Application and API Security Fundamentals
Trust boundaries, sessions and object authority, input/output handling, dependencies and secure release.
Curriculum
Learn at your own paceConcepts and security design
0/2 completedA five-question quiz follows this module.
Module quizzes
Use knowledge in a decision
Practice paths for this course
7 missions to explore
Poisoned context: the assistant’s boundary
A document retrieved by a support assistant requests an unexpected tool action. Separate information, instructions and authority.
Delegated agent: the authority chain
An agent calls another tool and loses the user’s scope during delegation. Investigate identity, tool outputs and recovery boundaries.
Authorised boundary: the redirect trap
An authorised lab page redirects to an out-of-scope provider. Manage the difference between reachability and permission.
Finding or assumption?
A scanner reports high risk, but the first response is empty. Separate evidence from impact using two synthetic identities.
Hidden button, open resource
The UI hides a button; the API returns another account's synthetic object. Put the control at the right layer.
Queued authority: when is the decision made?
An export request is accepted, then access is revoked before execution. Inspect session, queue and download boundaries.
Green check, open release risk
Scanning is green; a new dependency changes data paths and release authority. Preserve acceptance boundaries under delivery pressure.
Final exam
Meet the required proficiency standard to earn your course certificate.
Academy finals require 80%; official exam requirements are assessed separately.