Security audits: OWASP
This course works through the OWASP Top 10:2025, using a Rails application as the running example. It starts with the list itself, what changed in it, and which categories Rails handles by default. Lessons then cover broken access control, injection in SQL, shell commands and views, and authentication and sessions. They also cover dependencies and the build pipeline, and configuration, secrets and failing safely. The last lesson audits the application in order of likely damage and names what scanners cannot find.
What you'll learn
- ✓How the OWASP Top 10:2025 is organized and what Rails covers by default
- ✓Scoping queries to the current user and writing negative access tests
- ✓Finding SQL, command and XSS injection outside the framework's safe paths
- ✓Password storage, non-enumerating messages and session handling
- ✓Supply chain controls, secret handling and failing closed
- ✓Auditing an application in order of likely damage
The OWASP Top 10, 2025
Security work without a frame is a list of things you happened to remember. The OWASP Top 10 is the frame most of the industry uses: a ranked list of the categories of weakness that cause breaches, revised every few years from real data.
Read the full lesson free →Curriculum
7 lessonsThe OWASP Top 10, 2025
Introduces the OWASP Top 10:2025, its two most changed entries, and which categories Rails handles by default.
Broken access control, in Rails
Shows how to scope queries to the current user, protect admin routes, review permit lists and test refusals.
Injection and its modern shapes
Covers SQL fragments that need allowlists, shell-free commands, html_safe, Markdown rendering, Content Security Policy and prompt injection.
Authentication and sessions
Explains bcrypt storage, a single password policy, hiding which accounts exist, session resets, rate limiting and MFA.
Supply chain and dependencies
Describes A03 as the whole build and distribution process, with SBOMs, audit tooling, lock files and dependency choices.
Configuration, secrets, and failing safely
Covers production misconfiguration, secret rotation, failing closed, safe error pages and partial failures outside database transactions.
Putting it together: auditing this application
Audits this application in order of likely damage, with existing answers, next questions and the limits of scanners.