Free to read ยท Three levels
Secure Software Development: design, boundaries, and evidence
A complete course connecting protected outcomes, design decisions, and implementation boundaries to verification, dependency risk, remediation, and response.
Start learningIn this course
Follow a fictional community workshop service protecting registrations and attendee contact data. Lessons begin with outcomes and risk, then develop asset, data-flow, and trust models, verifiable requirements, bounded misuse cases, safe defaults, and decision records. Each choice explains what must be protected and who owns the decision.
Intermediate lessons cover input contracts, data/interpreter separation, file and deserialization lifecycles, identity and permission interfaces, secrets and diagnostics, and verification design. Advanced lessons connect component inventories, build provenance, code review, weakness triage, release and recovery readiness, and a reviewable assurance package.
English and Arabic versions provide complete teaching with identical technical identifiers, examples, and results. Examples use invented records, public markers, and local in-memory state without a real target, scanner, credential, service, or dependency installation. Lessons and three diagnostic guides distinguish planning, inspection, local execution, and actual platform verification.
What you will learn
- Define protected outcomes, trust boundaries, requirements, and independent oracles.
- Review authority, data interpretation, and lifecycle behavior at implementation boundaries.
- Assess component identity, artifact evidence, and build provenance without conflating claims.
- Document triage, remediation, readiness, and response within actual evidence limits.
Your learning path
Three levels
Basic: outcomes, models, and decisions
Define protected outcomes, trust boundaries, requirements, bounded misuse cases, safe defaults, and reviewable design choices.
- Make security a lifecycle responsibility
- Map assets, data flows, and trust boundaries
- Write verifiable security requirements
- Design misuse cases without operational attacks
- Design safe defaults and enforceable invariants
- Record security decisions for useful review
Intermediate: implementation boundaries and verification
Review input, interpreter, file, identity, secret, and verification boundaries using explicit local policies and safe data.
- Build explicit input boundary contracts
- Keep data separate from interpreter instructions
- Constrain files and deserialization capabilities
- Design trusted identity and permission interfaces
- Keep secrets out of code and diagnostics
- Design security verification that can detect failure
Advanced: components, evidence, and response
Connect inventories, provenance, code review, triage, release readiness, and an evidence-backed assurance package.
- Build a component inventory for dependency decisions
- Distinguish artifact integrity from build provenance
- Review security-sensitive changes by data and authority flow
- Triage weaknesses and verify the actual repair
- Review release and recovery readiness
- Build a reviewable security assurance package
Who this is for
- Developers, code reviewers, and quality engineers who want security decisions grounded in specific evidence.
- Learners connecting requirements, design, implementation, and response without overstating local-test claims.
Before you start
- Basic familiarity with programming functions, data structures, HTTP, and JSON.
- Ability to read short Python examples; optional validation uses already available tools only.