Cybersecurity

Thinking like an attacker to find and fix weaknesses before they're exploited.

CurrentintermediateGuide only -- no course yet

Overview

Cybersecurity for developers (as distinct from penetration testing) means understanding common vulnerability classes -- injection, XSS, broken authentication, insecure direct object references -- well enough to avoid introducing them, and reviewing code with an attacker's mindset. This platform's own docs/SECURITY.md is a real, applied example of this thinking for a specific application.

What it is: The practice of identifying and preventing weaknesses that let an attacker do something unintended.
Why it's used: Every application handles some combination of user input, authentication, or sensitive data -- all common attack surfaces.
Where it fits: A cross-cutting concern across frontend, backend, and infrastructure -- not a separate add-on step at the end.

Core concepts

Injection attacks (SQL injection, XSS)
Authentication vs. authorization
Input validation and output encoding
The principle of least privilege
Threat modeling

Example

SQL injection happens when user input is concatenated directly into a query string; a parameterized query keeps input strictly as data, never as executable code -- the standard defense.

-- Vulnerable: string concatenation lets an attacker inject SQL
query = "SELECT * FROM users WHERE email = '" + input + "'"

-- Safe: parameterized query -- input is data, never executable SQL
query = "SELECT * FROM users WHERE email = ?"; params = [input]

Common use cases

Reviewing code for common vulnerability classes
Designing authentication and authorization
Threat-modeling a new feature before building it

Project ideas

Review a small existing form-handling script for injection and XSS risks, and list concrete fixes
Read the OWASP Top 10 and map each item to whether it applies to a project you've built