Intermediate6 min read
Testing Spring Security
Writing security tests that catch real gaps: @WithMockUser and @WithUserDetails, MockMvc request post-processors, testing method security, mock JWTs, and the negative tests that matter.
Read tutorialSpring Security · Phase 4
Security Testing & DevSecOps
Proving the controls work and keeping them working: spring-security-test, penetration testing methodology, pipeline security gates, threat modelling and secrets management.
Advanced6 min read
Penetration Testing for Java Apps
A structured approach to testing your own application: reconnaissance, authentication and authorisation testing, injection, business logic flaws, and the tools that help.
Read tutorialAdvanced5 min read
DevSecOps — Securing the Pipeline
Security gates that catch real problems without blocking delivery: pre-commit secret scanning, SAST with FindSecBugs, dependency and container scanning, DAST, and tuning out the noise.
Read tutorialAdvanced6 min read
Threat Modelling
Finding design flaws before they ship: drawing data flow diagrams, applying STRIDE per element, prioritising with DREAD, and running a session that produces actionable work.
Read tutorialIntermediate5 min read
Secrets Management & Key Security
Getting secrets out of configuration: taking an inventory, Vault KV and dynamic database credentials, Kubernetes auth, the External Secrets Operator, and rotation that works.
Read tutorial