Security & Privacy
Protect user data and test access boundaries using safe simulated cases.
Open any lesson to see its learning objective. The lesson activities are being prepared.
Identity and Authorization
Authentication Versus Authorization
Explain who a user is versus what they are permitted to do.
Sessions, Tokens and Login State
Understand session boundaries and basic token exposure risks.
Roles, Groups and Membership
Evaluate owner, admin and member access with explicit permissions.
Database RLS and Server-Side Checks
Recognize why UI-only restrictions cannot protect stored records.
Secrets and Data Boundaries
API Keys, Secrets and Environment Variables
Keep privileged credentials out of browser-visible code.
Tenant Isolation and Organization Boundaries
Test whether data belonging to one organization leaks to another.
Private Files, Permissions and Signed Links
Explore access to images, audio and temporary download links.
Personal Data, Retention and Residency
Identify sensitive fields and basic retention/location considerations.
Safe Security Verification
Input Validation and Untrusted Content
Recognize unsafe input and distinguish instructions from data.
Least Privilege and Account Lifecycle
Reduce unnecessary access and remove permissions when no longer needed.
Negative Security Tests and Evidence
Design read, write and update denial cases using test accounts.
Privacy Incidents and Responsible Reporting
Document concerns carefully without exposing real user data.