The Application security engineer path
You stop vulnerabilities from being written rather than finding them after they ship. It is two disciplines — code and security — and you cannot fake either: the most common route is a few years of development followed by a deliberate turn toward security.
Published 2026-10-09 · generated from the lesson data · serves Application security engineer
Work the groups in order. Each checkpoint is a gate: do not move on until you can do it unaided. The capstone is level 4 — original work, made public, verifiable by a stranger.
Code fluency first
1. Python for security tooling
Stage A · Foundations
2. Reading code through a vulnerability
Stage A · Foundations
3. Git and GitHub
Stage A · Foundations
4. Linux command line for security work
Stage A · Foundations
The role page is explicit: read and write code well before the security layer means anything. Do not skip this block.
HTTP and identity
Vulnerability classes, from the fix side
6. IDOR: Insecure Direct Object References
Stage B · Practitioner
7. API abuse: the flaws that live behind the JSON
Stage B · Practitioner
8. SQL injection: when your input becomes the query
Stage B · Practitioner
9. OS command injection: when your input reaches a shell
Stage B · Practitioner
10. Cross-site scripting: when the browser can't tell your code from the attacker's
Stage B · Practitioner
11. CSRF: when the victim's browser does the attacker's work
Stage B · Practitioner
12. SSRF: when the server fetches what you tell it to
Stage B · Practitioner
13. Server-side template injection: when your input becomes the program
Stage B · Practitioner
14. XXE: when the parser works for the attacker
Stage B · Practitioner
15. Insecure deserialization: when data builds the objects
Stage B · Practitioner
16. GraphQL abuse: the query language that trusts the querier
Stage B · Practitioner
17. Race conditions: when "check, then act" isn't atomic
Stage B · Practitioner
18. Broken authentication and session management: proving who you are, and staying proven
Stage B · Practitioner
19. JWT and OAuth flaws: trusting the token more than the verifier deserves
Stage B · Practitioner
20. Security headers and browser defenses: telling the browser what "safe" means
Stage B · Practitioner
21. Business-logic flaws: when the code works and the rules don't
Stage B · Practitioner
Each class studied for how it is found and how it is fixed — the fix is your half of the job.
AppSec specialist
CISSP Domain 8
Checkpoints
- A STRIDE threat model for something you built — not a tutorial app, your code.
- SAST integrated into a real pipeline, with the findings triaged and the false positives documented.
- A security fix responsibly disclosed and merged into real code.
The capstone
Level 4 — Extend: Merged fix or original secure-design guide. A merged security fix in a real open-source project, with a teaching write-up, or an original secure-design guide others can verify — public and reviewable. That is the artifact a hiring stranger checks.