Learning paths
Build your security judgment with sequences of guides and labs, from a first path for developers to specialist ones, and plans for training a team.
Developer foundations
Start at the data boundary. Build habits that make common defects harder to introduce.
Foundation · Web and API developersBrowser and API boundaries
Protect state changes, browser policies, rendering, object access and concurrent business operations, repairing seven concrete defects along the way.
Practitioner · Application security engineersAppSec in practice
Review a system, build a test plan, and carry a finding through to verified remediation.
Practitioner · Identity and application engineersIdentity through the whole lifecycle
Connect login, token verification, phishing-resistant credentials, recovery and authorization to testable boundaries.
Practitioner · Build engineers and product security teamsFrom source to trusted release
Generate and compare inventory, assess dependency risk, verify artifacts and retain evidence tied to the shipped release.
Practitioner · Platform and cloud security engineersRuntime and cloud defense
Review workload identity, cluster boundaries, configuration drift, exposed APIs and incident evidence.
Practitioner · AI application and security engineersSecure an AI application
Keep retrieval, tool authority and output handling outside model discretion, then build an evaluation and operations plan.
Specialist · Software security specialistsCryptography without shortcuts
Pick primitives by job, build authenticated records, rotate keys, run TLS, plan post-quantum migration, then study past failures.
Specialist · Security leads and assurance specialistsBuild an evidence-driven security program
Set ownership and requirements, produce release-specific evidence, manage exceptions and scope external obligations.
Plan training for a team
Role tracks put the paths in order for each role, with the total time for the guides and labs (capstones add more). Each path ends with a capstone workbook a team can work through together; progress stays in each person’s browser and can be exported as a file.
| Role | Paths, in order | Time |
|---|---|---|
| Application developers | Developer foundations, then Browser and API boundaries | 15.5–19 hours |
| AppSec engineers | Developer foundations, then AppSec in practice, then Build an evidence-driven security program | 21–25 hours |
| Platform, cloud and build engineers | From source to trusted release, then Runtime and cloud defense | 12–13 hours |
| Identity and cryptography specialists | Identity through the whole lifecycle, then Cryptography without shortcuts | 12.5–15.5 hours |
| AI application teams | Developer foundations, then Secure an AI application | 11–13 hours |
| Security leads and assurance | AppSec in practice, then Build an evidence-driven security program | 14–17 hours |
Completion is a personal bookmark, not a certification. Capstone workbooks are on the templates list.
Sample 6- and 12-week team plans, with facilitator notes and a team progress summary
Choose a browser lab
All labsSBOM completeness lab: Find the dependencies missing from a release SBOM
A release SBOM lists only direct dependencies. The shipped artifact also contains a bundled parser and a transitive helper. Repair the comparison so inventory omissions remain visible.
Browser lab · Practitioner · 25–40 minCompletedPrivileged container lab: Reject a privileged workload before deployment
A deployment review checks only the first container. A privileged init container slips through. Repair a deliberately small admission predicate and test all container lists.
Browser lab · Practitioner · 25–40 minCompletedJWT validation lab: Validate the purpose and audience of a token
An API accepts a correctly signed token intended for another service. Repair claim validation after the trusted signature verifier has finished.
Browser lab · Practitioner · 25–40 minCompletedRAG access control lab: Stop a retriever from returning another tenant’s documents
A search helper sends every matching document to a model and asks the model to respect permissions. Repair filtering before any content reaches the model.
Browser lab · Advanced · 30–45 minCompletedRelease evidence lab: Keep stale test evidence out of a release decision
A release report says every required check passed, but some evidence belongs to an old commit or another service. Repair the evidence-selection function before the report hides those gaps.
Browser lab · Foundation · 20–30 minCompletedIDOR lab: Repair an invoice authorization bug
Bob can retrieve Alice’s invoice by changing the URL. You own the endpoint’s permission check. Reproduce the leak, patch the function below, and prove that Alice can still read her invoice.
Your progress, your browser
Progress is stored on this device. Export it to carry it to another browser, or clear it whenever you want. Importing a file adds its completed items to the progress already here; items this site no longer offers are skipped and counted, and nothing else is removed.