Your browser is blocking local storage, so your progress will be lost when you close or reload this page.

Habits and basic knowledge to keep software, secrets and data safe.

Topics

• Secure Development MindsetExpected level: Working

  Build software on the assumption that mistakes and attacks will happen.

  Not reviewed
• Secrets ManagementExpected level: Proficient

  Keep credentials and sensitive data out of code, logs and chat.

  Not reviewed
• Authentication vs AuthorizationExpected level: Working

  How systems verify who you are (sessions, tokens, API keys) and how they decide what you may do.

  Not reviewed
• Input ValidationExpected level: Working

  Reject malformed or malicious input before you use it.

  Not reviewed
• Password SecurityExpected level: Working

  How to store and handle passwords securely.

  Not reviewed
• Common VulnerabilitiesExpected level: Awareness

  SQL injection, XSS, CSRF and related risks.

  Not reviewed
• Dependency RisksExpected level: Awareness

  Third-party software risks and how to keep them under control.

  Not reviewed
• Data Privacy AwarenessExpected level: Awareness

  Recognise personal and regulated data; involve the Data Privacy Officer early.

  Not reviewed

Self-assessment

You should be able to do each of these without help.

• Explain why credentials must never be committed to source control. Describe what can happen when they are, and why deleting them in a later commit does not fix it.Related: Secrets Management, Ignoring and Excluding Files
• Explain authentication vs authorization. Give an example where a user passes the first and still gets refused by the second.Related: Authentication vs Authorization
• Explain why input must be validated on the server even when the browser already checks it. Describe what an attacker can do by skipping the checks in the browser.Related: Input Validation
• Validate a field on the server. Check type, length and range against an allowlist, and return a clear 400 error without echoing the input back.Related: Input Validation
• Explain why passwords are hashed rather than stored or encrypted. Say what an attacker gets from a leaked database in each case.Related: Password Security
• Describe how SQL injection works and how to prevent it. Show the difference between building a query from strings and using parameters.Related: Common Vulnerabilities, Input Validation, SQL Fundamentals
• Run your ecosystem's dependency audit, such as npm audit. Read one finding and say which package is affected, whether it is a direct dependency, and how it would be fixed.Related: Dependency Risks
• Look at a small feature such as login or file upload and say how it could be abused. Name one design rule, such as least privilege, that limits the damage.Related: Secure Development Mindset