Cybersecurity for Developers

The security mindset and threat modelling

Learn how security people think and use four questions plus STRIDE to find what can go wrong in your own app before attackers do.

The OWASP Top 10 explained

A plain-English tour of the OWASP Top 10:2025: what each risk means, a coffee-shop example, and the main defence, so you can spot these problems in your own code and answer interview questions.

Cryptography basics: hashing, encryption and TLS

Learn the difference between hashing, encryption, signing and TLS, when to use each, and how to use them safely in code without inventing your own cryptography.

Passwords, authentication and MFA done right

Build the core of a safe login in Python: Argon2 password storage, generic errors, rate limiting, TOTP multi-factor codes and secure session cookies, and learn when to use a proven library instead.

Authorisation and broken access control

Reproduce an IDOR bug in a small orders API on your own machine, fix it with object-level and role checks, and lock the fix in with tests, so a customer can never read another customer's order.

Injection attacks: SQL, command and XSS

See how SQL injection, command injection and XSS work on tiny practice code you run yourself, then fix each with parameterised queries, argument lists, output encoding and a CSP header.

Managing secrets and API keys

Keep API keys and passwords out of your code and Git: load them from the environment, ignore .env, understand why frontends cannot hide secrets, scan for leaks and learn what to do in the first hour after one leaks.

Dependencies and supply-chain security

Learn how attackers use the packages you install, then practise the habits that protect you: auditing, lockfiles, hash pinning, vetting new packages and automatic updates with Dependabot.

Securing APIs: rate limits, CORS and input checks

Harden a FastAPI service for Brew & Bean with rate limiting, a CORS allowlist and strict input validation, then test each defence with curl. Learn what CORS does and does not protect.

AI security: prompt injection, data leaks and model risks

Learn the main security risks of apps that use LLMs: prompt injection, unsafe output handling, over-powerful agents, data leaks and model supply-chain issues, and the defences that limit the damage.

Security testing tools: ZAP, Semgrep and Trivy

Install and use three free security tools: Semgrep to scan source code, Trivy to scan dependencies, images and config, and OWASP ZAP to test a running app. Practise only on your own code and a deliberately vulnerable lab.

Practise legally: CTFs and labs

Learn the legal line in security testing, the best free places to practise, and complete your first labs: run OWASP Juice Shop locally, solve a CTF-style decoding puzzle, and plan a six-week path.

Cybersecurity careers and certifications

Understand the main cybersecurity roles, which skills each needs, how entry-level certifications fit, and how to build public proof of skill. A practical map for developers and students.