Skip to content
Miraat·dweb developer journey, reflected
IT EN FR عربي
SE

Application Security

Think like an attacker to write code that resists. Vulnerabilities, hardening, audits.

18 skills 7 months Advanced
To write secure code you first need to understand how code breaks. This path teaches you the main vulnerability classes (OWASP Top 10), the threat model of web applications, and how hardening, audits, and incident response work in practice.

It is not a hacking course: it is defensive training, designed for developers who want to reduce risk in the products they ship, and for people moving into AppSec or blue-team roles.

Outcomes: AppSec engineer, blue-team analyst, security-focused full-stack.
Threat Modeling · 25 min FOUNDATION · 25 MIN Threat Modeling OWASP Top 10 Deep Dive · 30 min FOUNDATION · 30 MIN OWASP Top 10 Deep Dive SQL Injection — Defense · 30 min CORE · 30 MIN SQL Injection — Defense XSS Defense · 30 min CORE · 30 MIN XSS Defense CSRF Defense · 25 min CORE · 25 MIN CSRF Defense SSRF Defense · 25 min ADVANCED · 25 MIN SSRF Defense Authentication Weaknesses · 30 min CORE · 30 MIN Authentication Weaknesses Session Management · 25 min CORE · 25 MIN Session Management JWT Pitfalls · 25 min ADVANCED · 25 MIN JWT Pitfalls Remote Code Execution · 30 min ADVANCED · 30 MIN Remote Code Execution TLS Configuration · 25 min CORE · 25 MIN TLS Configuration HTTP Security Headers · 20 min CORE · 20 MIN HTTP Security Headers Secrets Management · 25 min CORE · 25 MIN Secrets Management Dependency Security · 20 min CORE · 20 MIN Dependency Security Vulnerability Scanning · 25 min ADVANCED · 25 MIN Vulnerability Scanning Security Code Review · 30 min ADVANCED · 30 MIN Security Code Review Incident Response · 30 min ADVANCED · 30 MIN Incident Response Logging for Security · 25 min CORE · 25 MIN Logging for Security

Foundation

1
Threat Modeling
Mapping assets, attackers and entry points. STRIDE for the practical engineer.
25 minutes
2
OWASP Top 10 Deep Dive
The ten most common families of bugs explained with real CVEs and fixes.
30 minutes

Core

3
SQL Injection — Defense
Why prepared statements always win, ORM safety, blind injection patterns.
30 minutes
4
XSS Defense
Output encoding, CSP, trusted types, sanitizing only at boundaries.
30 minutes
5
CSRF Defense
Tokens, SameSite cookies, double-submit, when same-origin is enough.
25 minutes
7
Authentication Weaknesses
Credential stuffing, brute force, password reset flaws, MFA bypass.
30 minutes
8
Session Management
Cookie attributes, fixation, hijacking, rotation on privilege change.
25 minutes
11
TLS Configuration
Cipher suites, modern profiles, automatic renewal, HSTS preload.
25 minutes
12
HTTP Security Headers
CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy. Cheap big wins.
20 minutes
13
Secrets Management
Vault, KMS, sealed secrets. Rotation. Never in git, never in env files in production.
25 minutes
14
Dependency Security
Lockfiles, audit, automated upgrades, known-vuln databases.
20 minutes
18
Logging for Security
What to log, what NOT to log (PII!), tamper-evident chains, retention.
25 minutes

Advanced

6
SSRF Defense
Server-side request forgery: allowlists, metadata-IP blocking, isolated egress.
25 minutes
9
JWT Pitfalls
alg=none, key confusion, replay, why short-lived tokens beat blacklists.
25 minutes
10
Remote Code Execution
Unsafe deserialization, eval-like APIs, command injection, supply chain.
30 minutes
15
Vulnerability Scanning
SAST, DAST, dependency scanners. Wiring them into CI without false-positive fatigue.
25 minutes
16
Security Code Review
Spotting common bugs in PRs: a checklist that scales beyond intuition.
30 minutes
17
Incident Response
Detect, contain, eradicate, recover. Communication. Blameless postmortem.
30 minutes