Course Objective & Scope
AI coding assistants generate clean-looking, syntactically valid code in seconds, yet they frequently introduce subtle vulnerabilities—missing object-level authorization checks (BOLA/IDOR), outdated cryptography, injection sinks or hallucinated package names susceptible to slopsquatting. This course equips engineers and AppSec teams to review high-velocity code securely.
AI-specific vulnerability patterns, deterministic SAST rules with Semgrep and CodeQL, LLM-assisted threat modelling and business-logic review, dependency/SBOM verification, and proving/fixing vulnerabilities with security regression tests are practised on real pull requests.
Who Should Attend?
- Software engineers and senior developers who review pull requests
- Application Security (AppSec) and DevSecOps engineers
- Tech leads and engineering Security Champions
- Prerequisite: experience with web/API development and Git pull-request workflows
Key Takeaways
- Spot security anti-patterns characteristic of AI-generated code during PR review
- Identify injection flaws, SSRF, insecure deserialisation and broken object-level authorization (BOLA/IDOR)
- Block hallucinated package names (slopsquatting), vulnerable dependencies and hardcoded secrets
- Combine Semgrep/CodeQL rules with context-aware LLM triage to cut false positives
- Write security regression tests that prove the flaw and verify the remediation
Curriculum
The Threat Landscape of AI-Generated Code
- Why clean-looking AI code hides vulnerabilities: insecure defaults and missing negative checks
- App-level LLM risks: prompt injection sinks, unsafe output rendering and over-privileged tools
Authentication, Authorization and Business-Logic Flaws
- Catching BOLA/IDOR, tenant-isolation leaks and state-bypass flaws that static scanners miss
- Reviewing PR diffs against endpoint permission matrices and threat models
Injection, Data Exposure and Cryptographic Pitfalls
- SQL/NoSQL/command injection, SSRF, path traversal and XSS patterns
- PII leaked into logs, hardcoded secrets and weak randomness or hashing
Supply Chain Security: Dependencies and Slopsquatting
- Detecting hallucinated package names (slopsquatting) and outdated transitive dependencies
- Lockfile verification, SCA scanners and private package registry policies
Hybrid Security Review Pipeline: Semgrep, CodeQL and AI Triage
- Authoring custom Semgrep rules in minutes with LLM assistance
- Triaging SAST findings for exploitability and shipping verified security patches with tests
Other Courses in This Category
-
Governance training for engineering organisations covering zero-data-retention (ZDR), IP and open-source licence compliance, approved model/MCP registries, risk tiering and developer policies for AI-assisted coding.
- Live Course
- 5 modules
-
End-to-end training on redesigning the Software Development Life Cycle for the AI era—resolving review, QA and security bottlenecks across requirements, coding, PR review, CI/CD and operations, with DORA/SPACE metrics.
- Live Course
- 5 modules
-
Extracting business rules from COBOL, PL/SQL stored procedures and legacy Java/.NET monoliths, applying the Strangler Fig pattern, verifying parity with golden-master/dual-run tests and migrating safely to modern architectures.
- Live Course
- 5 modules
-
Training for QA and test engineers on testing non-deterministic LLM, RAG and agent applications using golden datasets, RAG evaluation metrics, LLM-as-a-Judge, prompt-injection red teaming and CI regression gates.
- Live Course
- 5 modules
-
Training for SRE, DevOps and IT operations teams on alert noise reduction, log/metric/OpenTelemetry trace correlation, recent-change analysis, human-approved runbook execution and post-mortem automation.
- Live Course
- 5 modules
-
Accelerated transition programme taking software teams from basic IDE autocomplete and chat to context engineering, multi-file editing and test-verified autonomous coding agent workflows.
- Live Course
- 4 modules
Get in touch
