HomeLearnGuided project

YOUR SIX-LESSON PATH

Build and secure one small API.

A guided project in six lessons. Keep the same files as you identify an access-control bug, fix it, test it, and investigate its logs. Begin with lesson 01; it needs only a text editor.

Need a hand before you begin? Set up your tools · Look up a term

FOLLOW IN ORDERABOUT 100 MINUTES
  1. 01Plan

    Map the risk before the code

    Trace a private record request and write a testable security requirement.

    15 minOpen lesson ↗
  2. 02Code

    Find and fix a broken access check

    Reproduce an authorization flaw, fix it, and keep the regression tests.

    20 minOpen lesson ↗
  3. 03Build

    Check your runtime

    Make failing security tests stop a build and run the app without root privileges.

    20 minOpen lesson ↗
  4. 04Test

    Turn the regression into a CI gate

    Run the same security tests for changes with a read-only CI token.

    15 minOpen lesson ↗
  5. 05Deploy

    Release to your own machine

    Run a controlled local release, check health, and practice stopping it.

    15 minOpen lesson ↗
  6. 06Monitor

    Investigate a denied request

    Read a useful security event and walk through an incident response decision.

    15 minOpen lesson ↗