New: Roadmaps ordered paths through our cheat sheets and flashcards, so you always know what to study next.
Explore themSee what's new on GitHubFrom the OWASP Top 10 to shipping code that passes a security review.
A 13-step learning path. Follow it in order, or jump to what you need.
For developers who want their code to survive a real attacker, not just a code review, this is the secure-coding side of application security: the practices, protocols, and defenses you put directly into your own code. Plan on about 8 weeks at a few hours a week, moving from the OWASP Top 10 and threat modeling through cryptography, HTTPS, and secure backend code to authentication flows and API security. This path stays on the coding side: it skips the SOC monitoring and compliance work in the Cybersecurity Analyst path, the exploit-and-report workflow in the Penetration Tester path, and the CI/CD pipeline and supply-chain automation in DevSecOps. By the end you can spot and fix the OWASP Top 10 vulnerabilities in your own code, wire up an OAuth or JWT-based login flow correctly, and lock an API down against broken authorization.
Expected: comfort writing code in at least one language and basic familiarity with how HTTP requests work. Helpful but not required: some experience building a backend or an API.
Names the vulnerability classes, injection, broken access control, misconfiguration, that show up in code you can review starting today, and that every later defense in this path maps back to.
This is where thinking like an attacker clicks, STRIDE turns the abstract categories from step one into concrete risks on your own design; expect to revisit it on every new feature you ship.
You can name the vulnerability classes hiding in your own code and sketch out where an attacker would actually hit it first. Next up: turning that eye into real cryptography and backend defenses.
Finish this section to unlock.
+100 XP
Explains hashing and encryption in plain terms, so the certificates in the next step and the password storage two steps later stop feeling like a black box.
Puts the encryption from step three to work: certificates and the TLS handshake are what actually turns a padlock icon into something you can configure and debug.
Hands you the input validation and injection defenses that fix the attack classes step one named, plus the password storage and secrets handling for the code you write every day.
Surveys API keys, cookies, and token schemes side by side, so you can pick the right one before the next two steps go deep on OAuth and JWT specifically.
You can explain what HTTPS actually buys you, harden a backend endpoint against the OWASP categories from section one, and a few minutes of due flashcards keeps that vocabulary fresh while you build on it. Next up: wiring up OAuth and JWT for real login flows.
Finish this section to unlock.
+100 XP
Step 6 named cookies as one option; here you set them safely: HttpOnly, Secure, and SameSite, session rotation, and the CSRF defenses that decide whether a stolen session id is a shrug or a full account takeover.
Goes deeper on the delegated flows step six only sketched: PKCE and the authorization code flow are what let a third-party app touch a user's data without ever seeing their password.
Zooms into the token format sitting underneath OAuth's access tokens; algorithm confusion and storage mistakes here are some of the most common auth bugs you will actually ship.
Applies the authentication from the last three steps to the APIs themselves, broken object level authorization is the flaw that keeps topping the API-specific OWASP list.
You can set a session cookie that survives a real attack, wire up an OAuth flow, issue and verify a JWT without the classic algorithm-confusion mistakes, and lock an API down against broken object-level authorization. Next up: picking your optional deep-dives and proving it all holds up under testing.
Finish this section to unlock.
+100 XP
Take this if you're shipping a public API: token buckets and sliding windows keep the login endpoints from step six from being brute-forced into submission.
Grab this if you're building consumer signup flows: WebAuthn replaces the passwords step five taught you to store safely with a credential that cannot be phished at all.
Pulls injection, auth, and API defenses from every earlier step into the SAST, DAST, and secure-SDLC habits that actually verify what you built before a user or an attacker does.
You can build, authenticate, and test a web application the way a security-conscious developer does, from the OWASP basics to a working testing habit that catches mistakes before release. This badge marks you as a developer who builds security in from the start, not one who bolts it on after.
Finish this section to unlock.
+100 XP
Finish every required step, at least 70% of them genuinely done (not skipped), to earn this badge and 500 XP.