Lesson 1 · Free · 2 min
$ python3 -c "print(find('x' OR '1'='1'))"
Watch lesson 1 freePlausible is not safe · 2 min

Secure the code AI writes

Security · 27 lessons · 59 min · Intermediate

Generated code fails in predictable ways, and a reviewer who knows the patterns catches them in seconds. Across one running project you will review access control, injection, secrets, crypto, dependencies and AI features themselves, then wire the checks into your pipeline.

What you'll be able to do

  • Review a diff with a security eye by tracing untrusted input to the places it can do harm
  • Spot and fix broken access control, injection, path traversal and request forgery in generated code
  • Replace unsafe handling of secrets, passwords, randomness, deserialisation and errors with sound defaults
  • Detect invented, typosquatted and unpinned dependencies before they are installed
  • Limit what an AI feature or agent can do when its input is hostile, using least privilege and approval gates
  • Choose and configure scanners and CI gates, and explain what each one misses

How the lessons work

Lessons that move

Narrated, animated lessons with real terminals and code on screen.

Pause and ask

Stuck? Ask out loud or type. The answer plays as a short video made for your question.

Check yourself

Short quizzes inside the lessons show whether it stuck.

Course content

27 lessons · 59 min · 2 lessons are free
Unit 1 · Why generated code fails3 lessons · 6 min
01Plausible is not safe2 minFree02Read a diff like an attacker2 minFree
03Map Tidepool's trust boundaries2 min
Unit 2 · Access and identity4 lessons · 8 min
04The missing ownership check2 min
05Routes that deny by default2 min
06Tokens you verify, not trust2 min
07Mass assignment and the hidden admin flag2 min
Unit 3 · Injection and untrusted input4 lessons · 9 min
08SQL built from f-strings2 min
09Shell commands built from strings2 min
10Paths and uploads2 min
11Fetching a URL without being used as a proxy3 min
Unit 4 · Secrets, crypto and data handling5 lessons · 11 min
12Secrets in code, and what to do when they leak2 min
13Storing passwords properly2 min
14Randomness and comparison that hold up2 min
15Deserialising untrusted data2 min
16Errors and logs that leak2 min
Unit 5 · Dependencies and the safety net5 lessons · 11 min
17Packages that do not exist yet2 min
18Lockfiles, pins and hashes2 min
19Install scripts and provenance2 min
20What scanners catch and what they miss2 min
21CI gates that hold2 min
Unit 6 · Securing the AI features you build4 lessons · 9 min
22Prompt injection is not input validation2 min
23Indirect injection and the lethal trifecta2 min
24Tool permissions and excessive agency3 min
25Sandboxing agents and trusting tool servers2 min
Unit 7 · Capstone: ship Tidepool2 lessons · 5 min
26The release review2 min
27The incident and its diagnosis2 min