Whetstone

Web Security

The attacks a web app actually meets and the defences that stop them: XSS and what React does and doesn't escape, Content-Security-Policy with nonces, CSRF with SameSite cookies and origin checks, keeping secrets out of the client bundle and out of git, the security headers worth sending, and the OWASP Top 10 (2025) as reference cards.

  1. 1. XSS: when your page runs someone else's script

    Full · Core · ~40 min
    • React
    • XSS

  2. 2. Content-Security-Policy: the browser-enforced second line

    Full · Advanced · ~40 min
    • Next.js
    • XSS
    • Content-Security-Policy

  3. 3. CSRF, SameSite cookies and where the session lives

    Full · Core · ~40 min
    • Next.js
    • CSRF
    • Cookies

  4. 4. Secrets & config: what must never reach the browser or git

    Lesson · Core · ~30 min
    • Next.js
    • Secrets & Config

  5. 5. Security headers worth sending

    Card · Core · ~10 min
    • Security Headers

  6. 6. OWASP Top 10:2025 in a TypeScript stack

    Card · Core · ~15 min
    • OWASP Top 10