Unit 01 · 1 h 12 min
Secrets in code
Find keys, passwords and tokens in a repository and its history, rotate them and stop the next one at commit time.
Secure Code and CI
Keep secrets, dependencies, pipelines and releases out of attackers' hands.
- Time
- 11 h 13 min
- Lessons
- 41
- Machine
- Ubuntu 24.04 LTS
- Builds on
- Linux Foundations
What you earn
RootCertificateSecure Code and CI, certificate of completion ISC2CSSLPCertified Secure Software Lifecycle Professional
*Comparable to Certified Secure Software Lifecycle Professional.
You will be able to
- Find and rotate secrets in code and git history
- Lock dependencies with hashes and spot typosquats
- Respond to a hijacked package from advisory to rotation
- Harden GitHub Actions: permissions, pinning and secrets
- Prove builds match source with reproducibility and signatures
Units and lessons
Unit 02 · 1 h 41 min
Dependencies and lockfiles
Know exactly what you install, pin it with hashes, spot typosquats and switch off install scripts you did not ask for.
Unit 03 · 1 h 6 min
Hijacked packages and registry worms
When a trusted package is published by an attacker: find where it landed, what it touched, and how provenance and cooldowns help.
Unit 04 · 1 h 21 min
CI pipelines as targets
Read GitHub Actions workflows like an attacker would, then cut token permissions, pin actions and keep secrets away from untrusted code.
Unit 05 · 1 h 22 min
Build integrity
Prove that what you ship is what is in source control: reproducible builds, tarball checks, signatures and a second builder.
Unit 06 · 1 h 5 min
Inventories and vulnerability response
Build an SBOM, find every copy of a vulnerable library across an estate, prioritise with KEV and prove the patch landed.
Unit 07 · 1 h 18 min
Developer machines
The laptop is part of the supply chain: plaintext tokens, IDE extensions, AI coding agents, MCP servers and fake interview tasks.
Unit 08 · 59 min
Safe releases
Ship changes in stages with health gates, validate content updates like code, switch features off fast and roll back cleanly.
Unit 09 · 1 h 9 min
Capstone: audit a repository and its pipeline
Audit quay-billing end to end with everything from this course and write findings a team can act on.
Audit a software company's repositories, packages, CI pipelines and developer laptops on a real machine, using cases from xz utils to the 2025 npm worms. Every lesson ends with the control that would have stopped the real incident.
* Root is not affiliated with these issuers. See our terms.