How much Web Security do you already have?
Be honest — nobody is watching. This only decides which chapters come first; every chapter stays open to you either way.
“I can spot the obvious mistakes.”
Start with the mindset, then the classics — injection, XSS, weak auth — the mistakes that show up in almost every real breach.
- You've shipped a login form without thinking hard about it
- "XSS" and "SQL injection" are names you've heard, not things you've prevented on purpose
- You want the common vulnerabilities once, in order, with the fix each time
“I can secure a real application.”
You know the classics. Now learn CSRF, access control, OAuth, and the API/dependency/config hygiene that closes the rest of the gaps.
- Comfortable with XSS/injection and basic password hashing
- You've wired up "Login with Google" without fully understanding the flow
- You want a real app's auth and API surface actually secured
“I can think like an attacker.”
The full OWASP Top 10 in context, cryptography basics, and the architecture (zero trust, defense in depth) behind a security-mature system.
- You can already secure a real app's auth, sessions and API surface
- You want to run a security review, not just fix findings handed to you
- You want the why under SSRF, prototype pollution and zero trust
Not sure? Start at Beginner — every path opens at the section people usually skip.
Full syllabus
Everything each level eventually covers — ticked sections are written, the rest are still on the desk.
Beginner0 / 7 sections written
- The security mindsetcoming soon
Why security is everyone's job, basic threat modeling
- Injection attackscoming soon
SQL injection, command injection — how they actually happen
- Cross-Site Scripting (XSS)coming soon
Stored, reflected, and DOM-based XSS
- Authentication basicscoming soon
Password hashing (bcrypt), common mistakes
- HTTPS & transport securitycoming soon
TLS basics, why plain HTTP isn't enough
- Sensitive data exposurecoming soon
What not to log, store, or return in a response
- Security headerscoming soon
CSP, X-Frame-Options, HSTS — surface level
✅ Checkpoint: you can look at a form or API endpoint and name the injection/XSS/auth risks in it, plus the specific fix for each.
Intermediate0 / 9 sections written
- CSRFcoming soon
Tokens, SameSite cookies
- Broken access controlcoming soon
IDOR, privilege escalation
- Session managementcoming soon
Secure cookies, session fixation, token expiry
- OAuth & OpenID Connectcoming soon
The flows, and the common mistakes in implementing them
- API securitycoming soon
Rate limiting, API keys, validating input at the boundary
- Dependency & supply-chain securitycoming soon
npm audit, lockfiles, SBOM basics
- CORS in depthcoming soon
What it actually protects against — and what it doesn't
- Security misconfigurationcoming soon
Default credentials, verbose errors, open ports
- Secrets managementcoming soon
Env vars, vaults, never committing secrets
✅ Checkpoint: you can secure a real API's auth, sessions, and CORS/CSRF surface, and explain an OAuth flow well enough to debug it.
Advanced0 / 8 sections written
- The OWASP Top 10coming soon
The full list, in context, one pass
How untrusted data becomes code execution
- Server-Side Request Forgery (SSRF)coming soon
Tricking a server into requesting what it shouldn't
- Security testingcoming soon
SAST/DAST tools, penetration testing basics
- Cryptography for developerscoming soon
Symmetric vs asymmetric, common misuse
- Zero trust & defense in depthcoming soon
Architectural thinking, not just a checklist
- Incident responsecoming soon
What to actually do when a breach happens
- Compliance basicscoming soon
GDPR/SOC2, surface level — why they shape engineering
✅ Checkpoint: you can run a security review against the OWASP Top 10, explain a cryptographic misuse bug, and defend an incident-response plan.
- Every beginner chapter here pairs a real vulnerability with the specific mistake that causes it — security sticks better as "here's what goes wrong" than as a rulebook.
- The OWASP Top 10 itself is an advanced chapter, not the first one — by then most of it is already familiar from earlier chapters, and it reads as a checklist instead of a wall of jargon.
- Compliance (GDPR/SOC2) is the deepest, least code-focused layer — most developers never own it directly, but the advanced tier doesn't skip why it shapes engineering decisions.