A fix that actually protects data.
Alice can read her note. Bob can’t. You’ll put that decision where it belongs: on the server.
Learn DevSecOps by doing.
Your first security fix starts here.
Follow a small API project from a security bug to a tested fix, or sharpen your Git, Linux, and Docker skills with short terminal exercises.
New to the tools? Get help getting started →
Six guided lessons or 53 practice exercises. No account needed.
Continue learning →Whose note is it, anyway?
Try it ↓AAlice’s private note
Weekend project
Build something small.
Make it work.
Then make it safer.
Who’s asking to read it?
Bob is signed in. Does that mean he can read Alice’s note?
A sample-data demo of the bug you’ll fix in the course.
Proof you didn’t break something else.
Keep the owner’s access working while rejecting the wrong user. Run the tests yourself.
A little confidence in your next release.
Run the app locally, check its behavior, and see how a failing test can stop a bad build.
YOU DON’T NEED TO KNOW EVERYTHING FIRST.
Bring a little curiosity.
We’ll start with the basics.
You’ll need a text editor and some JavaScript familiarity. Choose Local machine with Node.js 24, or use Docker to run Node.js in containers. You only need one of these. GitHub Actions is optional.
Each lesson gives you the steps, the expected result, and help when it doesn’t work.
Let’s start with lesson one →Here for a specific file or a fix?Find it in Resources →