12 practical lessons · Starting → Professional · Defensive learning only
తెలుగు: ప్రతి Lessonలో Theory, Practice, Output, Errors ఉంటాయి. हिन्दी: प्रत्येक पाठ में अभ्यास और परिणाम हैं।
Starting · Lesson 01
Threat Modeling
Theory / Concept
Identify assets, attackers, entry points and mitigations.
Step-by-step Practical
Draw a data flow for a contact form; list user input, server, database and administrator. Rank three risks by impact and likelihood.
Expected Output
A risk register containing risk, impact, likelihood, owner and mitigation.
Common Error & Solution
Mistake: treating every risk as equally urgent. Fix: prioritize exposure and impact.
Independent Exercise
Repeat the practical with a fictional client project. Capture the outcome in a checklist, explain why each control matters, and verify the negative test case.
Starting · Lesson 02
Passwords, MFA and Account Recovery
Theory / Concept
Passwords protect credentials; MFA adds a separate verification factor.
Step-by-step Practical
Use a password manager; create unique credentials for a test account; enable passkey or authenticator MFA; store recovery codes offline.
Expected Output
A test account with unique credentials and a verified recovery method.
Common Error & Solution
Mistake: storing recovery codes in public files. Fix: use private secure storage.
Independent Exercise
Repeat the practical with a fictional client project. Capture the outcome in a checklist, explain why each control matters, and verify the negative test case.
Intermediate · Lesson 03
HTML Input Validation
Theory / Concept
Client validation improves usability, but server validation remains mandatory.
Step-by-step Practical
Create a form with required, minlength and type=email; test empty, malformed and valid values; record results.
Expected Output
Browser rejects obvious invalid entries; server validation remains in scope.
Common Error & Solution
Mistake: trusting HTML validation for security. Fix: validate again on server.
Independent Exercise
Repeat the practical with a fictional client project. Capture the outcome in a checklist, explain why each control matters, and verify the negative test case.
Intermediate · Lesson 04
Safe DOM Rendering
Theory / Concept
textContent treats input as text; innerHTML parses markup and can create injection risks.
Step-by-step Practical
Open the interactive demo below; enter <img src=x onerror=alert(1)>; compare safe text rendering with escaped source preview.
Expected Output
Untrusted input is displayed literally; no injected element is executed.
Common Error & Solution
Mistake: inserting untrusted text into innerHTML. Fix: use textContent or context-appropriate encoding.
Independent Exercise
Repeat the practical with a fictional client project. Capture the outcome in a checklist, explain why each control matters, and verify the negative test case.
Intermediate · Lesson 05
Authentication vs Authorization
Theory / Concept
Authentication establishes identity; authorization decides which resources a user may access.
Step-by-step Practical
Design two roles: viewer and editor; write a permission matrix for read, create, update and delete; test denied operations.
Expected Output
Documented permissions and explicit deny behavior.
Common Error & Solution
Mistake: hiding a button as authorization. Fix: enforce permission checks on server.
Independent Exercise
Repeat the practical with a fictional client project. Capture the outcome in a checklist, explain why each control matters, and verify the negative test case.
Advanced · Lesson 06
Firebase Security Rules
Theory / Concept
Rules enforce access on database requests; UI checks alone are insufficient.
Step-by-step Practical
In a test Firebase project, design owner-only access; test authorized and unauthorized users with emulator; inspect denied reads.
Expected Output
Unauthorized reads and writes are rejected in emulator tests.
Common Error & Solution
Mistake: using allow read, write: if true in production. Fix: use least privilege.
Independent Exercise
Repeat the practical with a fictional client project. Capture the outcome in a checklist, explain why each control matters, and verify the negative test case.
Advanced · Lesson 07
Secrets and API Keys
Theory / Concept
Server secrets must not be shipped in client-side JavaScript or public repositories.
Step-by-step Practical
Create a sample .env.example with placeholders; add .env to .gitignore; scan git diff for tokens before committing.
Expected Output
Repository contains examples but no actual private credentials.
Common Error & Solution
Mistake: committing secrets then only deleting them. Fix: revoke and rotate compromised credentials.
Independent Exercise
Repeat the practical with a fictional client project. Capture the outcome in a checklist, explain why each control matters, and verify the negative test case.
Advanced · Lesson 08
HTTPS, Cookies and Sessions
Theory / Concept
TLS protects data in transit; secure cookies and session expiry reduce hijacking risk.
Step-by-step Practical
Inspect browser developer tools for Secure, HttpOnly and SameSite on test cookies; document session expiry and logout behavior.
Expected Output
A session security checklist with observed settings.
Repeat the practical with a fictional client project. Capture the outcome in a checklist, explain why each control matters, and verify the negative test case.
Full Advanced · Lesson 09
Dependency and Supply Chain Review
Theory / Concept
Third-party packages and build pipelines can introduce vulnerabilities.
Step-by-step Practical
Run npm audit on a disposable sample project; review findings, version constraints and changelogs; test updates before release.
Expected Output
A dependency report with severity, remediation and regression-test status.
Common Error & Solution
Mistake: blindly upgrading every package. Fix: assess breaking changes and test.
Independent Exercise
Repeat the practical with a fictional client project. Capture the outcome in a checklist, explain why each control matters, and verify the negative test case.
Full Advanced · Lesson 10
Secure CI/CD with GitHub Actions
Theory / Concept
Least-privilege workflow permissions and pinned actions reduce deployment risk.
Step-by-step Practical
Review workflow permissions; set contents: read by default; store secrets in GitHub Secrets; restrict deploy jobs and approvals.
Expected Output
Documented workflow with minimal token permissions.
Common Error & Solution
Mistake: printing secret values to logs. Fix: never echo credentials.
Independent Exercise
Repeat the practical with a fictional client project. Capture the outcome in a checklist, explain why each control matters, and verify the negative test case.
Expert · Lesson 11
Incident Response and Backups
Theory / Concept
Preparation, detection, containment, recovery and review form a repeatable response process.
Step-by-step Practical
Write a tabletop scenario for a leaked API key; record detection, revocation, log review, user impact and lessons learned.
Expected Output
A timed incident checklist and tested restore procedure.
Common Error & Solution
Mistake: deleting evidence before investigation. Fix: preserve logs securely.
Independent Exercise
Repeat the practical with a fictional client project. Capture the outcome in a checklist, explain why each control matters, and verify the negative test case.
Professional · Lesson 12
Client Security Handover
Theory / Concept
A project is not complete until access, maintenance and recovery are documented.
Step-by-step Practical
Prepare a handover with accounts, role matrix, update schedule, backups, privacy notice and incident contacts.
Expected Output
A signed-off handover checklist with no passwords embedded.
Common Error & Solution
Mistake: emailing passwords in plain text. Fix: transfer access through secure channels.
Independent Exercise
Repeat the practical with a fictional client project. Capture the outcome in a checklist, explain why each control matters, and verify the negative test case.
Working Safe DOM Lab
Type any sample text, including HTML-like text. The preview uses textContent, so it will not interpret the input as markup.