Interactive online training
A security vulnerability is a missing test. Learn how to find weaknesses, reproduce them as a red PHPUnit test, and secure them green. Directly from the creator of PHPUnit.
The idea
Security scanners deliver lists. This training delivers a habit: you treat every security requirement like every other functional requirement, as an executable test. The “flag” here is not proof of a break-in, but a green test that prevents all future break-ins of the same kind.
You work in a deliberately vulnerable, realistic PHP application. The vulnerabilities look like real development mistakes: forgotten escaping, string concatenation in SQL, a missing authorisation check. No framework hides them.
The cycle
Every vulnerability becomes a “station”. At each station you go through the same three-step cycle: the pattern that stays with you in your daily work afterwards.
Find and exploit the vulnerability by hand, to really understand the attack vector.
Express the security requirement as a PHPUnit test. Against the vulnerable code it is red.
phpunit → FAILEDChange the code until the test is green. It stays as regression protection.
phpunit → OKWho it is for
Your trainer
Sebastian is the creator of PHPUnit, the de facto standard for testing PHP code. As a consultant, trainer, and co-founder of thePHP.cc he has been helping teams build maintainable, well-tested software for more than two decades.
In this training he does not walk you through slides, but through real vulnerable code. You learn how an exploit becomes a test that stays.
Registration
Four interactive live sessions of two hours each, as a Zoom meeting. Small group, real code, your questions.