// AMWARE · Courses
Learn the systems, not just the syntax.
Build-along courses pulled from production work: the patterns, trade-offs and plumbing that tutorials skip.
- 1 course in pre-launch
- Self-paced
- A quiz every week
01 · Featured course · for developers
Pre-launch · waitlist openSecure the Stack.
Vulnerability testing for apps on Supabase, Next.js, Drizzle, Prisma and Postgres. For developers who can build a full-stack app but were never taught to break one.
- modules, from foundations to a client-ready audit
- 9
- weekly lessons, each ending in a quiz
- ~34
- staged vulnerable apps to work through
- 9
- FindRecon a staged app the way an attacker would.
- RateScore each finding by likelihood and impact.
- FixPatch it, then write the test that keeps it fixed.
Module 1 · Built
Security Foundations for Full-Stack Developers
Install the mental model: how attackers think, what goes wrong in this stack, how to threat-model it, and how to set up a testing lab.
- Week 1The AppSec mindset and how attackers think
- Week 2The OWASP Top 10, mapped to your stack
- Week 3Threat modeling a full-stack app
- Week 4Building your vulnerability testing lab
Project. OrbitDesk, a vulnerable Next.js app with 12 planted findings. Recon it, threat-model it and rate what you find.
About 8 to 9 months at about 4 weeks per module. Go at the pace where the quizzes stay easy.
02 · By the end
What you'll be able to do.
Four outcomes, and every module works toward at least one of them.
- Think like an attackerThreat-model a modern JS/TS full-stack app systematically, starting from where the trust boundaries sit.
- Find, rate and fixExploit and remediate the vulnerability classes that actually hit Supabase, Next.js, Drizzle, Prisma and Postgres apps.
- Catch regressions in CIWire security testing into your workflow so a fixed bug stays fixed.
- Write the client reportProduce a professional security assessment, the deliverable a fractional CTO hands a founder.
03 · Before you start
Built for builders who are new to security.
You'll need
- Comfort building full-stack apps: JS or TS, React and SQL basics.
You won't need
- Any security background. Module 1 starts from how attackers think.
How it's assessed
- Weekly quizActive recall while the lesson is fresh.
- Module quizMixes earlier weeks back in, so it sticks.
- Hands-on projectNew code, same ideas. That's where skill comes from.
Later modules re-exploit earlier bugs on purpose. CVE-2025-29927 shows up in Module 2 and again in Module 7.
04 · Join the first cohort
Pick the track that fits where you are.
Same curriculum, two paces. Join the waitlist and you'll hear first when the cohort opens.
Not ready for a course?
