Secure Coding: Building, Reviewing, and Shipping
Secure Software
Duration: 4 days
TRAINING OVERVIEW
This 4-day hands-on training equips software teams with practical secure-coding skills to
prevent the most common application vulnerabilities. Participants will learn how to think like
an attacker, apply secure design principles, implement defensive coding patterns, and
integrate security into daily development workflows (code review, testing, CI/CD). The
course is aligned with widely used industry practices such as OWASP guidance and focuses
on real-world scenarios: web/API security, authentication/authorization, input validation,
secrets management, dependency risks, and secure logging/monitoring.
TRAINING OBJECTIVES
By the end of this training, participants will be able to:
1. Identify common vulnerability classes and apply secure design principles in day-to-day
coding
2. Implement strong input validation, output encoding, and data handling controls for
web/APIs
3. Build secure authentication and authorization (session/JWT, RBAC/ABAC concepts) and
prevent access control flaws
4. Prevent injection attacks (SQL/NoSQL/command), XSS, CSRF, SSRF, and insecure
deserialization patterns
5. Manage secrets safely, reduce dependency risk (SCA), and use secure configurations and
headers
6. Apply secure error handling, logging, and monitoring without leaking sensitive data
7. Integrate security checks into CI/CD (SAST/SCA/secret scanning) and improve code
review quality
8. Deliver a “secure coding checklist” + remediation plan applicable to their projects
COURSE CONTENTS
Chapter 1 — Secure Coding Mindset, Threat Modeling, and Security Baselines
Why vulnerabilities happen: trust boundaries, attacker incentives, common dev pitfalls
Secure coding principles:
o least privilege, defense-in-depth, secure defaults, fail-safe, minimize attack
surface
Threat modeling basics:
o assets, actors, entry points, abuse cases
o trust boundaries and data flow diagrams (DFD lite)
Security baselines for modern apps:
o TLS everywhere concept, safe headers, secure configurations
“What to log” vs “what not to log” and data classification basics (PII awareness)
Lab: Build a simple threat model for a sample API and extract security requirements + abuse
cases.
Chapter 2 — Input Validation, Output Encoding, and Safe Data Handling
Validation strategy:
o allowlists vs denylists, canonicalization
o schema validation for JSON (request DTO validation)
o file upload validation (type, size, scanning concept)
Output encoding and context-aware escaping (HTML/JS/URL)
Safe serialization patterns:
o avoid insecure deserialization; validate and constrain formats
Handling untrusted data end-to-end:
o “never trust client input” patterns
o preventing data leaks in responses
Lab: Harden API endpoints with request schema validation + safe output patterns;
implement robust error responses.
Chapter 3 — Authentication, Authorization, and Session Security
Authentication patterns:
o password hashing (bcrypt/argon2 concept), MFA overview
o session vs token (JWT) trade-offs
Authorization:
o RBAC vs ABAC decision rules
o object-level authorization and ownership checks
Preventing common auth flaws:
o broken access control
o insecure direct object references (IDOR)
o privilege escalation patterns
CSRF basics and when it matters
Security controls:
o rate limiting, account lockout, brute-force protection
o secure logout, token rotation basics
Lab: Implement authorization checks for “multi-tenant” resources and test for IDOR and
privilege escalation attempts.
Chapter 4 — Injection Attacks: SQL/NoSQL/Command and Defensive Patterns
Injection fundamentals: how untrusted input becomes executable intent
SQL injection prevention:
o parameterized queries, ORM pitfalls, safe dynamic query patterns
NoSQL injection patterns (MongoDB-style query operator abuse)
OS command injection and safe subprocess patterns
Template injection and unsafe string interpolation (practical examples)
Secure query building checklist for devs and reviewers
Lab: Break and then fix vulnerable endpoints: SQL injection and NoSQL injection scenarios
using safe query patterns.
Chapter 5 — Web and API Security Pitfalls (XSS, SSRF, CORS, and More)
XSS types: reflected/stored/DOM; prevention via encoding + CSP concepts
SSRF:
o why it’s dangerous (cloud metadata, internal services)
o URL allowlists, DNS rebinding awareness, egress controls
CORS pitfalls:
o misconfigurations that expose APIs
o safe patterns for allowed origins/headers
Clickjacking and security headers overview (CSP, X-Frame-Options, etc.)
File handling and path traversal:
o safe path joins, storage separation, content-type verification
Lab: Build mitigations for SSRF and XSS in a sample app; implement secure CORS
configuration.
Chapter 6 — Secrets, Dependencies, and Supply Chain Security (Dev-Friendly)
Secrets management:
o what counts as a secret, common leak paths
o env vars vs secret vaults (concept)
o rotation and incident response basics
Dependency risk:
o SCA concepts, CVE severity interpretation
o dependency pinning/lockfiles, “typosquatting” awareness
Secure build inputs:
o artifact provenance concept, SBOM overview
Configuration security:
o secure defaults, disable debug in prod, safe error pages
Lab: Add secret scanning + dependency scanning to a sample repo; remediate a vulnerable
dependency and document the change.
Chapter 7 — Secure Error Handling, Logging, and Observability
Error handling:
o avoid leaking stack traces, internal IDs, secrets
o consistent error contracts for APIs
Logging:
o structured logging, correlation IDs
o PII redaction and sensitive-field masking
Monitoring signals:
o auth anomalies, rate spikes, suspicious input patterns
Auditability:
o what events should be auditable (logins, privilege changes, money movement)
Lab: Implement safe error responses + structured logs with correlation IDs and redaction
rules.
Chapter 8 — Secure Code Review and Security Testing in CI/CD
Secure code review playbook:
o what reviewers must look for (authZ, validation, injection, secrets)
o “diff-based threat modeling” (review changes as new attack surface)
Security testing layers:
o SAST, SCA, secret scanning (practical), DAST concept
o unit tests for security controls (authZ tests, validation tests)
CI/CD gates:
o fail conditions, exceptions process, risk acceptance documentation
Developer workflow:
o how to fix findings without breaking velocity
o triage and prioritization (severity, exploitability, blast radius)
Lab: Create a secure CI pipeline policy:
mandatory security checks
severity thresholds
PR checklist + review rubric
Chapter 9 — Capstone: Secure a Mini Service End-to-End
Participants harden a small web/API service by:
threat modeling and security requirements
implementing validation + authN/authZ
fixing injection and web security issues
adding security checks to CI/CD
writing a secure coding checklist and “release security gate” rules
Output: A secured service + secure coding checklist + CI/CD security gate spec.