BranchesTags

Repository files navigation

Elixir Secure Coding Training

Elixir Secure Coding Training (ESCT)

Run in Livebook

EEF Security WG projectEEF Education WG projectGitHub contributorsGitHub last commitGitHub issues by-labelGitHub pull requests by-label

An all-encompassing, opinionated cybersecurity curriculum designed for enterprise use at software companies using the Elixir programming language.

About | Curriculum | Usage | Contributing | License

About

Originally developed for Podium's Elixir engineers by its Product Security team, the ESCT was designed to be integrated into developer onboarding processes - teaching developers about Application Security using context that applies to them.

The content originally focused exclusively on what technology Podium uses, but quickly grew to encapsulate more areas of Application Security. The material itself is composed of views from the Product Security team at Podium as well as information sourced from reputable public information - attribution has been given wherever possible.

Today, individuals or companies wishing to try out the ESCT can and are encouraged to fork a copy of their own - please follow the relevant instructions below depending on your use case.

If you find an issue, wish to suggest an idea, or start a discussion; please see our CONTRIBUTING Guide!

Curriculum

Currently the curriculum is broken into the following 8 primary topics, each containing multiple lessons:

  1. OWASP
    • OWASP Top 10
  2. Secure SDLC
    • No Secrets In Code
    • Making Secret Rotation Easy
    • Rate Limiting
    • Principle of Least Privilege
  3. GraphQL Security
    • Disabling Introspection
    • Error Disclosure
    • Resource Exhaustion
      • Cost Theory
  4. Elixir Security
    • Atom Exhaustion
    • Protecting Sensitive Data
    • Untrusted Code
    • Timing Attacks
    • Boolean Coercion
  5. Cookie Security
    • Ingredients of a Cookie
    • The Perfect Cookie
    • Elixir Phoenix Cookies
  6. Security Anti-Patterns
    • Security Through Obscurity
    • Frontend Authorization Checks
  7. CI/CD Tooling
    • Sobelow
      • Salus
    • Semgrep
  8. The Secure Road
    • Service to Service Authentication
    • User Authorization

If you do not see a topic or lesson you would like covered, please review our open issues and our CONTRIBUTING Guide before opening a new issue - but we encourage requests!

Usage

For "Learners"

Using the ESCT as a consumer of the content is easy by just following these simple steps:

  1. Fork this repo into a space you control
    • Important to note: if you were instructed to use this course by your company, double check with the folks who are running things for your company to ensure they don't have a customized version of the training materials
  2. Clone your forked repo
  3. Load the Live Markdown files in an instance of Livebook
    • For further instructions on getting Livebook setup locally, please refer to their documentation.
  4. Complete the training as instructed and save your progress along the way!
  5. Feedback will be provided directly within Livebook via the "Graded Cell" smart cell

For "Educators"

Using the ESCT as a purveyor of the curriculum is relatively straight-forward:

  1. Determine if you need to customize the content to better suit your business - whether that's changing the contents to reflect internal only information or if you simply want to remove modules your engineers won't find useful.
    • If you determine that you wish to customize the content, fork the repository into your companies VCS with the necessary adjustments made.
    • In the future, there may need to be additional configuration steps regarding establishing configuration secrets for reporting purposes - at which you would also do that at this time.
  2. Instruct your workforce to follow the "Learners" instructions above using whichever version of the ESCT you would rather them use

Contributing

Please refer to our CONTRIBUTING Guide for more details on how to add to this project!

Sponsors

In addition to our contributors, this library receives support and maintenance from TV Labs

TV Labs Logo

License

GitHub

About

An interactive cybersecurity curriculum designed for enterprise use at software companies using Elixir

Topics

education-wgelixirelixir-langelixir-phoenixlivebooksalussecuritysecurity-educationsecurity-wgsobelow

Resources

Readme
MIT license

Code of conduct

Code of conduct

Contributing

Contributing

Security policy

Security policy
Activity
Custom properties

Stars

729 stars

Watchers

15 watching

Forks

172 forks
Report repository

Sponsor this project

Used by

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
BranchesTags
Repository files navigation
Elixir Secure Coding Training
Elixir Secure Coding Training (ESCT)
Run in Livebook
EEF Security WG projectEEF Education WG projectGitHub contributorsGitHub last commitGitHub issues by-labelGitHub pull requests by-label
An all-encompassing, opinionated cybersecurity curriculum designed for enterprise use at software companies using the Elixir programming language.
About |
Curriculum |
Usage |
Contributing |
License
About
Originally developed for Podium's Elixir engineers by its Product Security team, the ESCT was designed to be integrated into developer onboarding processes - teaching developers about Application Security using context that applies to them.
The content originally focused exclusively on what technology Podium uses, but quickly grew to encapsulate more areas of Application Security. The material itself is composed of views from the Product Security team at Podium as well as information sourced from reputable public information - attribution has been given wherever possible.
Today, individuals or companies wishing to try out the ESCT can and are encouraged to fork a copy of their own - please follow the relevant instructions below depending on your use case.
If you find an issue, wish to suggest an idea, or start a discussion; please see our CONTRIBUTING Guide!
Curriculum
Currently the curriculum is broken into the following 8 primary topics, each containing multiple lessons:
  1. OWASP
    • OWASP Top 10
  2. Secure SDLC
    • No Secrets In Code
    • Making Secret Rotation Easy
    • Rate Limiting
    • Principle of Least Privilege
  3. GraphQL Security
    • Disabling Introspection
    • Error Disclosure
    • Resource Exhaustion

      • Cost Theory
  4. Elixir Security
    • Atom Exhaustion
    • Protecting Sensitive Data
    • Untrusted Code
    • Timing Attacks
    • Boolean Coercion
  5. Cookie Security
    • Ingredients of a Cookie
    • The Perfect Cookie
    • Elixir Phoenix Cookies
  6. Security Anti-Patterns
    • Security Through Obscurity
    • Frontend Authorization Checks
  7. CI/CD Tooling
    • Sobelow

      • Salus
    • Semgrep
  8. The Secure Road
    • Service to Service Authentication
    • User Authorization
If you do not see a topic or lesson you would like covered, please review our open issues and our CONTRIBUTING Guide before opening a new issue - but we encourage requests!
Usage
For "Learners"
Using the ESCT as a consumer of the content is easy by just following these simple steps:
  1. Fork this repo into a space you control
    • Important to note: if you were instructed to use this course by your company, double check with the folks who are running things for your company to ensure they don't have a customized version of the training materials
  2. Clone your forked repo
  3. Load the Live Markdown files in an instance of Livebook
    • For further instructions on getting Livebook setup locally, please refer to their documentation.
  4. Complete the training as instructed and save your progress along the way!
  5. Feedback will be provided directly within Livebook via the "Graded Cell" smart cell
For "Educators"
Using the ESCT as a purveyor of the curriculum is relatively straight-forward:
  1. Determine if you need to customize the content to better suit your business - whether that's changing the contents to reflect internal only information or if you simply want to remove modules your engineers won't find useful.

    • If you determine that you wish to customize the content, fork the repository into your companies VCS with the necessary adjustments made.
    • In the future, there may need to be additional configuration steps regarding establishing configuration secrets for reporting purposes - at which you would also do that at this time.
  2. Instruct your workforce to follow the "Learners" instructions above using whichever version of the ESCT you would rather them use
Contributing
Please refer to our CONTRIBUTING Guide for more details on how to add to this project!
Sponsors
In addition to our contributors, this library receives support and maintenance from TV Labs
TV Labs Logo
License
GitHub
About
An interactive cybersecurity curriculum designed for enterprise use at software companies using Elixir
Topics
education-wgelixirelixir-langelixir-phoenixlivebooksalussecuritysecurity-educationsecurity-wgsobelow
Resources
Readme
MIT license
Code of conduct
Code of conduct
Contributing
Contributing
Security policy
Security policy
Activity
Custom properties
Stars
729 stars
Watchers
15 watching
Forks
172 forks
Report repository
Sponsor this project
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Repository files navigation
Elixir Secure Coding Training
Elixir Secure Coding Training (ESCT)
Run in Livebook
EEF Security WG projectEEF Education WG projectGitHub contributorsGitHub last commitGitHub issues by-labelGitHub pull requests by-label
An all-encompassing, opinionated cybersecurity curriculum designed for enterprise use at software companies using the Elixir programming language.
About |
Curriculum |
Usage |
Contributing |
License
About
Originally developed for Podium's Elixir engineers by its Product Security team, the ESCT was designed to be integrated into developer onboarding processes - teaching developers about Application Security using context that applies to them.
The content originally focused exclusively on what technology Podium uses, but quickly grew to encapsulate more areas of Application Security. The material itself is composed of views from the Product Security team at Podium as well as information sourced from reputable public information - attribution has been given wherever possible.
Today, individuals or companies wishing to try out the ESCT can and are encouraged to fork a copy of their own - please follow the relevant instructions below depending on your use case.
If you find an issue, wish to suggest an idea, or start a discussion; please see our CONTRIBUTING Guide!
Curriculum
Currently the curriculum is broken into the following 8 primary topics, each containing multiple lessons:
  1. OWASP
    • OWASP Top 10
  2. Secure SDLC
    • No Secrets In Code
    • Making Secret Rotation Easy
    • Rate Limiting
    • Principle of Least Privilege
  3. GraphQL Security
    • Disabling Introspection
    • Error Disclosure
    • Resource Exhaustion

      • Cost Theory
  4. Elixir Security
    • Atom Exhaustion
    • Protecting Sensitive Data
    • Untrusted Code
    • Timing Attacks
    • Boolean Coercion
  5. Cookie Security
    • Ingredients of a Cookie
    • The Perfect Cookie
    • Elixir Phoenix Cookies
  6. Security Anti-Patterns
    • Security Through Obscurity
    • Frontend Authorization Checks
  7. CI/CD Tooling
    • Sobelow

      • Salus
    • Semgrep
  8. The Secure Road
    • Service to Service Authentication
    • User Authorization
If you do not see a topic or lesson you would like covered, please review our open issues and our CONTRIBUTING Guide before opening a new issue - but we encourage requests!
Usage
For "Learners"
Using the ESCT as a consumer of the content is easy by just following these simple steps:
  1. Fork this repo into a space you control
    • Important to note: if you were instructed to use this course by your company, double check with the folks who are running things for your company to ensure they don't have a customized version of the training materials
  2. Clone your forked repo
  3. Load the Live Markdown files in an instance of Livebook
    • For further instructions on getting Livebook setup locally, please refer to their documentation.
  4. Complete the training as instructed and save your progress along the way!
  5. Feedback will be provided directly within Livebook via the "Graded Cell" smart cell
For "Educators"
Using the ESCT as a purveyor of the curriculum is relatively straight-forward:
  1. Determine if you need to customize the content to better suit your business - whether that's changing the contents to reflect internal only information or if you simply want to remove modules your engineers won't find useful.

    • If you determine that you wish to customize the content, fork the repository into your companies VCS with the necessary adjustments made.
    • In the future, there may need to be additional configuration steps regarding establishing configuration secrets for reporting purposes - at which you would also do that at this time.
  2. Instruct your workforce to follow the "Learners" instructions above using whichever version of the ESCT you would rather them use
Contributing
Please refer to our CONTRIBUTING Guide for more details on how to add to this project!
Sponsors
In addition to our contributors, this library receives support and maintenance from TV Labs
TV Labs Logo
License
GitHub
About
An interactive cybersecurity curriculum designed for enterprise use at software companies using Elixir
Topics
education-wgelixirelixir-langelixir-phoenixlivebooksalussecuritysecurity-educationsecurity-wgsobelow
Resources
Readme
MIT license
Code of conduct
Code of conduct
Contributing
Contributing
Security policy
Security policy
Activity
Custom properties
Stars
729 stars
Watchers
15 watching
Forks
172 forks
Report repository
Sponsor this project
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Repository files navigation
Elixir Secure Coding Training
Elixir Secure Coding Training (ESCT)
Run in Livebook
EEF Security WG projectEEF Education WG projectGitHub contributorsGitHub last commitGitHub issues by-labelGitHub pull requests by-label
An all-encompassing, opinionated cybersecurity curriculum designed for enterprise use at software companies using the Elixir programming language.
About |
Curriculum |
Usage |
Contributing |
License
About
Originally developed for Podium's Elixir engineers by its Product Security team, the ESCT was designed to be integrated into developer onboarding processes - teaching developers about Application Security using context that applies to them.
The content originally focused exclusively on what technology Podium uses, but quickly grew to encapsulate more areas of Application Security. The material itself is composed of views from the Product Security team at Podium as well as information sourced from reputable public information - attribution has been given wherever possible.
Today, individuals or companies wishing to try out the ESCT can and are encouraged to fork a copy of their own - please follow the relevant instructions below depending on your use case.
If you find an issue, wish to suggest an idea, or start a discussion; please see our CONTRIBUTING Guide!
Curriculum
Currently the curriculum is broken into the following 8 primary topics, each containing multiple lessons:
  1. OWASP
    • OWASP Top 10
  2. Secure SDLC
    • No Secrets In Code
    • Making Secret Rotation Easy
    • Rate Limiting
    • Principle of Least Privilege
  3. GraphQL Security
    • Disabling Introspection
    • Error Disclosure
    • Resource Exhaustion

      • Cost Theory
  4. Elixir Security
    • Atom Exhaustion
    • Protecting Sensitive Data
    • Untrusted Code
    • Timing Attacks
    • Boolean Coercion
  5. Cookie Security
    • Ingredients of a Cookie
    • The Perfect Cookie
    • Elixir Phoenix Cookies
  6. Security Anti-Patterns
    • Security Through Obscurity
    • Frontend Authorization Checks
  7. CI/CD Tooling
    • Sobelow

      • Salus
    • Semgrep
  8. The Secure Road
    • Service to Service Authentication
    • User Authorization
If you do not see a topic or lesson you would like covered, please review our open issues and our CONTRIBUTING Guide before opening a new issue - but we encourage requests!
Usage
For "Learners"
Using the ESCT as a consumer of the content is easy by just following these simple steps:
  1. Fork this repo into a space you control
    • Important to note: if you were instructed to use this course by your company, double check with the folks who are running things for your company to ensure they don't have a customized version of the training materials
  2. Clone your forked repo
  3. Load the Live Markdown files in an instance of Livebook
    • For further instructions on getting Livebook setup locally, please refer to their documentation.
  4. Complete the training as instructed and save your progress along the way!
  5. Feedback will be provided directly within Livebook via the "Graded Cell" smart cell
For "Educators"
Using the ESCT as a purveyor of the curriculum is relatively straight-forward:
  1. Determine if you need to customize the content to better suit your business - whether that's changing the contents to reflect internal only information or if you simply want to remove modules your engineers won't find useful.

    • If you determine that you wish to customize the content, fork the repository into your companies VCS with the necessary adjustments made.
    • In the future, there may need to be additional configuration steps regarding establishing configuration secrets for reporting purposes - at which you would also do that at this time.
  2. Instruct your workforce to follow the "Learners" instructions above using whichever version of the ESCT you would rather them use
Contributing
Please refer to our CONTRIBUTING Guide for more details on how to add to this project!
Sponsors
In addition to our contributors, this library receives support and maintenance from TV Labs
TV Labs Logo
License
GitHub
About
An interactive cybersecurity curriculum designed for enterprise use at software companies using Elixir
Topics
education-wgelixirelixir-langelixir-phoenixlivebooksalussecuritysecurity-educationsecurity-wgsobelow
Resources
Readme
MIT license
Code of conduct
Code of conduct
Contributing
Contributing
Security policy
Security policy
Activity
Custom properties
Stars
729 stars
Watchers
15 watching
Forks
172 forks
Report repository
Sponsor this project
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
BranchesTags
Repository files navigation
Elixir Secure Coding Training
Elixir Secure Coding Training (ESCT)
Run in Livebook
EEF Security WG projectEEF Education WG projectGitHub contributorsGitHub last commitGitHub issues by-labelGitHub pull requests by-label
An all-encompassing, opinionated cybersecurity curriculum designed for enterprise use at software companies using the Elixir programming language.
About |
Curriculum |
Usage |
Contributing |
License
About
Originally developed for Podium's Elixir engineers by its Product Security team, the ESCT was designed to be integrated into developer onboarding processes - teaching developers about Application Security using context that applies to them.
The content originally focused exclusively on what technology Podium uses, but quickly grew to encapsulate more areas of Application Security. The material itself is composed of views from the Product Security team at Podium as well as information sourced from reputable public information - attribution has been given wherever possible.
Today, individuals or companies wishing to try out the ESCT can and are encouraged to fork a copy of their own - please follow the relevant instructions below depending on your use case.
If you find an issue, wish to suggest an idea, or start a discussion; please see our CONTRIBUTING Guide!
Curriculum
Currently the curriculum is broken into the following 8 primary topics, each containing multiple lessons:
  1. OWASP
    • OWASP Top 10
  2. Secure SDLC
    • No Secrets In Code
    • Making Secret Rotation Easy
    • Rate Limiting
    • Principle of Least Privilege
  3. GraphQL Security
    • Disabling Introspection
    • Error Disclosure
    • Resource Exhaustion

      • Cost Theory
  4. Elixir Security
    • Atom Exhaustion
    • Protecting Sensitive Data
    • Untrusted Code
    • Timing Attacks
    • Boolean Coercion
  5. Cookie Security
    • Ingredients of a Cookie
    • The Perfect Cookie
    • Elixir Phoenix Cookies
  6. Security Anti-Patterns
    • Security Through Obscurity
    • Frontend Authorization Checks
  7. CI/CD Tooling
    • Sobelow

      • Salus
    • Semgrep
  8. The Secure Road
    • Service to Service Authentication
    • User Authorization
If you do not see a topic or lesson you would like covered, please review our open issues and our CONTRIBUTING Guide before opening a new issue - but we encourage requests!
Usage
For "Learners"
Using the ESCT as a consumer of the content is easy by just following these simple steps:
  1. Fork this repo into a space you control
    • Important to note: if you were instructed to use this course by your company, double check with the folks who are running things for your company to ensure they don't have a customized version of the training materials
  2. Clone your forked repo
  3. Load the Live Markdown files in an instance of Livebook
    • For further instructions on getting Livebook setup locally, please refer to their documentation.
  4. Complete the training as instructed and save your progress along the way!
  5. Feedback will be provided directly within Livebook via the "Graded Cell" smart cell
For "Educators"
Using the ESCT as a purveyor of the curriculum is relatively straight-forward:
  1. Determine if you need to customize the content to better suit your business - whether that's changing the contents to reflect internal only information or if you simply want to remove modules your engineers won't find useful.

    • If you determine that you wish to customize the content, fork the repository into your companies VCS with the necessary adjustments made.
    • In the future, there may need to be additional configuration steps regarding establishing configuration secrets for reporting purposes - at which you would also do that at this time.
  2. Instruct your workforce to follow the "Learners" instructions above using whichever version of the ESCT you would rather them use
Contributing
Please refer to our CONTRIBUTING Guide for more details on how to add to this project!
Sponsors
In addition to our contributors, this library receives support and maintenance from TV Labs
TV Labs Logo
License
GitHub
About
An interactive cybersecurity curriculum designed for enterprise use at software companies using Elixir
Topics
education-wgelixirelixir-langelixir-phoenixlivebooksalussecuritysecurity-educationsecurity-wgsobelow
Resources
Readme
MIT license
Code of conduct
Code of conduct
Contributing
Contributing
Security policy
Security policy
Activity
Custom properties
Stars
729 stars
Watchers
15 watching
Forks
172 forks
Report repository
Sponsor this project
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Repository files navigation
Elixir Secure Coding Training
Elixir Secure Coding Training (ESCT)
Run in Livebook
EEF Security WG projectEEF Education WG projectGitHub contributorsGitHub last commitGitHub issues by-labelGitHub pull requests by-label
An all-encompassing, opinionated cybersecurity curriculum designed for enterprise use at software companies using the Elixir programming language.
About |
Curriculum |
Usage |
Contributing |
License
About
Originally developed for Podium's Elixir engineers by its Product Security team, the ESCT was designed to be integrated into developer onboarding processes - teaching developers about Application Security using context that applies to them.
The content originally focused exclusively on what technology Podium uses, but quickly grew to encapsulate more areas of Application Security. The material itself is composed of views from the Product Security team at Podium as well as information sourced from reputable public information - attribution has been given wherever possible.
Today, individuals or companies wishing to try out the ESCT can and are encouraged to fork a copy of their own - please follow the relevant instructions below depending on your use case.
If you find an issue, wish to suggest an idea, or start a discussion; please see our CONTRIBUTING Guide!
Curriculum
Currently the curriculum is broken into the following 8 primary topics, each containing multiple lessons:
  1. OWASP
    • OWASP Top 10
  2. Secure SDLC
    • No Secrets In Code
    • Making Secret Rotation Easy
    • Rate Limiting
    • Principle of Least Privilege
  3. GraphQL Security
    • Disabling Introspection
    • Error Disclosure
    • Resource Exhaustion

      • Cost Theory
  4. Elixir Security
    • Atom Exhaustion
    • Protecting Sensitive Data
    • Untrusted Code
    • Timing Attacks
    • Boolean Coercion
  5. Cookie Security
    • Ingredients of a Cookie
    • The Perfect Cookie
    • Elixir Phoenix Cookies
  6. Security Anti-Patterns
    • Security Through Obscurity
    • Frontend Authorization Checks
  7. CI/CD Tooling
    • Sobelow

      • Salus
    • Semgrep
  8. The Secure Road
    • Service to Service Authentication
    • User Authorization
If you do not see a topic or lesson you would like covered, please review our open issues and our CONTRIBUTING Guide before opening a new issue - but we encourage requests!
Usage
For "Learners"
Using the ESCT as a consumer of the content is easy by just following these simple steps:
  1. Fork this repo into a space you control
    • Important to note: if you were instructed to use this course by your company, double check with the folks who are running things for your company to ensure they don't have a customized version of the training materials
  2. Clone your forked repo
  3. Load the Live Markdown files in an instance of Livebook
    • For further instructions on getting Livebook setup locally, please refer to their documentation.
  4. Complete the training as instructed and save your progress along the way!
  5. Feedback will be provided directly within Livebook via the "Graded Cell" smart cell
For "Educators"
Using the ESCT as a purveyor of the curriculum is relatively straight-forward:
  1. Determine if you need to customize the content to better suit your business - whether that's changing the contents to reflect internal only information or if you simply want to remove modules your engineers won't find useful.

    • If you determine that you wish to customize the content, fork the repository into your companies VCS with the necessary adjustments made.
    • In the future, there may need to be additional configuration steps regarding establishing configuration secrets for reporting purposes - at which you would also do that at this time.
  2. Instruct your workforce to follow the "Learners" instructions above using whichever version of the ESCT you would rather them use
Contributing
Please refer to our CONTRIBUTING Guide for more details on how to add to this project!
Sponsors
In addition to our contributors, this library receives support and maintenance from TV Labs
TV Labs Logo
License
GitHub
About
An interactive cybersecurity curriculum designed for enterprise use at software companies using Elixir
Topics
education-wgelixirelixir-langelixir-phoenixlivebooksalussecuritysecurity-educationsecurity-wgsobelow
Resources
Readme
MIT license
Code of conduct
Code of conduct
Contributing
Contributing
Security policy
Security policy
Activity
Custom properties
Stars
729 stars
Watchers
15 watching
Forks
172 forks
Report repository
Sponsor this project
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Repository files navigation
Elixir Secure Coding Training
Elixir Secure Coding Training (ESCT)
Run in Livebook
EEF Security WG projectEEF Education WG projectGitHub contributorsGitHub last commitGitHub issues by-labelGitHub pull requests by-label
An all-encompassing, opinionated cybersecurity curriculum designed for enterprise use at software companies using the Elixir programming language.
About |
Curriculum |
Usage |
Contributing |
License
About
Originally developed for Podium's Elixir engineers by its Product Security team, the ESCT was designed to be integrated into developer onboarding processes - teaching developers about Application Security using context that applies to them.
The content originally focused exclusively on what technology Podium uses, but quickly grew to encapsulate more areas of Application Security. The material itself is composed of views from the Product Security team at Podium as well as information sourced from reputable public information - attribution has been given wherever possible.
Today, individuals or companies wishing to try out the ESCT can and are encouraged to fork a copy of their own - please follow the relevant instructions below depending on your use case.
If you find an issue, wish to suggest an idea, or start a discussion; please see our CONTRIBUTING Guide!
Curriculum
Currently the curriculum is broken into the following 8 primary topics, each containing multiple lessons:
  1. OWASP
    • OWASP Top 10
  2. Secure SDLC
    • No Secrets In Code
    • Making Secret Rotation Easy
    • Rate Limiting
    • Principle of Least Privilege
  3. GraphQL Security
    • Disabling Introspection
    • Error Disclosure
    • Resource Exhaustion

      • Cost Theory
  4. Elixir Security
    • Atom Exhaustion
    • Protecting Sensitive Data
    • Untrusted Code
    • Timing Attacks
    • Boolean Coercion
  5. Cookie Security
    • Ingredients of a Cookie
    • The Perfect Cookie
    • Elixir Phoenix Cookies
  6. Security Anti-Patterns
    • Security Through Obscurity
    • Frontend Authorization Checks
  7. CI/CD Tooling
    • Sobelow

      • Salus
    • Semgrep
  8. The Secure Road
    • Service to Service Authentication
    • User Authorization
If you do not see a topic or lesson you would like covered, please review our open issues and our CONTRIBUTING Guide before opening a new issue - but we encourage requests!
Usage
For "Learners"
Using the ESCT as a consumer of the content is easy by just following these simple steps:
  1. Fork this repo into a space you control
    • Important to note: if you were instructed to use this course by your company, double check with the folks who are running things for your company to ensure they don't have a customized version of the training materials
  2. Clone your forked repo
  3. Load the Live Markdown files in an instance of Livebook
    • For further instructions on getting Livebook setup locally, please refer to their documentation.
  4. Complete the training as instructed and save your progress along the way!
  5. Feedback will be provided directly within Livebook via the "Graded Cell" smart cell
For "Educators"
Using the ESCT as a purveyor of the curriculum is relatively straight-forward:
  1. Determine if you need to customize the content to better suit your business - whether that's changing the contents to reflect internal only information or if you simply want to remove modules your engineers won't find useful.

    • If you determine that you wish to customize the content, fork the repository into your companies VCS with the necessary adjustments made.
    • In the future, there may need to be additional configuration steps regarding establishing configuration secrets for reporting purposes - at which you would also do that at this time.
  2. Instruct your workforce to follow the "Learners" instructions above using whichever version of the ESCT you would rather them use
Contributing
Please refer to our CONTRIBUTING Guide for more details on how to add to this project!
Sponsors
In addition to our contributors, this library receives support and maintenance from TV Labs
TV Labs Logo
License
GitHub
About
An interactive cybersecurity curriculum designed for enterprise use at software companies using Elixir
Topics
education-wgelixirelixir-langelixir-phoenixlivebooksalussecuritysecurity-educationsecurity-wgsobelow
Resources
Readme
MIT license
Code of conduct
Code of conduct
Contributing
Contributing
Security policy
Security policy
Activity
Custom properties
Stars
729 stars
Watchers
15 watching
Forks
172 forks
Report repository
Sponsor this project
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
BranchesTags
Repository files navigation
Elixir Secure Coding Training
Elixir Secure Coding Training (ESCT)
Run in Livebook
EEF Security WG projectEEF Education WG projectGitHub contributorsGitHub last commitGitHub issues by-labelGitHub pull requests by-label
An all-encompassing, opinionated cybersecurity curriculum designed for enterprise use at software companies using the Elixir programming language.
About |
Curriculum |
Usage |
Contributing |
License
About
Originally developed for Podium's Elixir engineers by its Product Security team, the ESCT was designed to be integrated into developer onboarding processes - teaching developers about Application Security using context that applies to them.
The content originally focused exclusively on what technology Podium uses, but quickly grew to encapsulate more areas of Application Security. The material itself is composed of views from the Product Security team at Podium as well as information sourced from reputable public information - attribution has been given wherever possible.
Today, individuals or companies wishing to try out the ESCT can and are encouraged to fork a copy of their own - please follow the relevant instructions below depending on your use case.
If you find an issue, wish to suggest an idea, or start a discussion; please see our CONTRIBUTING Guide!
Curriculum
Currently the curriculum is broken into the following 8 primary topics, each containing multiple lessons:
  1. OWASP
    • OWASP Top 10
  2. Secure SDLC
    • No Secrets In Code
    • Making Secret Rotation Easy
    • Rate Limiting
    • Principle of Least Privilege
  3. GraphQL Security
    • Disabling Introspection
    • Error Disclosure
    • Resource Exhaustion

      • Cost Theory
  4. Elixir Security
    • Atom Exhaustion
    • Protecting Sensitive Data
    • Untrusted Code
    • Timing Attacks
    • Boolean Coercion
  5. Cookie Security
    • Ingredients of a Cookie
    • The Perfect Cookie
    • Elixir Phoenix Cookies
  6. Security Anti-Patterns
    • Security Through Obscurity
    • Frontend Authorization Checks
  7. CI/CD Tooling
    • Sobelow

      • Salus
    • Semgrep
  8. The Secure Road
    • Service to Service Authentication
    • User Authorization
If you do not see a topic or lesson you would like covered, please review our open issues and our CONTRIBUTING Guide before opening a new issue - but we encourage requests!
Usage
For "Learners"
Using the ESCT as a consumer of the content is easy by just following these simple steps:
  1. Fork this repo into a space you control
    • Important to note: if you were instructed to use this course by your company, double check with the folks who are running things for your company to ensure they don't have a customized version of the training materials
  2. Clone your forked repo
  3. Load the Live Markdown files in an instance of Livebook
    • For further instructions on getting Livebook setup locally, please refer to their documentation.
  4. Complete the training as instructed and save your progress along the way!
  5. Feedback will be provided directly within Livebook via the "Graded Cell" smart cell
For "Educators"
Using the ESCT as a purveyor of the curriculum is relatively straight-forward:
  1. Determine if you need to customize the content to better suit your business - whether that's changing the contents to reflect internal only information or if you simply want to remove modules your engineers won't find useful.

    • If you determine that you wish to customize the content, fork the repository into your companies VCS with the necessary adjustments made.
    • In the future, there may need to be additional configuration steps regarding establishing configuration secrets for reporting purposes - at which you would also do that at this time.
  2. Instruct your workforce to follow the "Learners" instructions above using whichever version of the ESCT you would rather them use
Contributing
Please refer to our CONTRIBUTING Guide for more details on how to add to this project!
Sponsors
In addition to our contributors, this library receives support and maintenance from TV Labs
TV Labs Logo
License
GitHub
About
An interactive cybersecurity curriculum designed for enterprise use at software companies using Elixir
Topics
education-wgelixirelixir-langelixir-phoenixlivebooksalussecuritysecurity-educationsecurity-wgsobelow
Resources
Readme
MIT license
Code of conduct
Code of conduct
Contributing
Contributing
Security policy
Security policy
Activity
Custom properties
Stars
729 stars
Watchers
15 watching
Forks
172 forks
Report repository
Sponsor this project
Used by
Contributors
Languages