Topic · 36 lessons in 17 series
Security
Threats and defences for developers: injection, XSS, CSRF, secrets, encryption, HTTPS and the OWASP lists, from the browser to the server to LLM apps.
DevOpsWhole series →
- HTTPS, SSL and TLS: Certificates, Let’s Encrypt, ACMWhat the padlock in your address bar actually proves, how a free certificate gets issued, and the exact commands to put HTTPS on your own EC2 server.15 min
- VPC: Subnets, Route Tables, Security GroupsYour own private network inside AWS. Public and private subnets, how traffic gets in and out, and where your database hides.20 min
- Security Hardening and BackupsLocking down what you built: patching, secrets, least privilege, automated backups and tested restores.27 min
System DesignWhole series →
- HTTP & HTTPS Explained: Methods, Status Codes and TLSHTTP is the shared language of the web: a method and URL in, a status code and body out. HTTPS wraps it in TLS so nobody on the path can read or change it. Methods, idempotency, status codes, HTTP/1.1 vs 2 vs 3, and the TLS handshake.12 min
- Encryption & Secrets ManagementUnencrypted traffic “inside our network”, an unencrypted backup in a public bucket, a database password pushed to GitHub. Where to encrypt in transit and at rest, who holds the keys, how envelope encryption and KMS work, end-to-end encryption, and how to store, deliver and rotate secrets.10 min
- OWASP Top 10 for Backend DevelopersMost breaches don't need a genius hacker — just a missing ownership check, a string-glued SQL query or a default password. The OWASP Top 10 explained for backend developers, with the attack, the fix and a real incident for each, plus the API-specific risks.10 min
The Browser ContractWhole series →
- Storage in the Browser: Cookies, localStorage, sessionStorage and IndexedDBHow long each one lasts, how big it can be, and who can read it: the tab, the site, the server or JavaScript. It ends with a table that answers: where should this data go?15 min
- Where Do Tokens Live? XSS, CSRF and the Storage Trade-offlocalStorage lets XSS steal tokens. Cookies let CSRF attacks use you. Safe patterns: HttpOnly cookies with SameSite or CSRF tokens, access tokens kept in memory, and a backend-for-frontend.18 min
- CORS Explained: Same-Origin Policy, Preflights and CredentialsWhy CORS protects the browser and is not a firewall for the server, what makes a preflight request, and why you cannot use a wildcard origin together with credentials.15 min
- Frontend Security Checklist: XSS, CSP, Clickjacking and Supply ChaindangerouslySetInnerHTML, CSP nonces, frame-ancestors, Subresource Integrity and risky packages. Each one asks: what would you check in a code review?18 min
Backend in DepthWhole series →
- Validation at the Edge: Schemas, DTOs and Trusting NothingCheck input where it enters the API, share schemas with the frontend, and keep validation errors apart from business-rule errors.15 min
- Authentication and Authorization on the ServerPassword hashing, session stores, checking JWTs properly, role-based vs attribute-based access control, and checking ownership on every resource.18 min
Scenario DebuggingWhole series →
Practical Design ProblemsWhole series →
Full-Stack QuestionsWhole series →
Team Lead MindsetWhole series →
Design Patterns & LLDWhole series →
System Design Case Studies 2Whole series →
AI EngineeringWhole series →
- Securing LLM Applications: The OWASP Top 10 for LLM Apps in CodeThe ten 2025 OWASP risks for LLM applications, each with a plain definition, a vulnerable sketch, a fix and a one-line interview answer.14 min
- Prompt Injection and Safe Tool Use for AgentsDirect and indirect injection, a mock agent leaking private notes, and a policy layer that blocks the leak.13 min
Security for DevelopersWhole series →
- The Security Mindset: Threats, Attack Surface and the OWASP Top 10How attackers think, what to protect, threat modelling in four questions, defence in depth, least privilege, and a map of the OWASP Top 10 so you know where each lesson fits.12 min
- Injection: SQL Injection, Command Injection and How to Stop ThemA real SQL injection on a tiny login, then the fix with parameterised queries. Also command injection, NoSQL injection and the rule behind all of them: never mix data into code.14 min
- XSS, CSRF, Clickjacking and Security HeadersHow a script gets into your page and how to stop it with output encoding and CSP, how CSRF uses your cookies, SameSite and CSRF tokens, frame-ancestors, and the headers worth setting.16 min
- Passwords and Login: Hashing, Sessions, MFA and Rate LimitsWhy you never store passwords, hashing with a salt (scrypt and Argon2), safe sessions and JWT mistakes, password reset flows, MFA, and stopping brute force.16 min
- Access Control: IDOR, Roles and Mass AssignmentThe number one web risk: checking who you are but not what you may do. IDOR with a real example, deny by default, roles and ownership checks, and mass assignment.14 min
- Secrets, Encryption and Data ProtectionWhere secrets leak (git, logs, front-end bundles), hashing vs encryption vs encoding, TLS in plain words, safe randomness, encrypting data with AES-GCM, and handling personal data.15 min
- Dependencies and the Supply Chain: npm, Lockfiles and GitHub ActionsHow a package you did not write can hurt you: typosquatting, install scripts, malicious updates. Lockfiles, npm audit, Dependabot, secret scanning and securing your CI.13 min
- APIs and Servers: SSRF, File Uploads, Rate Limits and MisconfigurationServer-side request forgery, unsafe file uploads, missing rate limits, verbose errors, CORS mistakes and the OWASP API Top 10, each with a small example and a fix.15 min
- Security in Practice: Code Review Checklist, Testing, Incidents and Interview AnswersA review checklist you can use tomorrow, SAST, DAST and dependency scans, what to do in the first hour of an incident, and the security questions interviewers ask with model answers.16 min
API DesignWhole series →
Next.js App RouterWhole series →
- Server Actions, Forms and MutationsForms that call server functions, validation, pending and error states, revalidating after a change, and the security rules for actions.15 min
- Authentication and Authorization in Next.jsSessions with cookies, checking auth close to the data, protecting routes and actions, and the common mistakes.15 min
Docker & KubernetesWhole series →
- Volumes, Networks and Running Containers SafelyPersisting data, bind mounts, networks and ports, environment variables and secrets, non-root users and other safety habits.14 min
- Configuration, Secrets and Storage in KubernetesConfigMaps, Secrets and their limits, persistent volumes and claims, StatefulSets at a glance.14 min