Cybersecurity line, station 2 of 4
Application Security for Developers
Build software that resists attack: the OWASP Top 10, threat modelling, secure code review, supply chain and AI app risks.
- 6lessons
- 4 hto read and do
- Intermediatelevel
- 6podcast episodes
- 9checked exercises
Tools you'll use in this course
The lessons open these with a template ready. They work for your own job too, no course needed.
About this course
Most breaches start with a flaw in an application: a missing access check, an injection, a leaked secret or a compromised dependency. This course teaches developers and security engineers to find and prevent these flaws during design and code review, not after an incident.
You will review and fix the patterns behind the Mangrove Partner app's riskiest features: access control between shops, injection, sessions and tokens, a threat model for the new invoice download, dependencies and secrets, and an LLM assistant that can be steered by text it reads. Every exercise runs in your browser against code and data written for the course, with tests that prove each fix. You will use the OWASP Top 10 and ASVS as your checklists and add security checks to CI.
The capstone is an audit-ready security pack for a small practice copy of the Partner app's invoice API that you build, review and fix yourself.
What you will be able to do
- Find and fix the most common web flaws from the OWASP Top 10
- Run a lightweight threat-modelling session for a new feature
- Review code for security and write secure-by-default patterns
- Secure the software supply chain: dependencies, builds and secrets
- Add automated security testing (SAST, DAST, SCA) to CI without drowning in noise
Syllabus
6 stops, about 4 h in total. Each stop fills in when you complete the lesson.
Broken access control
A logged-in partner shop changes one number in a link and reads another shop's invoice. That is broken access control, the most common serious flaw in web applications. This lesson shows how to spot it in a NestJS and PostgreSQL codebase, fix it so it stays fixed, prove the fix with tests and catch anyone who probes for it.
Authentication and authorisationOWASP Top 10Secure code reviewSecurity testing
Injection and unsafe input
SQL injection, cross-site scripting and command injection look like three different bugs. They share one cause: data and code mixed in one string that something then parses. This lesson teaches you to spot that pattern in a code review and replace it with fixes that keep working after the next refactor.
OWASP Top 10Secure code reviewSecurity testing
Authentication, sessions and tokens
Most account takeovers do not break cryptography. They walk through a weak password hash, a session that never changes, or a token nobody checks properly. This lesson shows you, as the developer and the reviewer, how to store passwords, run sessions and validate tokens so that one leak or one bug does not hand over every account.
Authentication and authorisationSecure code reviewSession managementToken validation
Threat modelling a feature
Most security flaws are cheapest to fix before the first line of code. This lesson shows you how to threat-model one feature in about 45 minutes: draw how its data moves, mark where trust changes, walk STRIDE over every piece, and leave the room with ranked tickets that each have an owner and a test.
Threat modellingAuthentication and authorisationSecurity testing
Supply chain and secrets
Most of the code you ship was written by people you have never met, and it reaches production through a pipeline that holds the keys to your cloud. This lesson shows you where that chain can be attacked and the control that belongs at each link: lockfiles and an update policy, SBOMs that answer "are we affected?" in minutes, signed builds, and secrets that are short-lived, scanned and quickly rotated.
Supply-chain securitySecret managementCI/CD security
Security in the pipeline and in AI features
Automated scanners in CI catch whole classes of flaws before they ship, but only if the build fails for real risks and stays quiet otherwise. This lesson sets up that pipeline, then turns to the newest attack surface in the Partner app: an LLM assistant that reads orders, product text and uploaded invoices, and can be talked into misbehaving by any of them.
Security testingLLM securitySecure code review
Capstone: Secure the Partner app before the audit
A realistic project with a rubric and a model answer.
Final exam and certificate
10 questions drawn at random, 70% to pass.
Capstone project
Secure the Partner app before the audit
A partner bank will audit the Partner app before connecting payments. Build a small practice copy of the Partner app's invoice API in Node (NestJS or Express) with login, search, and list and download invoices for a shop, starting from the unsafe patterns shown as the 'before' code in the lessons. Then review it as an auditor would: find the flaws, rate them consistently, fix the important ones with tests that would catch a regression, threat-model the payments feature the bank wants to connect, and add a CI pipeline that fails builds only for real risks. Everything runs on your own machine or in your own repository; never test anyone else's system.
You will hand in
- A findings report with severity ratings and evidence from your practice API
- Fixes as pull requests or commits, each with a test that fails before the fix and passes after
- A threat model for connecting payments: data-flow diagram, trust boundaries, STRIDE threats and mitigations
- A CI security pipeline (SAST, SCA, secret scanning) with documented thresholds and suppressions
Check what you know
Already know some of this? Answer 6 quick questions, one from each lesson, and we will mark the lessons you can skim. It takes about 3 minutes and nothing is graded.
Questions
Is it legal to do these attacks?
Only on systems you own or are allowed to test. Every exercise runs on code and data written for the course in your browser, and the capstone runs on a practice API you build yourself, never on real sites.
Which edition of the OWASP Top 10?
The 2025 edition, which adds software supply chain failures and mishandling of exceptional conditions. The course also uses the OWASP ASVS for detailed checks.
Do I need to know NestJS?
No. Examples use TypeScript in NestJS style, but the patterns apply to any backend. Backend APIs with Node is the suggested preparation.
Does it cover AI features?
Yes. The last lesson covers prompt injection and the controls that work for LLM features, using the OWASP Top 10 for LLM Applications.
Is it really free?
Yes. Every lesson, podcast episode, exercise, quiz, final exam and certificate is free. The labs and their templates for real work are free too. Plus and Premium add every lab challenge, weekly extras and a mentor on top, and they never lock the tools or the courses.
How long does it take?
Each lesson shows an honest time for reading and doing. Most people finish a course in two to four weeks at three or four hours a week.
How does the final exam work?
You get 15 questions drawn at random from a larger bank. You need 70% to pass. If you do not pass, you can try again after 24 hours. The exam is graded on the server and you never see the answer key.