Unit 01 · 1 h 12 min
Secrets in code
Find keys, passwords and tokens in a repository and its history, rotate them and stop the next one at commit time.
Secure Code and CI
Keep secrets, dependencies, pipelines and releases out of attackers' hands.
- Time
- 11 h 13 min
- Lessons
- 41
- Machine
- Ubuntu 24.04 LTS
- Builds on
- Linux Foundations
What you earn
RootCertificateSecure Code and CI, certificate of completion ISC2CSSLPCertified Secure Software Lifecycle Professional
Prepares you for Certified Secure Software Lifecycle Professional. Root is not affiliated with these issuers.
You will be able to
- Find and rotate secrets in code and git history
- Lock dependencies with hashes and spot typosquats
- Respond to a hijacked package from advisory to rotation
- Harden GitHub Actions: permissions, pinning and secrets
- Prove builds match source with reproducibility and signatures
Units and lessons
Unit 02 · 1 h 41 min
Dependencies and lockfiles
Know exactly what you install, pin it with hashes, spot typosquats and switch off install scripts you did not ask for.
Unit 03 · 1 h 6 min
Hijacked packages and registry worms
When a trusted package is published by an attacker: find where it landed, what it touched, and how provenance and cooldowns help.
Unit 04 · 1 h 21 min
CI pipelines as targets
Read GitHub Actions workflows like an attacker would, then cut token permissions, pin actions and keep secrets away from untrusted code.
Unit 05 · 1 h 22 min
Build integrity
Prove that what you ship is what is in source control: reproducible builds, tarball checks, signatures and a second builder.
Unit 06 · 1 h 5 min
Inventories and vulnerability response
Build an SBOM, find every copy of a vulnerable library across an estate, prioritise with KEV and prove the patch landed.
Unit 07 · 1 h 18 min
Developer machines
The laptop is part of the supply chain: plaintext tokens, IDE extensions, AI coding agents, MCP servers and fake interview tasks.
Unit 08 · 59 min
Safe releases
Ship changes in stages with health gates, validate content updates like code, switch features off fast and roll back cleanly.
Unit 09 · 1 h 9 min
Capstone: audit a repository and its pipeline
Audit quay-billing end to end with everything from this course and write findings a team can act on.
Audit a software company's repositories, packages, CI pipelines and developer laptops on a real machine, using cases from xz utils to the 2025 npm worms. Every lesson ends with the control that would have stopped the real incident.