0 of 24 chapters written · 3 levels planned
Web Security
OWASP, auth, and the attacker's view
Not written yet
Injection, XSS, CSRF, broken auth, and the OWASP Top 10 — from the mistakes that cause them to the architecture that prevents them. Beginner through advanced, laid out the same way as the rest of the shelf.
The plan
- chapters planned
- 24
- levels
- 3
- chapters written
- 0
What is planned, level by level
Every stop below is an outline for now. Open one to see what it will cover.
Beginner
“I can spot the obvious mistakes.”
7 sections
- soon
Intermediate
“I can secure a real application.”
9 sections
- soon
- soon
- soon
Advanced
“I can think like an attacker.”
8 sections
- soon
- soon
Meanwhile
Nothing here is written yet, but these are.
Three honest notes
Every beginner chapter here pairs a real vulnerability with the specific mistake that causes it — security sticks better as "here's what goes wrong" than as a rulebook.
The OWASP Top 10 itself is an advanced chapter, not the first one — by then most of it is already familiar from earlier chapters, and it reads as a checklist instead of a wall of jargon.
Compliance (GDPR/SOC2) is the deepest, least code-focused layer — most developers never own it directly, but the advanced tier doesn't skip why it shapes engineering decisions.