The whole catalog
Every topic, in one place.
Most are still being written.
482 topics across 7 modules, in a suggested order. Search them, or narrow the list to the lessons you can read today.
Still being written 179 of 482 lessons are drafted and open to read while they're reviewed. Planned topics show where the catalog is going.
Reading a program
Start hereStart with the vocabulary: what code says, what it does, and how to follow a small example.
Values, names, and variables
Start hereFollow declarations and assignments closely before treating a variable as a box in memory.
Bits, numbers, and text
Start hereLook beneath familiar values without assuming every language stores them in the same way.
Decisions and repetition
Build understandingUse the values you understand to choose a path, repeat work, and reason about termination.
Functions, calls, and closures
Build understandingFollow a call from argument evaluation to return, then explore the state a function can carry.
Collections and structured values
Build understandingBuild larger values and learn what indexing, resizing, copying, and iteration really involve.
References and pointers
Build understandingName the thing a value refers to, then follow how each language lets you reach and change it.
Types and abstraction
Build understandingDescribe the values an operation accepts and see how each language expresses a reusable contract.
Functional evaluation and effects
Build understandingUse Haskell to question familiar assumptions about mutation, function arguments, and the timing of work.
Modules, names, and visibility
Build understandingOrganize definitions and make the boundary between public and private names explicit.
Errors and failure
Build understandingFollow what happens when a normal result is unavailable, and keep failure behavior explicit.
Lifetimes, ownership, and cleanup
Go underneathNow ask who can use a value, how long it remains valid, and who is responsible for releasing resources.
The machine underneath
Start hereMeet the hardware your program eventually runs on, without needing to build it.
Booleans and logic gates
Build AND, OR, NOT, and XOR truth tables, then connect boolean expressions to the idea of a logic gate.
TypeScriptGoRustCHaskellJavaInstructions, registers, and the CPU
What does a processor actually do? Follow fetch, decode, and execute, and the small set of operations everything reduces to.
TypeScriptGoRustCHaskellJavaRegisters, caches, and main memory
Why is some memory faster than other memory? Compare the levels between a register and main memory, and what a cache miss costs.
TypeScriptGoRustCHaskellJavaReading a little assembly
What did the compiler turn this function into? Read a short listing and match it back to the source, without memorizing an instruction set.
CGoRustBuilding and loading a program
Build understandingFollow dependencies, build inputs, and initialization before examining the generated program.
Build commands and dependency resolution
What inputs does the toolchain need? Follow tsc, go, Cargo, a C compiler and linker, Cabal, and javac.
TypeScriptGoRustCHaskellJavaImports, dependencies, and initialization
What happens when a dependency is loaded? Compare dependency graphs, cycles, and initialization rules.
TypeScriptGoRustCHaskellJavaVersions, lockfiles, and reproducible builds
Why does the same project build differently on another machine? Follow version ranges, lockfiles, and pinned toolchains.
TypeScriptGoRustCHaskellJavaYour program and the operating system
Build understandingFollow what a running program asks the operating system for: memory, files, input, output, and an exit.
Processes and address spaces
What is a running program to the operating system? Follow a process, its own view of memory, and what separates it from others.
TypeScriptGoRustCHaskellJavaArguments, environment, and process startup
What exists before main runs? Follow how arguments and environment variables reach a program, and what each runtime sets up first.
TypeScriptGoRustCHaskellJavaSystem calls and the kernel boundary
How does a program ask the operating system to do something? Trace a library call down to a system call.
TypeScriptGoRustCHaskellJavaFile descriptors and handles
What does an open file look like from inside a program? Follow descriptors, standard streams, and closing what you open.
TypeScriptGoRustCHaskellJavaVirtual memory and the allocator
Where does heap memory come from? Follow pages from the operating system through the allocator to the value you created.
TypeScriptGoRustCHaskellJavaSignals, exit status, and termination
How does a program end, and who finds out? Follow exit codes, signals such as SIGINT and SIGTERM, and cleanup that may not run.
TypeScriptGoRustCHaskellJavaMemory, references, and layout
Go underneathConnect language behavior to storage while keeping conceptual diagrams distinct from measured layouts.
Addresses and storage
What is a memory address, and when does a language let you work with one? Compare physical storage with a diagram of bindings.
TypeScriptGoRustCHaskellJavaSize, alignment, and padding
Why can a record occupy more bytes than its fields add up to? Inspect a concrete layout and name its assumptions.
CGoRustJavaEndianness and byte order
How is a multi-byte number arranged? Compare memory inspection with a portable serialized representation.
TypeScriptGoRustCHaskellJavaEscape analysis and allocation
Does returning a value or creating an object imply a heap allocation? Explore what an implementation can prove and optimize.
GoJavaTypeScriptLocality, indirection, and caches
Why can two ways of storing the same data have different costs? Follow contiguous access and pointer chasing.
TypeScriptGoRustCHaskellJavaHaskell thunks, sharing, and retained values
What can a delayed computation keep alive? Inspect a named implementation instead of assuming a mutable variable slot.
HaskellEvaluation, retention, and reclamation
Go underneathDistinguish when work happens, why data stays reachable, and how storage becomes eligible for reclamation.
Leaks in garbage-collected programs
How can memory grow when a collector is running? Find caches, listeners, and closures that keep values reachable.
TypeScriptGoHaskellJavaFolds, strictness, and space leaks
When can a retained expression grow instead of being evaluated? Compare folds, strict accumulation, and retained data.
HaskellJVM heap generations and collectors
Why do most objects die young, and what does a collector do about it? Compare generations, pauses, and collector choices.
JavaTime, concurrency, and shared state
Go underneathReason about more than one activity after calls, mutation, lifetime, and failure are familiar.
Concurrency and parallelism
Can tasks overlap without running simultaneously? Separate task structure, scheduling, and multiple execution resources.
TypeScriptGoRustCHaskellJavaThreads, tasks, and goroutines
Who schedules each unit of work? Compare runtime tasks with operating-system threads.
TypeScriptGoHaskellRustJavaPromises, futures, and async/await
How do asynchronous results represent completion and suspension? Compare promises, futures, and languages with async/await; Java has futures without built-in await syntax.
TypeScriptRustJavaThe event loop and queued work
When does a callback or promise continuation run? Trace queued work and compare runtime-specific scheduling rules.
TypeScriptData races and synchronization
Which interleaving changes the result? Compare locks, atomics, and the visibility guarantees of a memory model.
TypeScriptGoRustCHaskellJavaChannels and message passing
Who owns data as it travels between tasks? Compare queues, channels, shared memory, and bounded capacity.
GoHaskellRustJavaCancellation, deadlocks, and task lifetime
What happens when work must stop or two tasks wait on each other? Follow cancellation, cleanup, and waiting dependencies.
TypeScriptGoRustCHaskellJavaWorkers and parallelism in JavaScript
How does single-threaded JavaScript use several cores? Follow workers, message copying, and shared memory.
TypeScriptGo select, sync, and context
How do goroutines wait, coordinate, and stop? Follow select, WaitGroup, Mutex, and cancellation through context.
GoRust Send, Sync, and thread boundaries
Which values can cross threads, and which references can be shared? Connect type guarantees to synchronization.
RustC threads, mutexes, and atomics
What does C give you for concurrency, and what is left to you? Follow pthreads or C11 threads, mutexes, and atomic operations.
CHaskell threads, MVar, and STM
How do threads coordinate through a shared runtime? Compare synchronized cells with composable memory transactions.
HaskellJava threads, executors, and virtual threads
How does Java run work concurrently? Compare platform threads, executor pools, and virtual threads.
JavaCompilers, virtual machines, and runtimes
Go underneathBring the pieces together: how language rules become executable work, and what the runtime supplies.
Parsing, syntax trees, and intermediate forms
How does source text become something a tool can analyze? Follow tokens, an AST, and an intermediate representation.
TypeScriptGoRustCHaskellJavaHow a type checker works
What does the compiler do with your types? Follow checking and inference over a small syntax tree.
TypeScriptGoRustCHaskellJavaCompilation and interpretation
What is translated, and what is executed? Compare strategies without treating compiled and interpreted as exclusive language categories.
TypeScriptGoRustCHaskellJavaLinking, loading, and modules
How are separately built pieces connected? Compare symbols, libraries, imports, and loading a program.
TypeScriptGoRustCHaskellJavaOptimization, AOT, and JIT
Why might the machine do less work than the source suggests? Explore ahead-of-time compilation, hot paths, and preserving observable behavior.
TypeScriptGoRustCHaskellJavaTypeScript checking and JavaScript execution
Which parts of TypeScript survive into JavaScript? Follow erased types, emitted code, and the separate JavaScript runtime.
TypeScriptGo runtime services and scheduling
What remains at runtime in a compiled program? Follow goroutine scheduling, stack growth, and garbage collection.
GoRust monomorphization and trait dispatch
How does a generic operation become executable code? Compare concrete instantiations with dynamic trait dispatch.
RustC preprocessing, translation units, and ABI
How does a declaration become a linked call? Separate preprocessing, compilation, symbol resolution, and platform calling conventions.
CGHC, thunks, and the runtime system
How does GHC turn Haskell into executable code? Explore delayed computations, garbage collection, and runtime services without confusing them with language guarantees.
HaskellBytecode and the JVM
What sits between Java source and machine execution? Explore class files, loading, verification, and runtime services.
JavaQuantities and representation
Start hereChoose useful quantities, keep units straight, and understand how values are represented.
Change, uncertainty, and evidence
Build understandingUse growth, probability, and statistics to interpret behavior and measurements.
Math in engineering decisions
Go underneathApply simple models to queues, reliability, retries, caches, capacity, and subnet plans.
Math behind AI
Build understandingUnderstand the math inside embeddings, training, and model output.
Networking foundations
Start hereFollow data across local links, network boundaries, and service endpoints.
What a network does
Relate hosts, interfaces, links, and paths to the services people use.
Layers, encapsulation, and decapsulation
Trace how link, network, transport, and application data wrap around one request.
Frames, MAC addresses, and local delivery
Explain local-link delivery and where ARP or neighbor discovery fits.
IPv6 address structure and neighbor discovery
Read prefixes, link-local addresses, and compressed forms without treating IPv6 as longer IPv4.
ICMP and ping
See how hosts report unreachable destinations and expired packets, and what a ping reply does and doesn't prove.
Ports, sockets, and endpoint identity
Connect addresses and transport ports to the local endpoints programs actually open.
TypeScriptGoByte order and wire formats
Read and write protocol headers from raw bytes, with endianness and length-prefixed framing made explicit.
TypeScriptGoTCP and UDP
Compare a reliable ordered byte stream with datagrams, and see what each contract leaves to the application.
TypeScriptGoDNS lookup path
Follow a name through resolver caches, records, and authoritative answers; recognize common failure points.
TypeScriptGoDHCP and address configuration
Understand how a host receives an address, route, and resolver configuration and renews its lease.
Common network services
Learn what HTTP(S), SSH, NTP, SMTP, and common file and name services do beyond their port numbers.
Physical media and wireless basics
Compare copper, fiber, transceivers, Wi-Fi bands, channels, and interference in context.
Network design and protocols
Build understandingUnderstand how networks forward, filter, secure, and deliver application traffic.
Routing and forwarding
Use a route table to explain next-hop choice and longest-prefix matching.
TypeScriptGoSwitching, VLANs, and broadcast domains
Show how switches forward frames and how VLANs separate layer-two traffic.
NAT and port forwarding
Trace address translation, connection state, and inbound reachability without treating NAT as a firewall.
Firewalls, ACLs, and packet filtering
Reason about rule order, direction, state, and default action in a packet policy.
Flow control, congestion, and head-of-line blocking
See why throughput ramps up gradually and how one lost packet can stall everything behind it.
TypeScriptGoHTTP request and response path
Inspect methods, status, headers, bodies, connection reuse, and intermediaries in a real local exchange.
TypeScriptGoTLS and certificate validation
Understand the handshake, peer identity, trust chains, and what common validation failures mean.
mTLS and service identity
Have both sides of a connection present certificates and see how services authenticate each other.
TypeScriptGoHTTP/2, HTTP/3, and QUIC
Compare multiplexing, header compression, and QUIC over UDP, and see what each version changes for an application.
TypeScriptGoCORS and browser network rules
Understand same-origin policy, preflight requests, and cross-site cookies, and read the errors browsers report.
TypeScriptGoReal-time transports
Compare polling, long polling, server-sent events, and WebSockets by connection cost and behavior through proxies.
TypeScriptGoProxies, reverse proxies, and load balancers
Locate connection termination, trusted forwarding metadata, and backend selection.
TypeScriptGoVPNs and network segmentation
Compare tunnels, remote access, site links, and the boundaries segmentation does and does not create.
Cloud and virtual networks
Relate subnets, routes, gateways, overlays, and provider-specific security controls.
Container and Kubernetes networking
Trace traffic through bridge networks, port mappings, service IPs, and in-cluster DNS.
Wireless network behavior
Diagnose association, authentication, roaming, channel overlap, and environmental interference.
Operations and troubleshooting
Go underneathGather network evidence, narrow likely causes, and verify that a repair worked.
A repeatable network troubleshooting method
Scope the impact, collect observations, test one hypothesis at a time, and confirm recovery.
Connection refused, reset, and timed out
Read each connection error as evidence pointing to a different layer or component.
TypeScriptGoRead route, interface, and neighbor tables
Use host tools to inspect local configuration and understand what their output cannot prove.
DNS, DHCP, and address-conflict diagnosis
Distinguish name resolution, lease, route, and duplicate-address failures.
Latency, bandwidth, throughput, loss, and jitter
Choose the measurement that answers the question, keep units visible, and account for direction.
Traceroute, MTU, and path diagnosis
Interpret hops and packet-size tests while allowing for filtered or hidden responses.
Inspecting HTTP from the client
Use curl and the browser network panel to see requests, timing, redirects, and TLS details before reaching for packet capture.
Packet capture and protocol inspection
Reconstruct conversations, use capture filters, and recognize what encryption hides.
Network monitoring and baselines
Relate counters, flow data, logs, and SNMP concepts to useful time and workload comparisons.
Network documentation and change control
Maintain address plans, diagrams, port records, ownership, and a reversible verification plan.
Security mindset and core vocabulary
Start hereBuild a practical vocabulary for reasoning about software risk and controls.
Security goals: confidentiality, integrity, availability
Which property a control protects, and what it cannot protect.
Assets, actors, trust boundaries, and attack surface
Start from what matters, who can influence it, and where data crosses ownership.
Threat, vulnerability, exploit, impact, and risk
Distinguish a weakness from its possible use and consequence.
Least privilege and secure defaults
Grant only the access needed; make the safe path the default.
Defense in depth and security boundaries
Layer controls without treating any single layer as a substitute for the others.
Fail open or fail closed
Choose behavior when a control or dependency is unavailable, based on the protected action.
Security by design versus security by obscurity
Keep useful design secrecy distinct from controls that must hold even when implementation is known.
Threat modeling and secure design
Start hereStart with assets and boundaries; use threats to decide which controls matter.
Threat modeling a small feature
Identify assets, actors, boundaries, abuse cases, and the controls that change the risk.
Data-flow diagrams and trust boundaries
Draw only the flows needed to make security assumptions visible and reviewable.
STRIDE and alternative threat prompts
Use a structured prompt as a completeness aid, not as a scoring oracle.
Abuse cases and business logic
Ask how a valid feature can be misused, combined, repeated, or accessed out of sequence.
Security requirements and acceptance criteria
Turn risks into explicit, testable requirements before implementation.
Secure architecture decisions
Record assumptions, rejected options, residual risk, and revisit triggers.
Attack surface reduction
Remove unused routes, permissions, dependencies, endpoints, and data.
Third-party and integration trust
Define what each provider may send, read, change, and trigger.
Privacy and security design review
Include data minimization, user expectations, and misuse impact alongside technical controls.
Lightweight threat-model review in pull requests
Revisit the model when a change adds a new boundary, privilege, data type, or external dependency.
Web and API trust boundaries
Start hereIdentify the trust boundaries where web requests and data enter the system.
The browser is an untrusted client
UI state and client-side checks can improve experience but cannot authorize a server action.
TypeScriptGoTrace untrusted data end to end
Follow a value from URL, form, header, cookie, or webhook to every sink that uses it.
TypeScriptGoParse, validate, normalize, and encode are different
Validate data for its domain; encode for the output context; avoid treating these steps as interchangeable.
TypeScriptGoAllowlist validation and bounded input
Define accepted shapes, sizes, ranges, and formats at each boundary.
TypeScriptGoCanonicalization and double-decoding bugs
Agree on one representation before validation and use; reject ambiguous encodings.
TypeScriptGoHTTP security-relevant behavior
Understand methods, status codes, headers, cookies, origins, caching, redirects, and content types as part of the security contract.
TypeScriptGoClient-side versus server-side validation
Duplicate user-friendly checks when useful, but enforce the actual security rule at the trusted boundary.
TypeScriptGoError messages and information leakage
Return useful errors without disclosing secrets, stack traces, internal topology, or account existence unnecessarily.
TypeScriptGoOutput handling and injection
Start hereKeep untrusted data from becoming executable code or query structure.
Reflected, stored, and DOM-based XSS
Where attacker-controlled content enters and how it reaches an executable browser context.
TypeScriptGoContextual output encoding
HTML text, attributes, URLs, JavaScript, CSS, and rich text require different safe handling.
TypeScriptGoSafe DOM APIs and dangerous HTML escape hatches
Prefer text and structured APIs; isolate and sanitize rich HTML when it is genuinely required.
TypeScriptFramework escaping and its limits
Know what a framework escapes automatically and identify raw HTML, unsafe URL, and template escape hatches.
TypeScriptNoSQL and search-query injection
Treat query operators and search syntax as untrusted structure, not harmless strings.
TypeScriptGoOS command injection
Avoid shell construction; call a process with argument arrays and constrained inputs when process execution is necessary.
TypeScriptGoTemplate, expression, and code injection
Separate data from executable templates and avoid evaluating untrusted expressions.
TypeScriptGoLDAP, XPath, and other interpreter injection
Recognize that every interpreter needs its own parameterization or safe construction strategy.
TypeScriptGoHeader, CRLF, and log injection
Keep untrusted values from creating response headers, splitting messages, or forging log records.
TypeScriptGoDeserialization and object construction
Avoid unsafe polymorphic deserialization; constrain types and validate parsed data.
TypeScriptGoPrototype pollution
Prevent attacker-controlled object keys from changing inherited properties, configuration, or later authorization checks in JavaScript.
TypeScriptReDoS and parser complexity
Bound input and algorithmic work so valid-looking inputs cannot monopolize CPU or memory.
TypeScriptGoAuthentication, credentials, and sessions
Build understandingProtect account access, credentials, and the sessions that represent a user.
Password storage and verification
Use a maintained password-hashing function with its intended salt and work parameters; never encrypt or fast-hash passwords as a substitute.
TypeScriptGoLogin abuse and credential stuffing
Combine throttling, abuse signals, MFA, and safe recovery without creating easy denial-of-service lockouts.
TypeScriptGoMulti-factor authentication and passkeys
Understand factor independence, phishing resistance, recovery, and the risk of weak fallback paths.
TypeScriptGoAccount recovery and password reset
Use short-lived, single-use reset capabilities; avoid account enumeration and insecure reset questions.
TypeScriptGoSession identifiers and entropy
Generate unpredictable session identifiers with cryptographic randomness.
TypeScriptGoCSRF and same-site request defenses
Protect cookie-authenticated state changes with an explicit request-origin strategy.
TypeScriptGoOAuth 2.0 and OpenID Connect roles
Distinguish authorization from authentication and keep client, resource server, and identity provider responsibilities clear.
TypeScriptGoAPI keys, bearer tokens, and signed tokens
Decide who can see a credential, its scope and lifetime, and how it is revoked; never treat a decoded token as trusted.
TypeScriptGoService identities and workload credentials
Prefer short-lived, narrowly scoped machine identity over copied long-lived secrets.
TypeScriptGoSensitive-action confirmation and reauthentication
Add stronger proof for account, payment, or permission changes where risk justifies it.
TypeScriptGoData protection and cryptography
Build understandingChoose sound ways to protect sensitive data, secrets, and cryptographic keys.
Data classification and minimization
Collect, retain, expose, and log only what the feature needs.
TLS, certificate validation, and trust stores
Verify peers and configure the transport; encryption without correct certificate validation is incomplete.
TypeScriptGoEncryption at rest and field-level protection
Choose what is protected from which threat and account for application access to decryption keys.
TypeScriptGoHashing, encryption, encoding, and signing
Explain the distinct security properties each operation provides.
Cryptographically secure randomness
Use platform cryptographic APIs for tokens, reset links, and unpredictable secrets—not general-purpose PRNGs.
TypeScriptGoKey lifecycle and key management
Generate, store, grant access to, rotate, back up, and retire keys deliberately.
TypeScriptGoTiming attacks and constant-time comparison
Avoid leaking secrets through data-dependent comparison or other observable timing where constant-time primitives are appropriate.
TypeScriptGoMessage authentication and digital signatures
Verify integrity and sender authenticity without confusing signatures with encryption.
TypeScriptGoNonces, IVs, and authenticated encryption
Use library-managed, unique parameters and authenticated modes; never invent a crypto protocol.
TypeScriptGoToken and URL leakage
Keep credentials out of URLs, referrers, analytics, error reports, and logs.
TypeScriptGoBackups, deletion, and cryptographic erasure
Align copies, retention, access, and key destruction with the data lifecycle.
API, workflow, and abuse resistance
Build understandingProtect APIs and business workflows from unauthorized use and resource abuse.
Request size, pagination, and resource limits
Bound payloads, nested structures, result sizes, and expensive operations.
TypeScriptGoRate limiting and abuse controls
Apply limits to the right identity and operation while considering distributed clients and shared infrastructure.
TypeScriptGoIdempotency and replay resistance
Make retries safe and protect sensitive one-time actions from replay.
TypeScriptGoWorkflow and business-logic abuse
Validate allowed state transitions on the server, not just individual fields.
TypeScriptGoPrice, quota, and entitlement tampering
Derive sensitive values and eligibility from trusted state.
TypeScriptGoWebhook signature verification
Verify the exact raw body and timestamp using the provider's documented scheme, then handle duplicates safely.
TypeScriptGoSSRF and server-side fetches
Restrict destinations and redirects, validate resolved addresses including cloud metadata ranges, and isolate outbound network access.
TypeScriptGoClickjacking and framing controls
Decide which trusted origins may embed the application and set frame protections accordingly.
TypeScriptGoGraphQL and query-shape abuse
Bound depth, complexity, batching, and object-level authorization.
TypeScriptGoWebSocket and long-lived connection security
Authenticate connection setup, authorize each relevant message/action, and handle expiry and origin checks.
TypeScriptGoRedirects, callbacks, and deep links
Validate destinations against explicit rules; prevent open redirect and unsafe callback behavior.
TypeScriptGoHTTP request smuggling and parser disagreement
Investigate when a proxy and origin parse message boundaries differently, and verify consistent handling across the request path.
TypeScriptGoWeb cache poisoning and cache deception
Check whether cache keys and origin behavior can store attacker-influenced content or expose a private response to other users.
TypeScriptGoLLM and AI application security
Build understandingSecure AI features by treating model inputs, outputs, retrieved content, and tool proposals as untrusted.
Threat-model an LLM feature
Map user prompts, system instructions, retrieved content, model providers, tools, and sinks as separate trust boundaries.
Direct and indirect prompt injection
Understand that instructions in user input or retrieved content can manipulate model behavior; prompt wording alone is not a security boundary.
TypeScriptUntrusted model output and dangerous sinks
Validate and authorize structured outputs before they reach HTML, SQL, shell, URLs, code execution, or state-changing tools.
TypeScriptGoData exfiltration through rendered output
Prevent rendered model-authored links or media from making unintended external requests that disclose sensitive context.
TypeScriptTool calls as untrusted requests
Treat every proposed tool call as data; validate its schema, caller, target, scope, and current user permissions in ordinary application code.
TypeScriptGoAgent permissions and excessive agency
Limit available tools, operation scope, autonomy, and downstream identities to what the task actually needs.
TypeScriptGoMCP and tool server security
Assess server identity, untrusted tool descriptions and results, authorization scope, and credential exposure across the client-server boundary.
TypeScriptGoHuman approval for high-impact actions
Require explicit, contextual confirmation before irreversible, externally visible, or privileged actions.
TypeScriptGoPoisoned and hostile retrieved content
Treat documents, web pages, email, and tool results as untrusted context that can contain indirect instructions.
TypeScriptGoVector stores, embeddings, and sensitive data
Protect access to source documents, derived embeddings, metadata, and retrieval results; consider leakage and cross-tenant exposure.
TypeScriptGoSystem prompts are not secrets
Keep credentials and access decisions out of prompts; assume instructions can be exposed and enforce controls elsewhere.
Conversation state and agent memory isolation
Scope memory to a user and task, define retention, and prevent one session's content from influencing another's.
TypeScriptAI provider data handling and privacy
Understand what prompts, files, telemetry, and outputs leave the system and the provider's retention and training settings.
Model, dataset, and plugin supply-chain risk
Verify provenance and permissions for models, fine-tuning data, connectors, plugins, and other components.
Unbounded token use, loops, and cost abuse
Set budgets, deadlines, output limits, and stopping rules for model calls and agent loops.
TypeScriptGoLLM security evaluations and regression tests
Test security properties across prompt variations and workflow states; retain reproducible cases while recognizing model variability.
TypeScriptGoRed-team an AI feature safely
Probe a local or authorized test system for data exposure, tool misuse, policy bypass, and resource abuse.
TypeScriptGoAI security incident response
Preserve relevant prompts, tool-call decisions, retrieved sources, model/provider versions, and outcomes without logging unnecessary sensitive content.
Security testing and code review
Build understandingTurn security properties into reviewable, repeatable tests.
Turn a threat into a test
Express the expected security property as a testable invariant.
TypeScriptGoUnit, integration, and end-to-end security tests
Place each check where it can exercise the real boundary without overclaiming coverage.
TypeScriptGoRegression tests for vulnerabilities
Preserve a minimal failing input and prove the fixed behavior at the relevant layer.
TypeScriptGoStatic analysis and lint rules
Use tools to find classes of mistakes; triage findings and understand blind spots.
Dynamic and interactive application testing
Exercise a running test deployment safely and interpret scanner results rather than treating them as proof.
Fuzzing parsers and validators
Generate unexpected inputs to find crashes, hangs, and invariant failures.
TypeScriptGoDependency and container scanning
Track components and investigate findings in the context of actual usage and exposure.
Secure code review checklist
Follow sources, trust boundaries, sinks, authorization decisions, secrets, and failure paths.
False positives, false negatives, and test coverage
Understand why scanners and passing tests cannot establish that an application is secure.
Security test environments and safe fixtures
Use synthetic data, scoped credentials, and isolated targets; do not test real systems without authorization.
Files, uploads, and content processing
Build understandingHandle uploaded files and complex content as hostile input.
Secure file upload pipeline
Enforce size, type, content, storage, and authorization checks as separate controls.
TypeScriptGoMIME type and extension validation
Treat client-provided filenames and content types as claims, not evidence.
TypeScriptGoSafe file names and storage locations
Generate server-side names and keep untrusted content out of executable or public paths.
TypeScriptGoMalware scanning and quarantine workflow
Define pending, scanned, rejected, and available states without trusting a scan as perfect.
TypeScriptGoArchive extraction and path traversal
Prevent entries from escaping the intended destination and bound expansion.
TypeScriptGoImage, document, and media parser risks
Isolate complex parsers and apply resource limits and updates.
TypeScriptGoContent-Disposition and download safety
Serve untrusted files with deliberate content types and download behavior.
TypeScriptGoImport, export, and CSV formula injection
Treat exported values as active content when opened by spreadsheet software.
TypeScriptGoXML external entities and unsafe XML features
Disable unnecessary entity resolution and bound parsing.
TypeScriptGoRich text sanitization and safe rendering
Define allowed markup, sanitize with maintained tooling, and preserve context-safe rendering.
TypeScriptGoDependencies, build systems, and software supply chain
Build understandingKnow what enters builds and reduce risk in dependencies and delivery pipelines.
Dependency inventory and transitive risk
Know what is in the build, where it came from, and which paths execute it.
Vulnerability advisories and triage
Consider affected versions, reachability, exposure, available fixes, and compensating controls.
Lockfiles, registries, and package confusion
Pin expected sources and prevent untrusted packages or namespaces from entering a build.
Dependency updates and patch policy
Automate discovery while retaining review, testing, and a way to respond quickly.
Secrets committed to source control
Detect exposed credentials, revoke and rotate them immediately, and remove them from future history without mistaking history rewriting for revocation.
Typosquatting and malicious packages
Verify package identity and provenance before adding dependencies.
Build isolation and reproducibility
Reduce ambient access and make artifacts traceable to reviewed source and build inputs.
SBOMs and component provenance
Produce useful component and build-origin records; distinguish inventory from a security guarantee.
Artifact signing and verification
Establish who produced an artifact and verify integrity at consumption.
CI/CD secret exposure
Use scoped, short-lived credentials and keep untrusted pull requests away from privileged secrets.
Pipeline permissions and workflow injection
Treat workflow files, actions, build scripts, and user-controlled parameters as executable attack surface.
Third-party actions, plugins, and build extensions
Pin and review external code that runs with pipeline privileges.
Coordinated vulnerability disclosure and patch response
Provide a safe reporting path, assess impact, ship fixes, and communicate clearly.
Browser, frontend, and privacy security
Build understandingUnderstand browser protections and preserve user privacy in client experiences.
Same-origin policy and origin model
Understand scheme, host, and port as browser isolation boundaries.
CORS preflight and credentialed requests
Configure explicit origin and credential behavior without using wildcard shortcuts for private data.
postMessage and cross-window messaging
Validate sender origin, source window, and message shape before trusting data from popups, frames, or embedded widgets.
TypeScriptBrowser storage trade-offs
Compare cookies, local storage, session storage, and in-memory state by threat and use case.
TypeScriptContent Security Policy deployment
Start with report-only observation, remove unsafe allowances, and test real application flows.
Subresource Integrity and third-party scripts
Reduce the risk of changed remote assets and minimize the scripts trusted with page access.
Referrer, permissions, and security headers
Set browser policy deliberately and verify actual deployed responses.
DOM clobbering and unsafe URL schemes
Avoid named-property collisions and validate navigable or executable URLs.
TypeScriptCross-site leaks and side channels
Recognize that observable response differences can expose sensitive state across origins.
TypeScriptPrivacy-preserving telemetry
Avoid collecting secrets and sensitive personal data in analytics, logs, or replay tools.
TypeScriptConsent, retention, deletion, and export
Implement user-facing data promises as backend behavior, not only interface copy.
TypeScriptGoRuntime, infrastructure, and cloud security
Go underneathReduce the privileges and exposure of the systems that run the application.
Security configuration and hardened defaults
Make secure configuration explicit, reviewable, environment-specific, and checked at startup.
Least privilege for application processes
Limit database, filesystem, network, cloud, and operating-system permissions.
Memory safety and unsafe code
Understand where unsafe and native boundaries—from Rust unsafe and Go cgo to Node extensions—bypass language safeguards and require explicit review.
TypeScriptGoEnvironment variables and secret stores
Know exposure paths and choose a managed secret mechanism appropriate to deployment.
Containers and image hygiene
Run as non-root where possible, minimize images, pin sources, and scan the resulting artifact.
Network segmentation and egress control
Limit which components can reach each other and where an application can connect outbound.
Cloud IAM and workload identity
Grant narrowly scoped access through identities rather than embedded static keys.
Database account and network security
Separate application roles, restrict reachable services, and avoid administrative credentials at runtime.
Production and non-production separation
Keep real data and production secrets out of developer machines, previews, and test fixtures.
Backups, restore, and ransomware resilience
Protect backup access and prove recovery rather than assuming that a backup is usable.
Patch management and exposed services
Inventory reachable components, prioritize fixes, and retire unused services.
Infrastructure as code review
Treat permissions, network rules, storage exposure, and deployment configuration as code requiring review and tests.
Logging, detection, and incident response
Go underneathCreate useful signals, respond to security incidents, and learn from them.
Security event logging
Record enough evidence to investigate while excluding credentials, tokens, and unnecessary personal data.
Log integrity, access, and retention
Protect logs from tampering, limit readers, and keep them only as long as justified.
Alert quality and operational ownership
Give each alert a clear signal, severity, responder, and first action.
Vulnerability triage and severity
Combine technical severity with reachability, exploitability, affected assets, and business impact.
Incident response roles and first steps
Preserve evidence, contain impact, communicate, and restore service through a prepared process.
Credential and key compromise
Revoke, rotate, identify use, invalidate sessions, and check downstream copies.
Security incident retrospectives
Identify control and process gaps without reducing the review to blame or one patch.
Vulnerability disclosure handling
Receive reports safely, acknowledge them, reproduce in authorized environments, and coordinate a fix.
Tabletop exercises and response readiness
Rehearse realistic scenarios and record what people, access, or telemetry were missing.
Governance, assurance, and certification crosswalk
Go underneathConnect engineering practices to versioned verification standards and exam objectives.
Security policies versus implemented controls
A written policy is not evidence that a control works in code or operations.
Secure development lifecycle
Place requirements, review, testing, release, and vulnerability response across the software lifecycle.
OWASP ASVS as a verification catalog
Use versioned requirements to plan and check web application controls; scope the verification level to the system.
OWASP Top 10 and common risk taxonomies
Use risk lists as awareness and prioritization aids, not complete curricula or pass/fail standards.
NIST SSDF practices in a small team
Translate outcome-oriented secure development practices into proportionate team habits.
Evidence, audit trails, and control ownership
Connect a control to a person, system evidence, review cadence, and remediation process.
Risk acceptance and exceptions
Record who accepts residual risk, for how long, with what compensating controls and review date.
CompTIA Security+ crosswalk
Optional exam-oriented index for applicable security foundations, threats, architecture, operations, and governance topics.
CompTIA CySA+ crosswalk
Optional analyst-oriented index for monitoring, vulnerability management, incident response, and threat analysis.
Exam objective versioning
State the exam code and objectives version beside every mapping; never imply the catalog alone prepares someone to pass.
Jurisdiction- and standard-specific compliance
Link out to separately maintained, dated material rather than presenting one universal compliance checklist.
Tools and everyday workflow
Start hereSet up the small habits that make every later investigation faster.
Reading documentation and specifications
Where is the real answer? Compare a language specification, standard-library docs, and a blog post, and know which one makes a promise.
TypeScriptGoRustCHaskellJavaREPLs and scratch experiments
How do you test an idea in thirty seconds? Use a REPL or a scratch file to check one behavior before relying on it.
TypeScriptGoRustCHaskellJavaFormatters, linters, and warnings
What can a tool catch before you run anything? Turn on warnings, read lint findings, and let a formatter settle style.
TypeScriptGoRustCHaskellJavaReading unfamiliar code
Where do you start in code you did not write? Find the entry point, follow one path, and write down what you learn.
TypeScriptGoRustCHaskellJavaDebugging with evidence
Build understandingMove from a symptom to a small explanation you can check.
Compiler diagnostics and stack traces
What is the tool telling you, and where did the failure originate? Separate a diagnostic location from the cause.
TypeScriptGoRustCHaskellJavaPrint statements and logging as evidence
What should you print, and where? Turn a print statement into a deliberate observation that can confirm or reject a guess.
TypeScriptGoRustCHaskellJavaBreakpoints, frames, and inspected values
Which values exist at this point? Inspect the call stack and scope without assuming an optimized program preserves every source-level detail.
TypeScriptGoRustCHaskellJavaSanitizers, race detectors, and checked builds
Can a tool catch the bug while it happens? Use AddressSanitizer, go test -race, and Miri to turn silent errors into reports.
CGoRustTests, properties, and repeatability
Build understandingUse examples and generated cases to challenge a claim about behavior.
Test structure and isolated state
How do you make an example repeatable? Compare assertions, fresh fixtures, and language-specific test runners.
TypeScriptGoRustCHaskellJavaTable-driven and parameterized tests
How do you check many cases without copying the test? List inputs and expected results, then report which row failed.
TypeScriptGoRustCHaskellJavaTesting failure paths
Does the code fail the way you promised? Check returned errors, thrown exceptions, and cleanup after a failure.
TypeScriptGoRustCHaskellJavaProperties and generated cases
What should hold over many inputs? Write a property, find a counterexample, and inspect which assumption failed.
TypeScriptGoRustCHaskellJavaClocks, randomness, and test seams
How do you test code that depends on time or external state? Make those dependencies explicit and control them in a test.
TypeScriptGoRustCHaskellJavaContracts, invariants, and safe changes
Build understandingChoose useful boundaries and improve the code while keeping its promises.
Naming and readable code
Will the next reader understand this? Choose names that state intent, and shape code so the common path is easy to follow.
TypeScriptGoRustCHaskellJavaDomain types and smart constructors
Which values should be impossible to construct? Validate at a boundary and use a type or API to preserve the invariant.
TypeScriptGoRustCHaskellJavaAPI contracts and explicit dependencies
What may a caller assume? Describe inputs, outputs, effects, and failure behavior, then choose a dependency boundary that can be tested.
TypeScriptGoRustCHaskellJavaReviewing code and hidden assumptions
What could break with a different caller, input, or lifetime? Review aliasing, ownership, failure paths, and implicit shared state.
TypeScriptGoRustCHaskellJavaRefactoring without changing behavior
Which observations must stay the same? Establish checks before changing the structure, then explain what they do and do not prove.
TypeScriptGoRustCHaskellJavaCost, benchmarks, and profiles
Go underneathMeasure a representative workload before deciding where the cost comes from.
Time, space, and algorithmic cost
How does work grow with input size? Compare asymptotic cost with allocations, constant factors, and the actual workload.
TypeScriptGoRustCHaskellJavaBenchmarking and build modes
What does this timing measure? Account for warmup, optimization, eliminated work, input selection, and measurement noise.
TypeScriptGoRustCHaskellJavaCPU profiles and hot paths
Where is time being spent? Read samples and call paths, form a hypothesis, and measure the change.
TypeScriptGoRustCHaskellJavaAllocation profiles and retained memory
Does this program allocate frequently or keep data alive? Distinguish allocation rate, live memory, and resource leaks.
TypeScriptGoRustCHaskellJavaCLI tools and configuration
Build understandingGive a small program a clear interface and predictable configuration.
Arguments, standard streams, and exit codes
How does another person or program interact with your tool? Parse arguments, distinguish output from diagnostics, and report failure.
TypeScriptGoRustCHaskellJavaProject structure and dependency boundaries
Where should parsing, domain behavior, and I/O live? Organize a small project around responsibilities and explicit dependencies.
TypeScriptGoRustCHaskellJavaFiles and external data
Build understandingTurn bytes outside the program into usable values, then write results with explicit failure behavior.
Reading lines and processing text
How do you count, filter, and summarize a text file? Build a small word-count tool and handle the last line and the empty file.
TypeScriptGoRustCHaskellJavaFiles, parsing, and serialization
How does external text become a checked value? Separate decoding, parsing, validation, and representing failures.
TypeScriptGoRustCHaskellJavaPaths, directories, and portability
Will this path work on another machine? Join paths safely, walk a directory, and handle files that disappear mid-walk.
TypeScriptGoRustCHaskellJavaSafe file updates and interrupted writes
What remains if a write fails halfway through? Compare overwriting, temporary files, replacement, and the limits of atomicity and durability.
TypeScriptGoRustCHaskellJavaSerialization and foreign interfaces
What survives when a value crosses a file, wire, or language boundary? Compare encodings, layouts, and ownership contracts.
TypeScriptGoRustCHaskellJavaHTTP clients and small servers
Build understandingFollow a request through parsing, application behavior, and a response.
HTTP requests, responses, and timeouts
What does a client actually send and receive? Handle status codes, body decoding, cancellation, and owned resources.
TypeScriptGoRustCHaskellJavaHandlers, validation, and error responses
Where does an untrusted request become a domain input? Separate transport handling from behavior and map failures deliberately.
TypeScriptGoRustCHaskellJavaTesting a network boundary
Which behavior needs a real connection, and which can be checked locally? Test protocol interactions without making every test depend on a remote service.
TypeScriptGoRustCHaskellJavaPersistence and transactions
Build understandingMake the boundary between an in-memory result and stored state explicit.
Storage operations and repository boundaries
What does the rest of the program need from storage? Express operations and errors without hiding important consistency assumptions.
TypeScriptGoRustCHaskellJavaTransactions, commit, and rollback
Which changes must succeed together? Trace success and failure while separating database transactions from in-memory mutation.
TypeScriptGoRustCHaskellJavaTesting persistence and restart behavior
What survives after the process exits? Check migrations, constraints, failed writes, and reload behavior with a representative storage environment.
TypeScriptGoRustCHaskellJavaA bounded concurrent worker
Go underneathCombine task lifetime, errors, resource ownership, and testing in one small application.
Bounded work and backpressure
What happens when jobs arrive faster than they finish? Limit active work and queue growth, and define how callers observe overload.
TypeScriptGoRustCHaskellJavaCancellation and graceful shutdown
What happens to queued and active work when the program stops? Trace cancellation, draining, cleanup, and explicit completion guarantees.
TypeScriptGoRustCHaskellJava