Securing Larkfield's Harbor app layer by layer: a stack of eight plates an attacker must pass to reach the data — edge and transport, authentication, authorization, input handling, application logic, dependencies, secrets and config, and data and privacy. On the left, flaws found in the team's own app sit beside their fixes: MD5 password hashing replaced by argon2id, string-built SQL replaced by a bound parameter, a wildcard CORS policy narrowed to one trusted origin, and HSTS switched on. On the right, re-tests prove the fixes hold: login brute force now rate-limited, a critical dependency upgraded, a leaked API key moved to a vault, stack traces hidden, and unused personal fields no longer collected.

CY-MID-071Mid Level · Application Security

Application Security Engineering — The Defense Stack

A hands-on mid-level course that secures a web application layer by layer, as the engineer who builds and fixes it. Work the defense stack — Edge & Transport, Authentication, Authorization, Input Handling, Application Logic, Dependencies, Secrets & Config, and Data & Privacy — finding each vulnerability class with a safe probe against your own app and closing it in the server-side code, verified with a test. Strictly defensive, always paired with the fix. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Harden the edge with enforced TLS, security headers, and safe CORS.
Build robust authentication and enforce authorization server-side on every object and action.
Close injection and XSS with parameterization, context-aware encoding, and allowlist validation.
Secure the supply chain, manage secrets and config, and protect application data.

Price:৳8,000