security
Security
The ways real apps get attacked and how to defend them — safe login and sessions, validating input, and the common mistakes that leak data.
Start track →Start from zero
Before the senior material: what web security even is, and the handful of words the rest of the track assumes you already know.Owasp modern
The OWASP Top 10 (2021): what changed and why it matters
The 2021 list moved Broken Access Control to #1 (found in 94% of tested apps) and shifted the whole field from…
OAuth 2.1 and OIDC: delegated authorization that does not leak
PKCE everywhere, exact redirect match, refresh rotation, sender-constrained tokens. Skipping any one mandatory check is a CVE.Jwt pitfalls
JWT security pitfalls: alg confusion, no revocation, and where tokens leak
A JWT is only as safe as how you verify it. The classic failures — accepting alg:none, RS256→HS256 confusion, no…
Csrf
CSRF in the SameSite era: why the default helped but didn''''t kill it
The browser auto-attaches cookies to cross-site requests, so a malicious page can trigger authenticated state changes.…
Password hashing
Password storage: why a slow, salted, memory-hard KDF is the only safe choice
A general-purpose fast hash like SHA-256 is the wrong tool for passwords — a GPU does ~22 billion of them per second,…
Secrets
Secrets management: why a key in git is already a breach
A credential in source code is a leaked credential. Git history keeps it after you delete it, scanners find public keys…
Supply chain
Supply-chain security: your real attack surface is your dependencies
You ship far more third-party code than your own, so the modern attack surface is the install step. Lockfiles, pinned…
Putting it together
Defense in depth: the breach lives in the seam
No single security control is sufficient. Each layer — TLS, auth, authz, input handling, secrets, dependencies — can be…
Build with this track
Guided projects that exercise what you learn here.
JSON parser from scratch
Write a spec-correct recursive-descent parser for JSON — tokenizer, value dispatcher, escape handler, number decoder — and watch every edge case in RFC 8259 become a concrete code path.
A Next.js app to production
Build a multi-tenant content app on the App Router — then run it: lock down auth and secrets, layer the caches, decide every edge-vs-node call, and work the incident when one tenant poisons a shared ISR page.
Mini OAuth 2.0 + PKCE login
Implement the authorization-code + PKCE flow end to end against a real provider, so you understand every redirect and token instead of trusting a library.
Presigned upload flow
Direct-to-storage uploads via presigned URLs with size/content-type limits and a completion webhook that verifies the object actually arrived — so your API server never touches file bytes.
Distributed rate limiter
Build a token-bucket limiter that holds across many app instances by keeping the counter in Redis, not in process memory.
Threat-Model and Harden a Small App
Take a small app you fully own and run it through the loop a real security engineer lives in: first map how an attacker would actually break it, then close those paths one by one. You build an attack tree against your own service, then fix authentication, authorization, secrets handling, security headers, and input validation — and write down which fix kills which branch of the tree. This is the whole craft of defensive security in miniature: not a checklist, but a chain from threat to mitigation you can defend out loud.
URL shortener at scale
Build a URL shortener that survives real traffic — then run it: deploy it, watch it, and work the incident when one hot link melts your cache.
Observability
How to see what your running system is doing — through logs, metrics, and traces — so that when something breaks at 3am you can actually find out why.