Course 11 · Craft
Security
Assume somebody is trying.
The attacks that actually happen to ordinary web applications, and the defences that stop them — written as code you run, not as a list of warnings.
0 of 16 lessons finished — nothing yet
The syllabus
16 lessons,
in the order they build on each other.
What are you defending?
Assets, attackers and trust boundaries — the five minutes that decide which of the next fifteen lessons matter to you.
Cross-site scripting
The three kinds, why escaping is contextual, and what CSP catches when you miss one.
Injection
SQL, shell, path and template: the same mistake in four languages, and the one fix.
Cross-site request forgery
How another site makes a request as you, and the two lines that stop it.
Passwords
Hashing that is meant to be slow, what a salt is for, and the login that does not leak who exists.
Authorisation
Deny by default, ownership checks, and the id in the URL that belongs to somebody else.
Sessions and tokens
Fixation, rotation, expiry, revocation — and the JWT mistakes that keep recurring.
Secrets
Where a key lives, how it rotates, and what to do the morning after one is pushed.
File uploads
Type checks that are not checks, the origin to serve them from, and the limits that stop a bill.
Server-side request forgery
When your server fetches a URL somebody else chose — and reaches your own network.
Dependencies and the supply chain
Lockfiles, audits, typosquats, and the build step that runs somebody else’s code.
Abuse and rate limiting
Brute force, enumeration, scraping — and limits that hurt attackers more than users.
Logging and detection
What to record, what must never be recorded, and noticing an attack while it happens.
Personal data
Collect less, keep it shorter, and the deletion request that arrives on a Friday.
Hardening a deployment
The configuration checklist: headers, cookies, TLS, CORS and error pages, in one pass.
Practice: review a small app
Nine problems hidden in one codebase. Find them, name them, fix them.
Keep going
The other courses.
HTML
The document, the elements and the meaning behind them. Everything else on the web is layered on top of this.
CSS
Selectors, the box model, layout with flexbox and grid, and motion that has a reason to move.
JavaScript
Values, functions, the DOM, events and asynchronous work — written so you can debug it later.