The whole catalog

Every topic, in one place.
Most are still being written.

482 topics across 7 modules, in a suggested order. Search them, or narrow the list to the lessons you can read today.

482 topics

Still being written 179 of 482 lessons are drafted and open to read while they're reviewed. Planned topics show where the catalog is going.

Reading a program

Start here

Start with the vocabulary: what code says, what it does, and how to follow a small example.

Values, names, and variables

Start here

Follow declarations and assignments closely before treating a variable as a box in memory.

Bits, numbers, and text

Start here

Look beneath familiar values without assuming every language stores them in the same way.

Decisions and repetition

Build understanding

Use the values you understand to choose a path, repeat work, and reason about termination.

Functions, calls, and closures

Build understanding

Follow a call from argument evaluation to return, then explore the state a function can carry.

Collections and structured values

Build understanding

Build larger values and learn what indexing, resizing, copying, and iteration really involve.

References and pointers

Build understanding

Name the thing a value refers to, then follow how each language lets you reach and change it.

Types and abstraction

Build understanding

Describe the values an operation accepts and see how each language expresses a reusable contract.

Functional evaluation and effects

Build understanding

Use Haskell to question familiar assumptions about mutation, function arguments, and the timing of work.

Modules, names, and visibility

Build understanding

Organize definitions and make the boundary between public and private names explicit.

Errors and failure

Build understanding

Follow what happens when a normal result is unavailable, and keep failure behavior explicit.

Lifetimes, ownership, and cleanup

Go underneath

Now ask who can use a value, how long it remains valid, and who is responsible for releasing resources.

The machine underneath

Start here

Meet the hardware your program eventually runs on, without needing to build it.

Concept planned

Booleans and logic gates

Build AND, OR, NOT, and XOR truth tables, then connect boolean expressions to the idea of a logic gate.

TypeScriptGoRustCHaskellJava
Concept planned

Instructions, registers, and the CPU

What does a processor actually do? Follow fetch, decode, and execute, and the small set of operations everything reduces to.

TypeScriptGoRustCHaskellJava
Concept planned

Registers, caches, and main memory

Why is some memory faster than other memory? Compare the levels between a register and main memory, and what a cache miss costs.

TypeScriptGoRustCHaskellJava
Concept planned

Reading a little assembly

What did the compiler turn this function into? Read a short listing and match it back to the source, without memorizing an instruction set.

CGoRust

Building and loading a program

Build understanding

Follow dependencies, build inputs, and initialization before examining the generated program.

Concept planned

Build commands and dependency resolution

What inputs does the toolchain need? Follow tsc, go, Cargo, a C compiler and linker, Cabal, and javac.

TypeScriptGoRustCHaskellJava
Concept planned

Imports, dependencies, and initialization

What happens when a dependency is loaded? Compare dependency graphs, cycles, and initialization rules.

TypeScriptGoRustCHaskellJava
Concept planned

Versions, lockfiles, and reproducible builds

Why does the same project build differently on another machine? Follow version ranges, lockfiles, and pinned toolchains.

TypeScriptGoRustCHaskellJava

Your program and the operating system

Build understanding

Follow what a running program asks the operating system for: memory, files, input, output, and an exit.

Concept planned

Processes and address spaces

What is a running program to the operating system? Follow a process, its own view of memory, and what separates it from others.

TypeScriptGoRustCHaskellJava
Concept planned

Arguments, environment, and process startup

What exists before main runs? Follow how arguments and environment variables reach a program, and what each runtime sets up first.

TypeScriptGoRustCHaskellJava
Concept planned

System calls and the kernel boundary

How does a program ask the operating system to do something? Trace a library call down to a system call.

TypeScriptGoRustCHaskellJava
Concept planned

File descriptors and handles

What does an open file look like from inside a program? Follow descriptors, standard streams, and closing what you open.

TypeScriptGoRustCHaskellJava
Concept planned

Virtual memory and the allocator

Where does heap memory come from? Follow pages from the operating system through the allocator to the value you created.

TypeScriptGoRustCHaskellJava
Concept planned

Signals, exit status, and termination

How does a program end, and who finds out? Follow exit codes, signals such as SIGINT and SIGTERM, and cleanup that may not run.

TypeScriptGoRustCHaskellJava

Memory, references, and layout

Go underneath

Connect language behavior to storage while keeping conceptual diagrams distinct from measured layouts.

Concept planned

Addresses and storage

What is a memory address, and when does a language let you work with one? Compare physical storage with a diagram of bindings.

TypeScriptGoRustCHaskellJava
Concept planned

Size, alignment, and padding

Why can a record occupy more bytes than its fields add up to? Inspect a concrete layout and name its assumptions.

CGoRustJava
Concept planned

Endianness and byte order

How is a multi-byte number arranged? Compare memory inspection with a portable serialized representation.

TypeScriptGoRustCHaskellJava
Concept planned

Escape analysis and allocation

Does returning a value or creating an object imply a heap allocation? Explore what an implementation can prove and optimize.

GoJavaTypeScript
Concept planned

Locality, indirection, and caches

Why can two ways of storing the same data have different costs? Follow contiguous access and pointer chasing.

TypeScriptGoRustCHaskellJava
Haskell planned

Haskell thunks, sharing, and retained values

What can a delayed computation keep alive? Inspect a named implementation instead of assuming a mutable variable slot.

Haskell

Evaluation, retention, and reclamation

Go underneath

Distinguish when work happens, why data stays reachable, and how storage becomes eligible for reclamation.

Concept planned

Leaks in garbage-collected programs

How can memory grow when a collector is running? Find caches, listeners, and closures that keep values reachable.

TypeScriptGoHaskellJava
Haskell planned

Folds, strictness, and space leaks

When can a retained expression grow instead of being evaluated? Compare folds, strict accumulation, and retained data.

Haskell
Java planned

JVM heap generations and collectors

Why do most objects die young, and what does a collector do about it? Compare generations, pauses, and collector choices.

Java

Time, concurrency, and shared state

Go underneath

Reason about more than one activity after calls, mutation, lifetime, and failure are familiar.

Concept planned

Concurrency and parallelism

Can tasks overlap without running simultaneously? Separate task structure, scheduling, and multiple execution resources.

TypeScriptGoRustCHaskellJava
Concept planned

Threads, tasks, and goroutines

Who schedules each unit of work? Compare runtime tasks with operating-system threads.

TypeScriptGoHaskellRustJava
Concept planned

Promises, futures, and async/await

How do asynchronous results represent completion and suspension? Compare promises, futures, and languages with async/await; Java has futures without built-in await syntax.

TypeScriptRustJava
TypeScript planned

The event loop and queued work

When does a callback or promise continuation run? Trace queued work and compare runtime-specific scheduling rules.

TypeScript
Concept planned

Data races and synchronization

Which interleaving changes the result? Compare locks, atomics, and the visibility guarantees of a memory model.

TypeScriptGoRustCHaskellJava
Concept planned

Channels and message passing

Who owns data as it travels between tasks? Compare queues, channels, shared memory, and bounded capacity.

GoHaskellRustJava
Concept planned

Cancellation, deadlocks, and task lifetime

What happens when work must stop or two tasks wait on each other? Follow cancellation, cleanup, and waiting dependencies.

TypeScriptGoRustCHaskellJava
TypeScript planned

Workers and parallelism in JavaScript

How does single-threaded JavaScript use several cores? Follow workers, message copying, and shared memory.

TypeScript
Go planned

Go select, sync, and context

How do goroutines wait, coordinate, and stop? Follow select, WaitGroup, Mutex, and cancellation through context.

Go
Rust planned

Rust Send, Sync, and thread boundaries

Which values can cross threads, and which references can be shared? Connect type guarantees to synchronization.

Rust
C planned

C threads, mutexes, and atomics

What does C give you for concurrency, and what is left to you? Follow pthreads or C11 threads, mutexes, and atomic operations.

C
Haskell planned

Haskell threads, MVar, and STM

How do threads coordinate through a shared runtime? Compare synchronized cells with composable memory transactions.

Haskell
Java planned

Java threads, executors, and virtual threads

How does Java run work concurrently? Compare platform threads, executor pools, and virtual threads.

Java

Compilers, virtual machines, and runtimes

Go underneath

Bring the pieces together: how language rules become executable work, and what the runtime supplies.

Concept planned

Parsing, syntax trees, and intermediate forms

How does source text become something a tool can analyze? Follow tokens, an AST, and an intermediate representation.

TypeScriptGoRustCHaskellJava
Concept planned

How a type checker works

What does the compiler do with your types? Follow checking and inference over a small syntax tree.

TypeScriptGoRustCHaskellJava
Concept planned

Compilation and interpretation

What is translated, and what is executed? Compare strategies without treating compiled and interpreted as exclusive language categories.

TypeScriptGoRustCHaskellJava
Concept planned

Linking, loading, and modules

How are separately built pieces connected? Compare symbols, libraries, imports, and loading a program.

TypeScriptGoRustCHaskellJava
Concept planned

Optimization, AOT, and JIT

Why might the machine do less work than the source suggests? Explore ahead-of-time compilation, hot paths, and preserving observable behavior.

TypeScriptGoRustCHaskellJava
TypeScript planned

TypeScript checking and JavaScript execution

Which parts of TypeScript survive into JavaScript? Follow erased types, emitted code, and the separate JavaScript runtime.

TypeScript
Go planned

Go runtime services and scheduling

What remains at runtime in a compiled program? Follow goroutine scheduling, stack growth, and garbage collection.

Go
Rust planned

Rust monomorphization and trait dispatch

How does a generic operation become executable code? Compare concrete instantiations with dynamic trait dispatch.

Rust
C planned

C preprocessing, translation units, and ABI

How does a declaration become a linked call? Separate preprocessing, compilation, symbol resolution, and platform calling conventions.

C
Haskell planned

GHC, thunks, and the runtime system

How does GHC turn Haskell into executable code? Explore delayed computations, garbage collection, and runtime services without confusing them with language guarantees.

Haskell
Java planned

Bytecode and the JVM

What sits between Java source and machine execution? Explore class files, loading, verification, and runtime services.

Java

Quantities and representation

Start here

Choose useful quantities, keep units straight, and understand how values are represented.

Change, uncertainty, and evidence

Build understanding

Use growth, probability, and statistics to interpret behavior and measurements.

Math in engineering decisions

Go underneath

Apply simple models to queues, reliability, retries, caches, capacity, and subnet plans.

Math behind AI

Build understanding

Understand the math inside embeddings, training, and model output.

Networking foundations

Start here

Follow data across local links, network boundaries, and service endpoints.

Concept planned

What a network does

Relate hosts, interfaces, links, and paths to the services people use.

Concept planned

Layers, encapsulation, and decapsulation

Trace how link, network, transport, and application data wrap around one request.

Concept planned

Frames, MAC addresses, and local delivery

Explain local-link delivery and where ARP or neighbor discovery fits.

Concept planned

IPv6 address structure and neighbor discovery

Read prefixes, link-local addresses, and compressed forms without treating IPv6 as longer IPv4.

Concept planned

ICMP and ping

See how hosts report unreachable destinations and expired packets, and what a ping reply does and doesn't prove.

Concept planned

Ports, sockets, and endpoint identity

Connect addresses and transport ports to the local endpoints programs actually open.

TypeScriptGo
Concept planned

Byte order and wire formats

Read and write protocol headers from raw bytes, with endianness and length-prefixed framing made explicit.

TypeScriptGo
Concept planned

TCP and UDP

Compare a reliable ordered byte stream with datagrams, and see what each contract leaves to the application.

TypeScriptGo
Concept planned

DNS lookup path

Follow a name through resolver caches, records, and authoritative answers; recognize common failure points.

TypeScriptGo
Concept planned

DHCP and address configuration

Understand how a host receives an address, route, and resolver configuration and renews its lease.

Concept planned

Common network services

Learn what HTTP(S), SSH, NTP, SMTP, and common file and name services do beyond their port numbers.

Concept planned

Physical media and wireless basics

Compare copper, fiber, transceivers, Wi-Fi bands, channels, and interference in context.

Network design and protocols

Build understanding

Understand how networks forward, filter, secure, and deliver application traffic.

Concept planned

Routing and forwarding

Use a route table to explain next-hop choice and longest-prefix matching.

TypeScriptGo
Concept planned

Switching, VLANs, and broadcast domains

Show how switches forward frames and how VLANs separate layer-two traffic.

Concept planned

NAT and port forwarding

Trace address translation, connection state, and inbound reachability without treating NAT as a firewall.

Concept planned

Firewalls, ACLs, and packet filtering

Reason about rule order, direction, state, and default action in a packet policy.

Concept planned

Flow control, congestion, and head-of-line blocking

See why throughput ramps up gradually and how one lost packet can stall everything behind it.

TypeScriptGo
Concept planned

HTTP request and response path

Inspect methods, status, headers, bodies, connection reuse, and intermediaries in a real local exchange.

TypeScriptGo
Concept planned

TLS and certificate validation

Understand the handshake, peer identity, trust chains, and what common validation failures mean.

Concept planned

mTLS and service identity

Have both sides of a connection present certificates and see how services authenticate each other.

TypeScriptGo
Concept planned

HTTP/2, HTTP/3, and QUIC

Compare multiplexing, header compression, and QUIC over UDP, and see what each version changes for an application.

TypeScriptGo
Concept planned

CORS and browser network rules

Understand same-origin policy, preflight requests, and cross-site cookies, and read the errors browsers report.

TypeScriptGo
Concept planned

Real-time transports

Compare polling, long polling, server-sent events, and WebSockets by connection cost and behavior through proxies.

TypeScriptGo
Concept planned

Proxies, reverse proxies, and load balancers

Locate connection termination, trusted forwarding metadata, and backend selection.

TypeScriptGo
Concept planned

VPNs and network segmentation

Compare tunnels, remote access, site links, and the boundaries segmentation does and does not create.

Concept planned

Cloud and virtual networks

Relate subnets, routes, gateways, overlays, and provider-specific security controls.

Concept planned

Container and Kubernetes networking

Trace traffic through bridge networks, port mappings, service IPs, and in-cluster DNS.

Concept planned

Wireless network behavior

Diagnose association, authentication, roaming, channel overlap, and environmental interference.

Operations and troubleshooting

Go underneath

Gather network evidence, narrow likely causes, and verify that a repair worked.

Concept Pro planned

A repeatable network troubleshooting method

Scope the impact, collect observations, test one hypothesis at a time, and confirm recovery.

Concept Pro planned

Connection refused, reset, and timed out

Read each connection error as evidence pointing to a different layer or component.

TypeScriptGo
Concept Pro planned

Read route, interface, and neighbor tables

Use host tools to inspect local configuration and understand what their output cannot prove.

Concept Pro planned

DNS, DHCP, and address-conflict diagnosis

Distinguish name resolution, lease, route, and duplicate-address failures.

Concept Pro planned

Latency, bandwidth, throughput, loss, and jitter

Choose the measurement that answers the question, keep units visible, and account for direction.

Concept Pro planned

Traceroute, MTU, and path diagnosis

Interpret hops and packet-size tests while allowing for filtered or hidden responses.

Concept Pro planned

Inspecting HTTP from the client

Use curl and the browser network panel to see requests, timing, redirects, and TLS details before reaching for packet capture.

Concept Pro planned

Packet capture and protocol inspection

Reconstruct conversations, use capture filters, and recognize what encryption hides.

Concept Pro planned

Network monitoring and baselines

Relate counters, flow data, logs, and SNMP concepts to useful time and workload comparisons.

Concept Pro planned

Network documentation and change control

Maintain address plans, diagrams, port records, ownership, and a reversible verification plan.

Security mindset and core vocabulary

Start here

Build a practical vocabulary for reasoning about software risk and controls.

Concept planned

Security goals: confidentiality, integrity, availability

Which property a control protects, and what it cannot protect.

Concept planned

Assets, actors, trust boundaries, and attack surface

Start from what matters, who can influence it, and where data crosses ownership.

Concept planned

Threat, vulnerability, exploit, impact, and risk

Distinguish a weakness from its possible use and consequence.

Concept planned

Authentication, authorization, and accounting

Identity proof, permission decisions, and evidence are different jobs.

Concept planned

Least privilege and secure defaults

Grant only the access needed; make the safe path the default.

Concept planned

Defense in depth and security boundaries

Layer controls without treating any single layer as a substitute for the others.

Concept planned

Fail open or fail closed

Choose behavior when a control or dependency is unavailable, based on the protected action.

Concept planned

Security by design versus security by obscurity

Keep useful design secrecy distinct from controls that must hold even when implementation is known.

Threat modeling and secure design

Start here

Start with assets and boundaries; use threats to decide which controls matter.

Concept planned

Threat modeling a small feature

Identify assets, actors, boundaries, abuse cases, and the controls that change the risk.

Concept planned

Data-flow diagrams and trust boundaries

Draw only the flows needed to make security assumptions visible and reviewable.

Concept planned

STRIDE and alternative threat prompts

Use a structured prompt as a completeness aid, not as a scoring oracle.

Concept planned

Abuse cases and business logic

Ask how a valid feature can be misused, combined, repeated, or accessed out of sequence.

Concept planned

Security requirements and acceptance criteria

Turn risks into explicit, testable requirements before implementation.

Concept planned

Secure architecture decisions

Record assumptions, rejected options, residual risk, and revisit triggers.

Concept planned

Attack surface reduction

Remove unused routes, permissions, dependencies, endpoints, and data.

Concept planned

Third-party and integration trust

Define what each provider may send, read, change, and trigger.

Concept planned

Privacy and security design review

Include data minimization, user expectations, and misuse impact alongside technical controls.

Concept planned

Lightweight threat-model review in pull requests

Revisit the model when a change adds a new boundary, privilege, data type, or external dependency.

Web and API trust boundaries

Start here

Identify the trust boundaries where web requests and data enter the system.

Concept planned

The browser is an untrusted client

UI state and client-side checks can improve experience but cannot authorize a server action.

TypeScriptGo
Concept planned

Trace untrusted data end to end

Follow a value from URL, form, header, cookie, or webhook to every sink that uses it.

TypeScriptGo
Concept planned

Parse, validate, normalize, and encode are different

Validate data for its domain; encode for the output context; avoid treating these steps as interchangeable.

TypeScriptGo
Concept planned

Allowlist validation and bounded input

Define accepted shapes, sizes, ranges, and formats at each boundary.

TypeScriptGo
Concept planned

Canonicalization and double-decoding bugs

Agree on one representation before validation and use; reject ambiguous encodings.

TypeScriptGo
Concept planned

HTTP security-relevant behavior

Understand methods, status codes, headers, cookies, origins, caching, redirects, and content types as part of the security contract.

TypeScriptGo
Concept planned

Client-side versus server-side validation

Duplicate user-friendly checks when useful, but enforce the actual security rule at the trusted boundary.

TypeScriptGo
Concept planned

Error messages and information leakage

Return useful errors without disclosing secrets, stack traces, internal topology, or account existence unnecessarily.

TypeScriptGo

Output handling and injection

Start here

Keep untrusted data from becoming executable code or query structure.

Concept planned

Reflected, stored, and DOM-based XSS

Where attacker-controlled content enters and how it reaches an executable browser context.

TypeScriptGo
Concept planned

Contextual output encoding

HTML text, attributes, URLs, JavaScript, CSS, and rich text require different safe handling.

TypeScriptGo
TypeScript planned

Safe DOM APIs and dangerous HTML escape hatches

Prefer text and structured APIs; isolate and sanitize rich HTML when it is genuinely required.

TypeScript
TypeScript planned

Framework escaping and its limits

Know what a framework escapes automatically and identify raw HTML, unsafe URL, and template escape hatches.

TypeScript
Concept planned

NoSQL and search-query injection

Treat query operators and search syntax as untrusted structure, not harmless strings.

TypeScriptGo
Concept planned

OS command injection

Avoid shell construction; call a process with argument arrays and constrained inputs when process execution is necessary.

TypeScriptGo
Concept planned

Template, expression, and code injection

Separate data from executable templates and avoid evaluating untrusted expressions.

TypeScriptGo
Concept planned

LDAP, XPath, and other interpreter injection

Recognize that every interpreter needs its own parameterization or safe construction strategy.

TypeScriptGo
Concept planned

Header, CRLF, and log injection

Keep untrusted values from creating response headers, splitting messages, or forging log records.

TypeScriptGo
Concept planned

Deserialization and object construction

Avoid unsafe polymorphic deserialization; constrain types and validate parsed data.

TypeScriptGo
TypeScript planned

Prototype pollution

Prevent attacker-controlled object keys from changing inherited properties, configuration, or later authorization checks in JavaScript.

TypeScript
Concept planned

ReDoS and parser complexity

Bound input and algorithmic work so valid-looking inputs cannot monopolize CPU or memory.

TypeScriptGo

Authorization and access control

Start here

Make every sensitive action depend on an explicit, verified permission.

Concept planned

Deny by default and check every request

Enforce authorization on the server for every protected operation and resource.

TypeScriptGo
Concept planned

Function-level and administrative authorization

Protect privileged actions independently of whether a user can access the general application.

TypeScriptGo
Concept planned

Horizontal and vertical privilege escalation

Test access across peers and across privilege levels.

TypeScriptGo
Concept planned

RBAC, ABAC, and relationship-based policies

Choose a model that represents real ownership, attributes, roles, and relationships.

TypeScriptGo
Concept planned

Authorization policy placement

Centralize policy enough to audit it while keeping resource ownership explicit.

TypeScriptGo
Concept planned

Tenant isolation

Derive tenant context from a verified membership, scope every query, and add database protections where appropriate.

TypeScriptGo
Concept planned

Mass assignment and over-posting

Bind only fields the caller is allowed to set; do not deserialize request fields directly into privileged domain state.

TypeScriptGo
Concept planned

Time-of-check/time-of-use authorization

Keep the permission decision valid through the protected change, particularly under concurrency.

TypeScriptGo
Concept planned

Authorization regression tests

Build a matrix of subject, resource, operation, and expected outcome; test negative cases as first-class behavior.

TypeScriptGo

Authentication, credentials, and sessions

Build understanding

Protect account access, credentials, and the sessions that represent a user.

Concept planned

Password storage and verification

Use a maintained password-hashing function with its intended salt and work parameters; never encrypt or fast-hash passwords as a substitute.

TypeScriptGo
Concept planned

Login abuse and credential stuffing

Combine throttling, abuse signals, MFA, and safe recovery without creating easy denial-of-service lockouts.

TypeScriptGo
Concept planned

Multi-factor authentication and passkeys

Understand factor independence, phishing resistance, recovery, and the risk of weak fallback paths.

TypeScriptGo
Concept planned

Account recovery and password reset

Use short-lived, single-use reset capabilities; avoid account enumeration and insecure reset questions.

TypeScriptGo
Concept planned

Session identifiers and entropy

Generate unpredictable session identifiers with cryptographic randomness.

TypeScriptGo
Concept planned

CSRF and same-site request defenses

Protect cookie-authenticated state changes with an explicit request-origin strategy.

TypeScriptGo
Concept planned

OAuth 2.0 and OpenID Connect roles

Distinguish authorization from authentication and keep client, resource server, and identity provider responsibilities clear.

TypeScriptGo
Concept planned

API keys, bearer tokens, and signed tokens

Decide who can see a credential, its scope and lifetime, and how it is revoked; never treat a decoded token as trusted.

TypeScriptGo
Concept planned

Service identities and workload credentials

Prefer short-lived, narrowly scoped machine identity over copied long-lived secrets.

TypeScriptGo
Concept planned

Sensitive-action confirmation and reauthentication

Add stronger proof for account, payment, or permission changes where risk justifies it.

TypeScriptGo

Data protection and cryptography

Build understanding

Choose sound ways to protect sensitive data, secrets, and cryptographic keys.

Concept planned

Data classification and minimization

Collect, retain, expose, and log only what the feature needs.

Concept planned

TLS, certificate validation, and trust stores

Verify peers and configure the transport; encryption without correct certificate validation is incomplete.

TypeScriptGo
Concept planned

Encryption at rest and field-level protection

Choose what is protected from which threat and account for application access to decryption keys.

TypeScriptGo
Concept planned

Hashing, encryption, encoding, and signing

Explain the distinct security properties each operation provides.

Concept planned

Cryptographically secure randomness

Use platform cryptographic APIs for tokens, reset links, and unpredictable secrets—not general-purpose PRNGs.

TypeScriptGo
Concept planned

Key lifecycle and key management

Generate, store, grant access to, rotate, back up, and retire keys deliberately.

TypeScriptGo
Concept planned

Timing attacks and constant-time comparison

Avoid leaking secrets through data-dependent comparison or other observable timing where constant-time primitives are appropriate.

TypeScriptGo
Concept planned

Message authentication and digital signatures

Verify integrity and sender authenticity without confusing signatures with encryption.

TypeScriptGo
Concept planned

Nonces, IVs, and authenticated encryption

Use library-managed, unique parameters and authenticated modes; never invent a crypto protocol.

TypeScriptGo
Concept planned

Token and URL leakage

Keep credentials out of URLs, referrers, analytics, error reports, and logs.

TypeScriptGo
Concept planned

Backups, deletion, and cryptographic erasure

Align copies, retention, access, and key destruction with the data lifecycle.

API, workflow, and abuse resistance

Build understanding

Protect APIs and business workflows from unauthorized use and resource abuse.

Concept planned

API authentication is not API authorization

Validate identity and separately check action and resource access.

TypeScriptGo
Concept planned

Request size, pagination, and resource limits

Bound payloads, nested structures, result sizes, and expensive operations.

TypeScriptGo
Concept planned

Rate limiting and abuse controls

Apply limits to the right identity and operation while considering distributed clients and shared infrastructure.

TypeScriptGo
Concept planned

Idempotency and replay resistance

Make retries safe and protect sensitive one-time actions from replay.

TypeScriptGo
Concept planned

Workflow and business-logic abuse

Validate allowed state transitions on the server, not just individual fields.

TypeScriptGo
Concept planned

Price, quota, and entitlement tampering

Derive sensitive values and eligibility from trusted state.

TypeScriptGo
Concept planned

Webhook signature verification

Verify the exact raw body and timestamp using the provider's documented scheme, then handle duplicates safely.

TypeScriptGo
Concept planned

SSRF and server-side fetches

Restrict destinations and redirects, validate resolved addresses including cloud metadata ranges, and isolate outbound network access.

TypeScriptGo
Concept planned

Clickjacking and framing controls

Decide which trusted origins may embed the application and set frame protections accordingly.

TypeScriptGo
Concept planned

GraphQL and query-shape abuse

Bound depth, complexity, batching, and object-level authorization.

TypeScriptGo
Concept planned

WebSocket and long-lived connection security

Authenticate connection setup, authorize each relevant message/action, and handle expiry and origin checks.

TypeScriptGo
Concept planned

HTTP request smuggling and parser disagreement

Investigate when a proxy and origin parse message boundaries differently, and verify consistent handling across the request path.

TypeScriptGo
Concept planned

Web cache poisoning and cache deception

Check whether cache keys and origin behavior can store attacker-influenced content or expose a private response to other users.

TypeScriptGo

LLM and AI application security

Build understanding

Secure AI features by treating model inputs, outputs, retrieved content, and tool proposals as untrusted.

Concept planned

Threat-model an LLM feature

Map user prompts, system instructions, retrieved content, model providers, tools, and sinks as separate trust boundaries.

TypeScript planned

Direct and indirect prompt injection

Understand that instructions in user input or retrieved content can manipulate model behavior; prompt wording alone is not a security boundary.

TypeScript
Concept planned

Untrusted model output and dangerous sinks

Validate and authorize structured outputs before they reach HTML, SQL, shell, URLs, code execution, or state-changing tools.

TypeScriptGo
TypeScript planned

Data exfiltration through rendered output

Prevent rendered model-authored links or media from making unintended external requests that disclose sensitive context.

TypeScript
Concept planned

Tool calls as untrusted requests

Treat every proposed tool call as data; validate its schema, caller, target, scope, and current user permissions in ordinary application code.

TypeScriptGo
Concept planned

Agent permissions and excessive agency

Limit available tools, operation scope, autonomy, and downstream identities to what the task actually needs.

TypeScriptGo
Concept planned

MCP and tool server security

Assess server identity, untrusted tool descriptions and results, authorization scope, and credential exposure across the client-server boundary.

TypeScriptGo
Concept planned

Human approval for high-impact actions

Require explicit, contextual confirmation before irreversible, externally visible, or privileged actions.

TypeScriptGo
Concept planned

Retrieval authorization and tenant isolation

Apply the requesting user's permissions before retrieval and recheck authorization before disclosing retrieved content.

TypeScriptGo
Concept planned

Poisoned and hostile retrieved content

Treat documents, web pages, email, and tool results as untrusted context that can contain indirect instructions.

TypeScriptGo
Concept planned

Vector stores, embeddings, and sensitive data

Protect access to source documents, derived embeddings, metadata, and retrieval results; consider leakage and cross-tenant exposure.

TypeScriptGo
Concept planned

System prompts are not secrets

Keep credentials and access decisions out of prompts; assume instructions can be exposed and enforce controls elsewhere.

TypeScript planned

Conversation state and agent memory isolation

Scope memory to a user and task, define retention, and prevent one session's content from influencing another's.

TypeScript
Concept planned

AI provider data handling and privacy

Understand what prompts, files, telemetry, and outputs leave the system and the provider's retention and training settings.

Concept planned

Model, dataset, and plugin supply-chain risk

Verify provenance and permissions for models, fine-tuning data, connectors, plugins, and other components.

Concept planned

Unbounded token use, loops, and cost abuse

Set budgets, deadlines, output limits, and stopping rules for model calls and agent loops.

TypeScriptGo
Concept planned

LLM security evaluations and regression tests

Test security properties across prompt variations and workflow states; retain reproducible cases while recognizing model variability.

TypeScriptGo
Concept planned

Red-team an AI feature safely

Probe a local or authorized test system for data exposure, tool misuse, policy bypass, and resource abuse.

TypeScriptGo
Concept planned

AI security incident response

Preserve relevant prompts, tool-call decisions, retrieved sources, model/provider versions, and outcomes without logging unnecessary sensitive content.

Security testing and code review

Build understanding

Turn security properties into reviewable, repeatable tests.

Concept planned

Turn a threat into a test

Express the expected security property as a testable invariant.

TypeScriptGo
Concept planned

Negative authorization tests

Assert that the wrong user, tenant, role, or workflow state is rejected.

TypeScriptGo
Concept planned

Unit, integration, and end-to-end security tests

Place each check where it can exercise the real boundary without overclaiming coverage.

TypeScriptGo
Concept planned

Regression tests for vulnerabilities

Preserve a minimal failing input and prove the fixed behavior at the relevant layer.

TypeScriptGo
Concept planned

Static analysis and lint rules

Use tools to find classes of mistakes; triage findings and understand blind spots.

Concept planned

Dynamic and interactive application testing

Exercise a running test deployment safely and interpret scanner results rather than treating them as proof.

Concept planned

Fuzzing parsers and validators

Generate unexpected inputs to find crashes, hangs, and invariant failures.

TypeScriptGo
Concept planned

Dependency and container scanning

Track components and investigate findings in the context of actual usage and exposure.

Concept planned

Secure code review checklist

Follow sources, trust boundaries, sinks, authorization decisions, secrets, and failure paths.

Concept planned

False positives, false negatives, and test coverage

Understand why scanners and passing tests cannot establish that an application is secure.

Concept planned

Security test environments and safe fixtures

Use synthetic data, scoped credentials, and isolated targets; do not test real systems without authorization.

Files, uploads, and content processing

Build understanding

Handle uploaded files and complex content as hostile input.

Concept planned

Secure file upload pipeline

Enforce size, type, content, storage, and authorization checks as separate controls.

TypeScriptGo
Concept planned

MIME type and extension validation

Treat client-provided filenames and content types as claims, not evidence.

TypeScriptGo
Concept planned

Safe file names and storage locations

Generate server-side names and keep untrusted content out of executable or public paths.

TypeScriptGo
Concept planned

Malware scanning and quarantine workflow

Define pending, scanned, rejected, and available states without trusting a scan as perfect.

TypeScriptGo
Concept planned

Archive extraction and path traversal

Prevent entries from escaping the intended destination and bound expansion.

TypeScriptGo
Concept planned

Image, document, and media parser risks

Isolate complex parsers and apply resource limits and updates.

TypeScriptGo
Concept planned

Content-Disposition and download safety

Serve untrusted files with deliberate content types and download behavior.

TypeScriptGo
Concept planned

Import, export, and CSV formula injection

Treat exported values as active content when opened by spreadsheet software.

TypeScriptGo
Concept planned

XML external entities and unsafe XML features

Disable unnecessary entity resolution and bound parsing.

TypeScriptGo
Concept planned

Rich text sanitization and safe rendering

Define allowed markup, sanitize with maintained tooling, and preserve context-safe rendering.

TypeScriptGo

Dependencies, build systems, and software supply chain

Build understanding

Know what enters builds and reduce risk in dependencies and delivery pipelines.

Concept planned

Dependency inventory and transitive risk

Know what is in the build, where it came from, and which paths execute it.

Concept planned

Vulnerability advisories and triage

Consider affected versions, reachability, exposure, available fixes, and compensating controls.

Concept planned

Lockfiles, registries, and package confusion

Pin expected sources and prevent untrusted packages or namespaces from entering a build.

Concept planned

Dependency updates and patch policy

Automate discovery while retaining review, testing, and a way to respond quickly.

Concept planned

Secrets committed to source control

Detect exposed credentials, revoke and rotate them immediately, and remove them from future history without mistaking history rewriting for revocation.

Concept planned

Typosquatting and malicious packages

Verify package identity and provenance before adding dependencies.

Concept planned

Build isolation and reproducibility

Reduce ambient access and make artifacts traceable to reviewed source and build inputs.

Concept planned

SBOMs and component provenance

Produce useful component and build-origin records; distinguish inventory from a security guarantee.

Concept planned

Artifact signing and verification

Establish who produced an artifact and verify integrity at consumption.

Concept planned

CI/CD secret exposure

Use scoped, short-lived credentials and keep untrusted pull requests away from privileged secrets.

Concept planned

Pipeline permissions and workflow injection

Treat workflow files, actions, build scripts, and user-controlled parameters as executable attack surface.

Concept planned

Third-party actions, plugins, and build extensions

Pin and review external code that runs with pipeline privileges.

Concept planned

Coordinated vulnerability disclosure and patch response

Provide a safe reporting path, assess impact, ship fixes, and communicate clearly.

Browser, frontend, and privacy security

Build understanding

Understand browser protections and preserve user privacy in client experiences.

Concept planned

Same-origin policy and origin model

Understand scheme, host, and port as browser isolation boundaries.

Concept planned

CORS preflight and credentialed requests

Configure explicit origin and credential behavior without using wildcard shortcuts for private data.

TypeScript planned

postMessage and cross-window messaging

Validate sender origin, source window, and message shape before trusting data from popups, frames, or embedded widgets.

TypeScript
TypeScript planned

Browser storage trade-offs

Compare cookies, local storage, session storage, and in-memory state by threat and use case.

TypeScript
Concept planned

Content Security Policy deployment

Start with report-only observation, remove unsafe allowances, and test real application flows.

Concept planned

Subresource Integrity and third-party scripts

Reduce the risk of changed remote assets and minimize the scripts trusted with page access.

Concept planned

Referrer, permissions, and security headers

Set browser policy deliberately and verify actual deployed responses.

TypeScript planned

DOM clobbering and unsafe URL schemes

Avoid named-property collisions and validate navigable or executable URLs.

TypeScript
TypeScript planned

Cross-site leaks and side channels

Recognize that observable response differences can expose sensitive state across origins.

TypeScript
TypeScript planned

Privacy-preserving telemetry

Avoid collecting secrets and sensitive personal data in analytics, logs, or replay tools.

TypeScript

Runtime, infrastructure, and cloud security

Go underneath

Reduce the privileges and exposure of the systems that run the application.

Concept Pro planned

Security configuration and hardened defaults

Make secure configuration explicit, reviewable, environment-specific, and checked at startup.

Concept Pro planned

Least privilege for application processes

Limit database, filesystem, network, cloud, and operating-system permissions.

Concept Pro planned

Memory safety and unsafe code

Understand where unsafe and native boundaries—from Rust unsafe and Go cgo to Node extensions—bypass language safeguards and require explicit review.

TypeScriptGo
Concept Pro planned

Environment variables and secret stores

Know exposure paths and choose a managed secret mechanism appropriate to deployment.

Concept Pro planned

Containers and image hygiene

Run as non-root where possible, minimize images, pin sources, and scan the resulting artifact.

Concept Pro planned

Network segmentation and egress control

Limit which components can reach each other and where an application can connect outbound.

Concept Pro planned

Cloud IAM and workload identity

Grant narrowly scoped access through identities rather than embedded static keys.

Concept Pro planned

Database account and network security

Separate application roles, restrict reachable services, and avoid administrative credentials at runtime.

Concept Pro planned

Production and non-production separation

Keep real data and production secrets out of developer machines, previews, and test fixtures.

Concept Pro planned

Backups, restore, and ransomware resilience

Protect backup access and prove recovery rather than assuming that a backup is usable.

Concept Pro planned

Patch management and exposed services

Inventory reachable components, prioritize fixes, and retire unused services.

Concept Pro planned

Infrastructure as code review

Treat permissions, network rules, storage exposure, and deployment configuration as code requiring review and tests.

Logging, detection, and incident response

Go underneath

Create useful signals, respond to security incidents, and learn from them.

Concept Pro planned

Security event logging

Record enough evidence to investigate while excluding credentials, tokens, and unnecessary personal data.

Concept Pro planned

Authentication and authorization signals

Capture useful events and context for detecting abuse without treating every failure as an incident.

Concept Pro planned

Log integrity, access, and retention

Protect logs from tampering, limit readers, and keep them only as long as justified.

Concept Pro planned

Alert quality and operational ownership

Give each alert a clear signal, severity, responder, and first action.

Concept Pro planned

Vulnerability triage and severity

Combine technical severity with reachability, exploitability, affected assets, and business impact.

Concept Pro planned

Incident response roles and first steps

Preserve evidence, contain impact, communicate, and restore service through a prepared process.

Concept Pro planned

Credential and key compromise

Revoke, rotate, identify use, invalidate sessions, and check downstream copies.

Concept Pro planned

Security incident retrospectives

Identify control and process gaps without reducing the review to blame or one patch.

Concept Pro planned

Vulnerability disclosure handling

Receive reports safely, acknowledge them, reproduce in authorized environments, and coordinate a fix.

Concept Pro planned

Tabletop exercises and response readiness

Rehearse realistic scenarios and record what people, access, or telemetry were missing.

Governance, assurance, and certification crosswalk

Go underneath

Connect engineering practices to versioned verification standards and exam objectives.

Concept Pro planned

Security policies versus implemented controls

A written policy is not evidence that a control works in code or operations.

Concept Pro planned

Secure development lifecycle

Place requirements, review, testing, release, and vulnerability response across the software lifecycle.

Concept Pro planned

OWASP ASVS as a verification catalog

Use versioned requirements to plan and check web application controls; scope the verification level to the system.

Concept Pro planned

OWASP Top 10 and common risk taxonomies

Use risk lists as awareness and prioritization aids, not complete curricula or pass/fail standards.

Concept Pro planned

NIST SSDF practices in a small team

Translate outcome-oriented secure development practices into proportionate team habits.

Concept Pro planned

Evidence, audit trails, and control ownership

Connect a control to a person, system evidence, review cadence, and remediation process.

Concept Pro planned

Risk acceptance and exceptions

Record who accepts residual risk, for how long, with what compensating controls and review date.

Concept Pro planned

Security roles and shared responsibility

Clarify product, engineering, operations, security, and provider responsibilities.

Concept Pro planned

CompTIA Security+ crosswalk

Optional exam-oriented index for applicable security foundations, threats, architecture, operations, and governance topics.

Concept Pro planned

CompTIA CySA+ crosswalk

Optional analyst-oriented index for monitoring, vulnerability management, incident response, and threat analysis.

Concept Pro planned

Exam objective versioning

State the exam code and objectives version beside every mapping; never imply the catalog alone prepares someone to pass.

Concept Pro planned

Jurisdiction- and standard-specific compliance

Link out to separately maintained, dated material rather than presenting one universal compliance checklist.

Tools and everyday workflow

Start here

Set up the small habits that make every later investigation faster.

Concept planned

Reading documentation and specifications

Where is the real answer? Compare a language specification, standard-library docs, and a blog post, and know which one makes a promise.

TypeScriptGoRustCHaskellJava
Concept planned

REPLs and scratch experiments

How do you test an idea in thirty seconds? Use a REPL or a scratch file to check one behavior before relying on it.

TypeScriptGoRustCHaskellJava
Concept planned

Formatters, linters, and warnings

What can a tool catch before you run anything? Turn on warnings, read lint findings, and let a formatter settle style.

TypeScriptGoRustCHaskellJava
Concept planned

Reading unfamiliar code

Where do you start in code you did not write? Find the entry point, follow one path, and write down what you learn.

TypeScriptGoRustCHaskellJava

Debugging with evidence

Build understanding

Move from a symptom to a small explanation you can check.

Concept planned

Compiler diagnostics and stack traces

What is the tool telling you, and where did the failure originate? Separate a diagnostic location from the cause.

TypeScriptGoRustCHaskellJava
Concept planned

Print statements and logging as evidence

What should you print, and where? Turn a print statement into a deliberate observation that can confirm or reject a guess.

TypeScriptGoRustCHaskellJava
Concept planned

Breakpoints, frames, and inspected values

Which values exist at this point? Inspect the call stack and scope without assuming an optimized program preserves every source-level detail.

TypeScriptGoRustCHaskellJava
Concept planned

Sanitizers, race detectors, and checked builds

Can a tool catch the bug while it happens? Use AddressSanitizer, go test -race, and Miri to turn silent errors into reports.

CGoRust

Tests, properties, and repeatability

Build understanding

Use examples and generated cases to challenge a claim about behavior.

Concept planned

Test structure and isolated state

How do you make an example repeatable? Compare assertions, fresh fixtures, and language-specific test runners.

TypeScriptGoRustCHaskellJava
Concept planned

Table-driven and parameterized tests

How do you check many cases without copying the test? List inputs and expected results, then report which row failed.

TypeScriptGoRustCHaskellJava
Concept planned

Testing failure paths

Does the code fail the way you promised? Check returned errors, thrown exceptions, and cleanup after a failure.

TypeScriptGoRustCHaskellJava
Concept planned

Properties and generated cases

What should hold over many inputs? Write a property, find a counterexample, and inspect which assumption failed.

TypeScriptGoRustCHaskellJava
Concept planned

Clocks, randomness, and test seams

How do you test code that depends on time or external state? Make those dependencies explicit and control them in a test.

TypeScriptGoRustCHaskellJava

Contracts, invariants, and safe changes

Build understanding

Choose useful boundaries and improve the code while keeping its promises.

Concept planned

Naming and readable code

Will the next reader understand this? Choose names that state intent, and shape code so the common path is easy to follow.

TypeScriptGoRustCHaskellJava
Concept planned

Domain types and smart constructors

Which values should be impossible to construct? Validate at a boundary and use a type or API to preserve the invariant.

TypeScriptGoRustCHaskellJava
Concept planned

API contracts and explicit dependencies

What may a caller assume? Describe inputs, outputs, effects, and failure behavior, then choose a dependency boundary that can be tested.

TypeScriptGoRustCHaskellJava
Concept planned

Reviewing code and hidden assumptions

What could break with a different caller, input, or lifetime? Review aliasing, ownership, failure paths, and implicit shared state.

TypeScriptGoRustCHaskellJava
Concept planned

Refactoring without changing behavior

Which observations must stay the same? Establish checks before changing the structure, then explain what they do and do not prove.

TypeScriptGoRustCHaskellJava

Cost, benchmarks, and profiles

Go underneath

Measure a representative workload before deciding where the cost comes from.

Concept planned

Time, space, and algorithmic cost

How does work grow with input size? Compare asymptotic cost with allocations, constant factors, and the actual workload.

TypeScriptGoRustCHaskellJava
Concept planned

Benchmarking and build modes

What does this timing measure? Account for warmup, optimization, eliminated work, input selection, and measurement noise.

TypeScriptGoRustCHaskellJava
Concept planned

CPU profiles and hot paths

Where is time being spent? Read samples and call paths, form a hypothesis, and measure the change.

TypeScriptGoRustCHaskellJava
Concept planned

Allocation profiles and retained memory

Does this program allocate frequently or keep data alive? Distinguish allocation rate, live memory, and resource leaks.

TypeScriptGoRustCHaskellJava

CLI tools and configuration

Build understanding

Give a small program a clear interface and predictable configuration.

Concept planned

Arguments, standard streams, and exit codes

How does another person or program interact with your tool? Parse arguments, distinguish output from diagnostics, and report failure.

TypeScriptGoRustCHaskellJava
Concept planned

Project structure and dependency boundaries

Where should parsing, domain behavior, and I/O live? Organize a small project around responsibilities and explicit dependencies.

TypeScriptGoRustCHaskellJava

Files and external data

Build understanding

Turn bytes outside the program into usable values, then write results with explicit failure behavior.

Concept planned

Reading lines and processing text

How do you count, filter, and summarize a text file? Build a small word-count tool and handle the last line and the empty file.

TypeScriptGoRustCHaskellJava
Concept planned

Files, parsing, and serialization

How does external text become a checked value? Separate decoding, parsing, validation, and representing failures.

TypeScriptGoRustCHaskellJava
Concept planned

Paths, directories, and portability

Will this path work on another machine? Join paths safely, walk a directory, and handle files that disappear mid-walk.

TypeScriptGoRustCHaskellJava
Concept planned

Safe file updates and interrupted writes

What remains if a write fails halfway through? Compare overwriting, temporary files, replacement, and the limits of atomicity and durability.

TypeScriptGoRustCHaskellJava
Concept planned

Serialization and foreign interfaces

What survives when a value crosses a file, wire, or language boundary? Compare encodings, layouts, and ownership contracts.

TypeScriptGoRustCHaskellJava

HTTP clients and small servers

Build understanding

Follow a request through parsing, application behavior, and a response.

Concept planned

HTTP requests, responses, and timeouts

What does a client actually send and receive? Handle status codes, body decoding, cancellation, and owned resources.

TypeScriptGoRustCHaskellJava
Concept planned

Handlers, validation, and error responses

Where does an untrusted request become a domain input? Separate transport handling from behavior and map failures deliberately.

TypeScriptGoRustCHaskellJava
Concept planned

Testing a network boundary

Which behavior needs a real connection, and which can be checked locally? Test protocol interactions without making every test depend on a remote service.

TypeScriptGoRustCHaskellJava

Persistence and transactions

Build understanding

Make the boundary between an in-memory result and stored state explicit.

Concept planned

Storage operations and repository boundaries

What does the rest of the program need from storage? Express operations and errors without hiding important consistency assumptions.

TypeScriptGoRustCHaskellJava
Concept planned

Transactions, commit, and rollback

Which changes must succeed together? Trace success and failure while separating database transactions from in-memory mutation.

TypeScriptGoRustCHaskellJava
Concept planned

Testing persistence and restart behavior

What survives after the process exits? Check migrations, constraints, failed writes, and reload behavior with a representative storage environment.

TypeScriptGoRustCHaskellJava

A bounded concurrent worker

Go underneath

Combine task lifetime, errors, resource ownership, and testing in one small application.

Concept planned

Bounded work and backpressure

What happens when jobs arrive faster than they finish? Limit active work and queue growth, and define how callers observe overload.

TypeScriptGoRustCHaskellJava
Concept planned

Cancellation and graceful shutdown

What happens to queued and active work when the program stops? Trace cancellation, draining, cleanup, and explicit completion guarantees.

TypeScriptGoRustCHaskellJava