Choose your situation

Look up the ID your scanner or report gives, or find the weakness below: each links the guides that explain the fix and the labs and projects to practise it.

Injection and unsafe parsing

Cross-site scripting (XSS)

CWE-79CWE-116A05:2025 InjectionCWE Top 25 #1

Also called Reflected XSS, Stored XSS, DOM-based XSS, Unescaped output.

Fix cards: Cross-site scripting (XSS) (JavaScript, Python, Java, C#, TypeScript, Go, Ruby, PHP)

Practice: XSS lab

SQL injection

CWE-89A05:2025 InjectionCWE Top 25 #2

Also called SQLi, Query built from strings, Unparameterized query.

Fix cards: SQL injection (JavaScript, Python, Java, C#, TypeScript, Go, Ruby, PHP)

CSV and spreadsheet formula injection

CWE-1236

Also called CSV injection, Formula injection, DDE injection.

Fix cards: CSV formula injection (JavaScript, Python, Java, C#, Ruby)

Access control and request forgery

Mass assignment and excessive data exposure

CWE-915CWE-213A08:2025 Software or Data Integrity Failures

Also called BOPLA, Overposting, Excessive data exposure.

Fix cards: Mass assignment (over-posting) (JavaScript, Python, Java, C#, TypeScript, Go, Ruby, PHP)

Practice: Project: Secure a real HTTP API

Path traversal and file inclusion

CWE-22CWE-23CWE-59CWE-98A01:2025 Broken Access ControlA05:2025 InjectionCWE Top 25 #6

Also called Directory traversal, Zip Slip, Symlink following, LFI, RFI, Path injection.

Fix cards: Path traversal (JavaScript, Python, Java, C#, TypeScript, Go, Ruby, PHP)

Practice: Path traversal lab · Project: Keep extracted files inside their boundary

Cross-site request forgery (CSRF)

CWE-352CWE-1275A01:2025 Broken Access ControlCWE Top 25 #3

Also called XSRF, Missing CSRF token, SameSite cookie.

Fix cards: Cross-site request forgery (CSRF) (JavaScript, Python, Java, C#, Ruby, PHP) · Session fixation and session cookies (JavaScript, Python, Java, C#, Ruby, PHP)

Practice: CSRF lab

Server-side request forgery (SSRF)

CWE-918A01:2025 Broken Access ControlCWE Top 25 #22

Also called Unvalidated URL fetch, Cloud metadata access.

Fix cards: Server-side request forgery (SSRF) (JavaScript, Python, Java, C#, TypeScript, Go, Ruby, PHP)

Authentication, sessions and tokens

Weak password storage

CWE-916CWE-759CWE-760CWE-257CWE-521A04:2025 Cryptographic FailuresA07:2025 Authentication Failures

Also called Fast or unsalted hash, MD5 or SHA-1 passwords, Recoverable passwords.

Fix cards: Weak password hashing (JavaScript, Python, Java, C#, Go, PHP)

Cryptography and secrets

Configuration, design and operations

Dependencies and the build

AI features

Not listed? Browse every CWE with a page here, check the OWASP Top 10:2025, or search for the finding’s name.

WHAT YOU WILL PRODUCE
  • Separate a reported symptom from the unsafe decision that causes it.
  • Repair the boundary and its variants while preserving legitimate behavior.
  • Join regression evidence to the actual deployed revision before closing.

A finding record linking cause, variants found, code change, positive and negative regression evidence and deployment status.

BEFORE YOU START
  • Read a short request handler and its test output.
  • Use the supplied SQL or authorization fixture; real targets require an authorized test scope.
Example journey: SQL injection → parameterized query → regression test
1

Establish the behavior

Create finding F1 with the affected revision, entry point, attacker-controlled value, protected asset and observed result. Reproduce the scanner or report result first: one you cannot reproduce becomes a documented false positive with its reason, not a silent deletion. Set the due date from your remediation policy, using exposure and exploitation evidence such as a KEV listing rather than the scanner’s severity label alone. Use the connected SQL example or invoice fixture with synthetic records. Finish when another reviewer can replay the case and name the boundary that failed.

2

Correct the root cause

Write a short before-and-after explanation beside the change. For SQL, bind data values through the driver and constrain any dynamic identifier separately; for invoices, compare the authenticated tenant and ownership at the data-access boundary. Then look for variants: search the codebase for the same unsafe call or helper, or write a static-analysis rule for it, and fix or ticket every hit. Finish when each relevant path uses the corrected decision, rather than hiding the symptom in the interface or rejecting every request.

3

Prove the fix

Retain a compact case table with input, expected result, observed result and candidate revision. Pair the original unsafe input with an ordinary successful request and a neighboring forbidden case, and keep the cases as regression tests that run on every build. Explain why each result distinguishes the repair from a blanket denial. Use the connected exercise to obtain observations; mark any unexecuted checks pending. Finish when the evidence covers the affected paths and still permits the intended action.

4

Close with evidence

Join F1 to the patch, regression record and deployed artifact identity. If only the candidate is tested, record fix ready and rollout pending; if the fix cannot ship by the due date, ask the risk owner for a time-limited exception instead of letting the finding age. Close the finding only when the running version and its behavior match the verified change. Keep an owner, residual limitations and a reopening trigger such as another entry point using the old helper. A merged pull request alone is not completion.

Practice

The steps use a connected exercise: Fix SQL injection in Python sqlite3. To build the skills behind this job step by step, follow the learning path Developer foundations.

Work products

Use the blank work product for your system. Compare its required evidence with a completed synthetic example.

Download blank work product Download completed example