Goal
Security is not a specialist's afterthought; it is a property of designs, and the architect owns it. This path builds the working set: the attacks every developer must recognize on sight, identity done correctly, the trust machinery of TLS operated with your own hands, enough cryptography to choose boring right answers — and threat modeling to apply all of it before the code exists. The path runs on the KB's most visceral exercises: things are learned here by breaking them.
Prerequisites
- Foundations module 5 (the network); running web code from full-stack web makes the AppSec module concrete but isn't mandatory.
Modules
1. Know the attacks
- Read: AppSec fundamentals.
- Do: the note's lab drills — injection, XSS, CSRF, SSRF exploited in a deliberately vulnerable app, then patched.
- Proof: for each OWASP-class attack: one working exploit you performed, one defense you implemented, both in your notes.
2. Identity, done right
- Read: Authentication & authorization.
- Do: the note's drills — the PortSwigger auth/JWT/OAuth labs, then the PKCE-against-a-real-IdP build.
- Proof: the login build verifies its JWTs with pinned
algand checked claims; you can whiteboard the auth-code flow with every arrow justified.
3. The trust machinery
- Read: TLS/HTTPS & certificate management.
- Do: Stand up your own CA + mTLS between two services.
- Proof: the subject's gates — the chain verifies, mutual auth enforced, a revocation actually revokes.
4. Cryptography, humbled
- Read: Cryptography for engineers.
- Do: Cryptopals — crypto challenges (sets 1–3).
- Proof: the padding oracle broken with your own code; "just use a library" now a conclusion you earned, with the boring right answers memorized.
5. Secrets, operationally
- Read: Secrets management.
- Do: the note's drills — a real project moved from env-file secrets to a vault with rotation; a planted leak caught and walked through the response playbook.
- Proof: no long-lived credential in any repo you own; the rotation demonstrably doesn't break the app.
6. Think like the attacker, early
- Read: Threat modeling.
- Do: STRIDE passes on two real designs — one of your own builds (the RealWorld capstone is ideal) and one system you only operate.
- Proof: each model names assets, trust boundaries, and the three threats you fixed — plus the ones you consciously accepted, in writing.
Related
- The path to excellence — the master path; security threads through Stages 3–5 rather than sitting in one.
- Full-stack web — supplies the running targets modules 1–2 harden.
- Platform & production — where secrets, TLS, and supply chain meet operations.
- Theme drawn on: Security.