2h 58m total
Think like an attacker, code like a defender. This course builds the security instincts every professional engineer needs. You'll start with the web threat model, the CIA triad, and the attacker mindset, then work the OWASP Top 10 (2025) end to end: authentication and session security (bcrypt/argon2, secure cookies, MFA, credential stuffing), broken access control and IDOR, injection (SQL and command) and why parameterization stops it, XSS and CSRF and Content-Security-Policy, cryptography basics with TLS and secrets management, dependency and supply-chain security (SCA/SBOM), and security testing (SAST/DAST) inside a secure SDLC. Every vulnerability is taught defensively — you learn how an attack works only so you can prevent it, and every example ends in the fix. The capstone hardens a deliberately vulnerable app end to end. Assumes basic web and HTTP knowledge; no prior security experience required.
