powstik
Prove
LiveProof-of-Work · Oct–Nov: every verified proof counts. 35 days leftAll outcomes
Skills

Write Secure Code (OWASP practices)

6 weeks · 2 milestones

Principles of Secure Coding (OWASP Secure Coding Practices), then one project of your own. Part of the Varsity Curriculum: Computer Science.

Milestone map

Milestone map

2 milestones

Do the course work in public

2–4 weeks (4 hrs/week)

Take Principles of Secure Coding for free and do Juice Shop challenges on your own copy, each with how the bug works. Keep everything in one public repo or notebook as you go. OSSU lists a Coursera course. We use the free OWASP guide and Juice Shop.

Proof required

Link your public repo or notebook with Juice Shop challenges on your own copy, each with how the bug works, and a screenshot or log showing the self-check passed.

What gets checked

  • Run only on your own copy.
  • Each write-up names the coding mistake behind it.
  • Screens or logs prove it.

Common mistakes

  • Copying posted answers: verifiers read the history.
  • Skipping the self-check, then asking for review too early.

Powstik Guide

A public repo or notebook with Juice Shop challenges on your own copy, each with how the bug works.

Steps

  1. Make a public repo or notebook first.
  2. Do one unit at a time and commit after each.
  3. Run the self-check: Run Juice Shop on your own machine and solve its beginner challenges.
  4. Write a short README: what is here and how to run it.
  5. Ask three people who know the topic to check it.

Template

README
Course: Principles of Secure Coding (OWASP Secure Coding Practices)
What is here:
How to run it:
Self-check result:
What was hardest:

What gets sent back

  • No history, just one big upload.
  • Self-check not shown.
  • Code that does not run from the README.

Resources

Foundationstart here

Depthgo deeper

What a verifier looks for

  • Run only on your own copy.
  • Each write-up names the coding mistake behind it.
  • Screens or logs prove it.
  • Ask one question about a choice in the code; the answer should be clear.

You'll sign in first, then come straight back here.

Fix security bugs in your own code

1–3 weeks (5–8 hrs/week)

Use what you learned. Make a review of one of your apps against the OWASP checklist, with at least three fixes. Keep it small enough to finish in about two weeks.

Proof required

Link a review of one of your apps against the OWASP checklist, with at least three fixes, with a README that says how to run or read it.

What gets checked

  • Each fix links to a commit.
  • Each fix names the checklist item.
  • A test shows the bug is gone.

Common mistakes

  • A project too big to finish.
  • A demo that only works on your machine.

Powstik Guide

A review of one of your apps against the OWASP checklist, with at least three fixes.

Steps

  1. Write one line: what it does and for whom.
  2. Build the smallest version that works.
  3. Test it on someone else's machine or with someone else reading it.
  4. Write the README.
  5. Ask three people to check it.

Template

README
What it does:
Who it is for:
How to run it:
What I would do next:

What gets sent back

  • Does not run from the README.
  • Not clearly the person's own work.
  • Claims more than it does.

Resources

Foundationstart here

Depthgo deeper

What a verifier looks for

  • Each fix links to a commit.
  • Each fix names the checklist item.
  • A test shows the bug is gone.
  • Check that the work is the person's own.

You'll sign in first, then come straight back here.

Part of