Application Security & Secure Coding

Security categories Web Security's browser-focused domain doesn't reach — OS command injection, business-logic abuse, memory-safety bug classes, SAST/DAST/fuzzing, CI/CD pipeline supply-chain risk, privacy by design, and the compliance frameworks engineers actually have to satisfy.

12 lessons

Study 24 cards for this domain

Intermediate

OS command injection: when user input reaches a shellIntermediate3 min read·Not started Business logic vulnerabilities: when every request is technically validIntermediate3 min read·Not started API-specific vulnerabilities: BOLA, mass assignment, and excessive data exposureIntermediate3 min read·Not started SAST, DAST, and fuzzing: three different ways to find a bug automaticallyIntermediate4 min read·Not started Privacy by design: data you never collected can never be breachedIntermediate3 min read·Not started Compliance frameworks an engineer actually encounters: SOC 2, ISO 27001, and PCI-DSSIntermediate3 min read·Not started Credential stuffing and bot mitigation, beyond rate limitingIntermediate3 min read·Not started

Advanced

Memory-safety bug classes, conceptually — why they don't exist in Python or JavaScriptAdvanced4 min read·Not started CI/CD pipelines as an attack surface: third-party actions and script injectionAdvanced3 min read·Not started Defense in depth, and designing for secure-by-default failureAdvanced3 min read·Not started Paved roads: making the secure choice the easy choice, by defaultAdvanced3 min read·Not started A security code review walkthrough, applying this whole domain at onceAdvanced3 min read·Not started