01 · before the session
Lock your doors
Pre-work. Put passkeys or MFA on every account that can take down your app, set up a password manager, and get the lab running.
20 min · deliverable: text notesBring an app you built with AI. You attack a deliberately vulnerable app first, then your own, and fix what you find: leaked keys, broken access control, injection, prompt injection, and a coding agent with too much trust. Physical class on your own laptop, with 20 minutes of setup at home first.
Outcome. Leave with your own app audited, its top three holes fixed, and a security gate that runs on every push.
One evening, 3 hours, plus 20 min pre-work · physical
Your builder path
6 chapters · 6 blocks- 01Lock your doors20 min
- 02Think like the attacker25 min
- 03Secrets and AI context35 min
- 04OWASP Top 10 hunt50 min
- 05When the AI is the attack surface35 min
- 06Ship gate and breach plan25 min
02 · block 1
Think like the attacker
How one missing setting exposed 1.5 million tokens, the legal line you never cross, and a one-page threat model of your own app.
25 min · deliverable: file upload03 · block 2
Secrets and AI context
Find a secret key shipped to every visitor, scan your git history for leaks, and stop your coding agent from reading .env.
35 min · deliverable: text notes04 · block 3
OWASP Top 10 hunt
Break LabShop four ways from the OWASP Top 10:2025, fix each hole with your agent, prove it with curl, then repeat two checks on your own app.
50 min · deliverable: text notes05 · block 4
When the AI is the attack surface
Trick LabShop's chatbot into leaking its hidden instructions, stop model output from running as code, and lock down the coding agent that builds your app.
35 min · deliverable: text notes06 · block 5
Ship gate and breach plan
Add a security workflow that runs on every push, publish a SECURITY.md, and write the one-page plan for the day something leaks. Trainer approval issues your certificate.
25 min · deliverable: git repo urlLock a seat on a session below to open chapter 1, Lock your doors. The other chapters open on the day of your class and stay open after it.
Sessions
No sessions scheduled. Register your interest on the school site and we will email you when one opens.