OWASP-aligned classroom roadmap
We are expanding this collection incrementally toward a focused exercise for each OWASP Top 10:2025 category. A category can contain many weaknesses: one exercise is a worked example, not comprehensive coverage or certification.
Available lessons
| Category | Lesson coverage |
|---|---|
| A03 Software Supply Chain Failures | Exercises 01–03: investigate and remediate known vulnerable dependencies, review AI advice, and enforce scan policy. Not complete supply-chain coverage. |
| A05 Injection | Exercise 04: unsafe browser message rendering, a harmless local XSS demonstration, safe text rendering, and regression checks. Not SQL injection or complete injection coverage. |
| A01 Broken Access Control | Exercise 05: a supplied local student portal, one server-side ownership repair, and tests for allowed and denied record access. Not production authentication or complete authorization coverage. |
| A02 Security Misconfiguration | Exercise 06: disable public debug diagnostics in a supplied local service while retaining useful error reporting and normal functionality. Not complete production hardening. |
| A04 Cryptographic Failures | Exercise 07: replace reversible password storage with a supplied salted password-hashing helper; verify login behavior and stored values. Not a complete authentication system. |
Expansion order
The following proposed lessons are planned, not available. Topics and order are subject to refinement based on instructor feedback. No release dates are committed.
| Exercise | Status | OWASP 2025 | Proposed learning outcome |
|---|---|---|---|
| 08 Insecure Design | Planned | A06 | Identify an unsafe account-recovery design and introduce a safer verification flow. |
| 09 Authentication Failures | Planned | A07 | Repair session handling so logging out invalidates the session. |
| 10 Software or Data Integrity Failures | Planned | A08 | Reject a tampered update using a trusted integrity check. |
| 11 Security Logging and Alerting Failures | Planned | A09 | Record useful security events without secrets and flag suspicious activity. |
| 12 Mishandling of Exceptional Conditions | Planned | A10 | Handle unexpected failures safely without granting access or reporting success. |
Together with the seven available exercises, these would provide 12 exercises with examples across all ten categories. Exercises 01–03 share A03. Each new row represents a future complete teaching package, not an existing downloadable lesson.
The browser-only and local-server lessons provide reusable beginner teaching patterns. Refine them through instructor feedback while keeping dependency lessons connected to their OWASP category. Add the remaining category exercises incrementally according to course needs; they are not yet implemented. One example per category is the collection goal, not a claim of comprehensive coverage.
Each new lesson should supply a runnable application, a controlled demonstration, a repair and tests, student worksheet, instructor notes, rubric, and complete worked solution. Use a real isolated backend when the learning objective requires one; client-side UI restrictions are not server authorization.
CVE Lite belongs where dependency-security analysis helps. It is not presented as a detector of all OWASP weaknesses. Existing classroom interest is not claimed as institutional adoption or endorsement.