A little help getting started.

FIRST, THE IDEA

What is DevSecOps?

It means making security part of how a team builds, tests, releases, and runs software. Developers, security specialists, and operations teams share that work.

A RECOMMENDED ROUTE

Start where you are.

This is a suggested order, not a locked course. Skip a step when you can explain and do its task without the solution.

1. 1

   Find your way around a terminal

   Create a practice folder, write a file, and read it back.

   Terminal warm-up →
2. 2

   Save a change with Git

   Learn the difference between a file, staging, and a commit.

   Make your first commit →
3. 3

   Get comfortable with files

   Try Linux files and permissions if you have Linux or WSL. You can start the security project without this track.

   Organize practice files →
4. 4

   Understand a container

   Build and run an image if you want the Docker route. Docker is optional; the security project also runs directly with Node.js.

   Build your first image →
5. 5

   Make your first security fix

   Follow the six lessons: understand the risk, fix access, keep a test, and investigate a decision.

   Open the guided project →

Am I ready for the project?

Use these as a quick self-check. These boxes are temporary; they are not saved or used to block lessons.

If JavaScript is unfamiliar, read the MDN introduction to variables, conditions, and functions. Lesson 01 only needs a text editor.

WORDS YOU’LL MEET

A small glossary.

Terminal & shell

The terminal is the window where you type commands. The shell interprets them. PowerShell and Bash are different shells; a command written for one may not work in the other.

API

A way for programs to ask each other for information or actions. In this project, a request asks the server for Alice’s note; the server decides whether to return it.

Repository

A project tracked by Git, including its saved history. The hidden .git folder stores that history. A repository does not need to be uploaded to GitHub.

Staging & commit

Staging chooses the file contents for your next saved snapshot. A commit records that snapshot in Git history. Saving in your editor, staging, committing, and uploading are separate actions.

Image & container

An image is a packaged filesystem and configuration. A container is an instance created from an image. Building an image and running a container are separate steps.

Authentication & authorization

Authentication establishes who is asking. Authorization decides what that person may access. Bob can be signed in and still have no permission to read Alice’s note.

CI & pipeline

Continuous integration (CI) runs checks when code changes are shared. A pipeline is a sequence of steps such as building and testing. In this course, a failed access-control test should stop an unsafe change.

Regression

A bug that comes back after a change. A regression test preserves an example of the correct behavior so that the same mistake is easier to catch.

Localhost & port

Localhost refers to your own computer. A port identifies a service on it. In http://127.0.0.1:3000, 3000 is the port. A service must be running there before the address can respond.

HTTP status

A number describing a response. Here, 200 means success, 401 means no recognized identity, 403 means access denied, and 404 means the requested resource was not found.