SECNET.WORK / ENGINEERING WORKSHOP

Take security from code to release decisions.

One product, different trust boundaries. Inspect Harbor Desk’s web, API and mobile components; expose a flaw, test the correction and explain the decision.

01 · Start with secure coding

HARBOR DESK / ARCHITECTURE

BrowserMobile
↓ untrusted requestAPI · server actor↓ object + tenant authorityScoped records

TLS protects transport. Authority is evaluated at each boundary.

FOLLOW YOUR ROLE

Choose a specialization path.

From secure code to design ownership. The sequence below is a study recommendation, not an account achievement or formal qualification.

  1. 01Secure coding
  2. 02Web application security testing
  3. 03API authorization and business logic testing
  4. 04Android security review
  5. 05iOS security review
  6. 06DevSecOps and the software supply chain
  7. 07Secure software development lifecycle
  8. 08Threat modeling and design review
  9. 09Security-focused QA and retesting
  10. 10Security review of AI-generated code
Find related Academy courses ↗Choose your target role in Academy career planning ↗

Academy is a separate application. Choices here are not written to a career account; the career page opens your existing plan.

WORKSHOP LIBRARY

10 topics. Three depths in each.

10 modules · beginner, intermediate, advanced

01

Secure coding

A request that works is not necessarily authorized. Build trusted actor context, data boundaries, parameterized queries and field allowlists together in Harbor Desk.

3 scenarios · code + test + reasoning
02

Web application security testing

Test browser behavior, server sessions and file-processing boundaries together. Distinguish scanner output from a validated finding.

3 scenarios · code + test + reasoning
03

API authorization and business logic testing

Isolate object, action and tenant boundaries. Test forged roles, foreign records and stale updates in the Harbor Desk API.

3 scenarios · code + test + reasoning
04

Android security review

Review Android storage, verified links and release artifacts. Keep browser policy models distinct from device verification.

3 scenarios · code + test + reasoning
05

iOS security review

Review Keychain, Universal Links and release entitlements against business needs. Do not base token storage decisions on sandbox assumptions alone.

3 scenarios · code + test + reasoning
06

DevSecOps and the software supply chain

Show which code was checked, by which tool and through which artifact, rather than relying on a green pipeline. SAST, DAST, SCA and SBOM produce different evidence.

3 scenarios · code + test + reasoning
07

Secure software development lifecycle

Translate policy into testable product requirements. Trace owner, acceptance criteria, release gates and incident feedback in one record.

3 scenarios · code + test + reasoning
08

Threat modeling and design review

Give architecture boxes meaning through trust boundaries and abuse paths. Review API, mobile, AI tools and recovery dependencies in the same product.

3 scenarios · code + test + reasoning
09

Security-focused QA and retesting

Go beyond the happy path: verify denial, outage, race and side-effect behavior. Define expectations independently of current implementation.

3 scenarios · code + test + reasoning
10

Security review of AI-generated code

AI can accelerate work; authority over security decisions is retained. Evaluate generated code, package suggestions and self-authored tests with independent evidence.

3 scenarios · code + test + reasoning

Run it locally.

Node.js HTTP API, Python/SQLite fixture and tests; TypeScript, Java, C#, Kotlin and Swift review fragments. No package installation for Node/Python. Native fragments are not full applications; SDK and device verification remain separate.

Download the Harbor Desk project