Secure Coding Fundamentals

Module 1: Secure coding mindset and lifecycle

• Principles for writing safer code: least privilege, fail safe defaults, defense in depth
• Where security fits in requirements, design, coding, review, and deployment
• Typical weakness categories and how defects become exploits

Module 2: Application platforms at a glance (web, Windows, mobile)

• How web, desktop, and mobile differ in trust boundaries and data flow
• Platform specific risks: cookies and sessions, file system and registry, device storage and permissions
• Starter checklists for building safely on each platform

Module 3: Client and data layer attack techniques

• Script injection in the browser: XSS variants and prevention patterns
• Query tampering against data stores: SQL injection and parameterization
• Cross site request forgery and how to enforce intent with tokens and same site settings

Module 4: Server side risks and resource abuse

• Service exhaustion patterns and ways to reduce DoS impact
• Memory safety and bounds issues: buffer overflows and safer libraries
• Common server misconfigurations: headers, error handling, and dependency risk

Module 5: Trust the input last (validate, normalize, encode)

• Input validation strategies: allow lists, canonicalization, and type checks
• Output handling to stop injection: output encoding and context awareness
• Data cleaning and safe parsing patterns

Module 6: Putting controls in place

• Enforcing identity and permissions: authentication, authorization, session control
• Safeguarding data in motion and at rest: TLS, key management, encryption basics
• Guarding against frequent threats: rate limits, CSP, dependency updates, secure headers

Module 7: Building safer mobile apps

• Mobile specific exposures: storage, logs, intents, clipboard, background tasks
• Secure app structure: separation of concerns, secure IPC, least privilege
• Handling keys, tokens, and offline data on the device

Module 8: Standards, verification, and fit for release

• Using community guides (OWASP cheat sheets, ASVS, MASVS) as reference points
• Techniques to find issues: static checks, dependency scanning, basic dynamic tests
• Simple acceptance criteria and a pre release security checklist