI-assisted coding techniques using Claude and GPT. Foundation level, no prior security experience required.
Corporate and sovereign cohorts, and bespoke on-site delivery, on request.