Recognise the small number of mistakes that account for most real incidents, well enough to find them in your own system, to state the structural fix rather than the patch, and to explain why the same classes keep recurring

The Mistakes Behind Most Breaches

Breaches are not usually exotic. A handful of mistakes account for most of them, each with a structural cause and a structural fix. This course works through them, builds one of each, and then closes it.

8 lessons, written and corrected before you arrived. Reading them here needs no account. The first reads the whole way through; the others open and then stop, because a page nobody owns cannot tell who is reading it. Starting the course gives you your own copy, where every idea has problems standing under it and you can ask about any sentence.

Start reading

01One Mistake, Wearing Different ClothesDatabase injection, command injection, scripting in a page and template injection are not four problems. They are one problem at four boundaries, and knowing that gives you one fix.
02The Caller Is Not Running Your Softwareopening onlyA check in the page you shipped is a convenience for the honest. The caller can be a one-line command, and then only the checks on your side exist at all.
03The Most Common Serious Finding There Isopening onlyChange one number in a request and get a stranger's invoice. It survives review because the code looks correct: the missing line is a check nobody wrote, and absence is invisible.
04Follow It From the Field to the Place It Runsopening onlySomebody typed something into a box. Trace it, hop by hop, to a place that interprets it, in a browser or on your own server, and then close that path properly.
05Your Server Can Reach Things Nobody Outside Canopening onlyAccept an address and fetch it, and you have offered a stranger the use of your server's network position. That position reaches administrative ports, neighbours, and credential services.
06Nobody Chose This, Which Is the Problemopening onlyThe storage that is readable by anyone, the interface with the sample password, the error page listing your internals. None of these were decisions. That is exactly why they recur.
07Most of What You Ship, You Did Not Writeopening onlyYou chose forty packages and you run a thousand. A report arrives about one of them. The useful questions are what you actually run, whether it is reachable, and what to do.
08Could You Reconstruct It Afterwardsopening onlyEvery earlier lesson assumed you find out. The test of your logging is not whether it exists but whether you can answer, today, a question you will be asked under pressure.