Security for Developers

A blog series

Security for Developers: Web App Security From Zero

The security a working developer needs: how attackers think, injection, XSS and CSRF, passwords and login, access control, secrets and cryptography, dependencies and supply chain, and APIs. Small examples, every one run, based on OWASP, PortSwigger and the Node.js security guides.

Started 
2026
Lessons 
9
Reading 
~2 h

Contents

Every lesson has the same steps: what it is, how it works, a real example, common mistakes, then interview questions with answers you can say out loud.

  1. Lesson 00The Security Mindset: Threats, Attack Surface and the OWASP Top 10How attackers think, what to protect, threat modelling in four questions, defence in depth, least privilege, and a map of the OWASP Top 10 so you know where each lesson fits.12 min
  2. Lesson 01Injection: SQL Injection, Command Injection and How to Stop ThemA real SQL injection on a tiny login, then the fix with parameterised queries. Also command injection, NoSQL injection and the rule behind all of them: never mix data into code.14 min
  3. Lesson 02XSS, CSRF, Clickjacking and Security HeadersHow a script gets into your page and how to stop it with output encoding and CSP, how CSRF uses your cookies, SameSite and CSRF tokens, frame-ancestors, and the headers worth setting.16 min
  4. Lesson 03Passwords and Login: Hashing, Sessions, MFA and Rate LimitsWhy you never store passwords, hashing with a salt (scrypt and Argon2), safe sessions and JWT mistakes, password reset flows, MFA, and stopping brute force.16 min
  5. Lesson 04Access Control: IDOR, Roles and Mass AssignmentThe number one web risk: checking who you are but not what you may do. IDOR with a real example, deny by default, roles and ownership checks, and mass assignment.14 min
  6. Lesson 05Secrets, Encryption and Data ProtectionWhere secrets leak (git, logs, front-end bundles), hashing vs encryption vs encoding, TLS in plain words, safe randomness, encrypting data with AES-GCM, and handling personal data.15 min
  7. Lesson 06Dependencies and the Supply Chain: npm, Lockfiles and GitHub ActionsHow a package you did not write can hurt you: typosquatting, install scripts, malicious updates. Lockfiles, npm audit, Dependabot, secret scanning and securing your CI.13 min
  8. Lesson 07APIs and Servers: SSRF, File Uploads, Rate Limits and MisconfigurationServer-side request forgery, unsafe file uploads, missing rate limits, verbose errors, CORS mistakes and the OWASP API Top 10, each with a small example and a fix.15 min
  9. Lesson 08Security in Practice: Code Review Checklist, Testing, Incidents and Interview AnswersA review checklist you can use tomorrow, SAST, DAST and dependency scans, what to do in the first hour of an incident, and the security questions interviewers ask with model answers.16 min

Glossary

64 terms used in this series. Inside any lesson, hover or tap a dotted term to see its meaning without leaving the page. Browse all terms →