Course Overview

What this Security in Programming course covers, how to use it, prerequisites.

> Course goal: Learn to design, implement, test, deploy, and maintain software that protects data, identities, services, and infrastructure. The course progresses from foundational security concepts to secure architecture, advanced application security, cloud-native controls, and security engineering at scale.

Course use and safety

This is a defensive secure-development course. Use the exercises only on code, systems, and environments you own or are explicitly authorized to test. Examples demonstrate safe validation, testing, and mitigation. Never test against a real target without written permission.

How the Examples Were Checked

Every snippet that shows or implies an output was run while this course was built, and each output printed under a snippet is exactly what that run produced. Python ran on CPython 3.13.1 (and on Python 3.10.4 under Ubuntu 22.04/WSL2 for the examples that need the cryptography package, /usr/bin/file or POSIX paths); JavaScript and TypeScript on Node.js 24.18, with TypeScript also checked by tsc --strict; SQL on SQLite through Python's sqlite3; and C with GCC 11.2 using -Wall -Wextra -Werror plus AddressSanitizer and UndefinedBehaviorSanitizer. Where a run needed extra test inputs, the appended test code is shown or described next to the output.

All runs are defensive: safe patterns exercised with test data on the build machine. Deliberately unsafe snippets are labelled, shown only for recognition, and were not run. Snippets that need software that was not available (the Argon2 library, a container runtime, CI services) are marked not run. Interactive tools say whether they compute real results in your browser (Web Crypto, the URL parser) or simulate a system.

Course learning outcomes

By the end, learners should be able to:

Explain confidentiality, integrity, availability, authenticity, accountability, privacy, and non-repudiation.

Identify assets, trust boundaries, attack surfaces, threats, and security requirements.

Apply secure input handling, output encoding, parameterized queries, safe file operations, and robust error handling.

Design authentication, authorization, sessions, password storage, secrets management, and cryptographic workflows safely.

Prevent common web, API, mobile, desktop, native-code, and distributed-system vulnerabilities.

Write unit, integration, fuzz, property-based, and security regression tests.

Integrate static, dynamic, dependency, secret, container, infrastructure-as-code, and software-composition checks into CI/CD.

Assess privacy, logging, incident response, resilience, and secure release readiness.

Read security advisories and standards and create a practical remediation plan.

Course Roadmap

1. Security foundations and mindset 2. Threat modeling and secure requirements 3. Secure coding foundations

4. Input validation, output encoding, and injection prevention

5. Memory safety and language-specific risks 6. Authentication, passwords, MFA, and identity

7. Authorization, access control, and multi-tenancy 8. Cryptography and key management

9. Web security: browser, HTTP, and sessions 10. API security and service-to-service trust

11. Database, file, deserialization, and command security 12. Secure architecture and design patterns

13. Testing, fuzzing, and security verification 14. Dependency and software-supply-chain security

15. Cloud, containers, infrastructure, and secrets 16. Mobile, desktop, embedded, and IoT security

17. Privacy, data protection, and secure telemetry 18. Resilience, incident response, and recovery

19. Secure SDLC, DevSecOps, and governance 20. Advanced topics and security engineering at scale

21. Labs, capstone projects, review, and assessment