In this course, we will explore the principles that make software secure and the recurring mistakes that make it vulnerable. We will look at where untrusted data enters a system, what happens when assumptions about state and concurrency break down, how cryptography is misused in practice, how access control fails, and how attacks increasingly target the supply chain and the build pipeline rather than the application itself. These principles are independent of any particular language or framework, and they will stay useful long after today's technologies have been replaced.

Considerable emphasis will be placed on hands-on work. We will write vulnerable code, exploit it, and fix it. We will also automate the detection of such issues so that a build pipeline catches them before they reach production. The programming language used in the exercises will be chosen to match the prior experience of the participants.

Course topics:

• Security Design Principles
• Threat Modeling
• Input Validation and Trust Boundaries
• Injection and Output Encoding
• Static Analysis and Automated Code Scanning
• Error Handling, Failing Securely, and Logging
• Authentication, Authorization, and Access Control
• Security Testing and Fuzzing
• Supply Chain, Secrets, and Pipeline Security
• AI Assistants and Secure Coding

• Tanya Janca, "Alice and Bob Learn Secure Coding", Wiley, 2025, ISBN 978-1-394-17170-5
• Daniel Deogun, Dan Bergh Johnsson, Daniel Sawano, "Secure by Design", Manning Publications, 2019, ISBN 9781617294358
• Teiva Harsanyi, "100 Go Mistakes and How to Avoid Them", Manning Publications, 2022, ISBN 9781617299599

Lectures and slides are in English.