How to Secure Your Apps
A hands-on series that takes one real app from threat model to live detection to fixed code. Watch each episode, then follow the full written tutorial below it — every command, every step.
The episodes
Follow them in order — each builds on the last.
EP 16 min1. Threat-model your login
Before you write a single detection, find every way in — a free, local audit of your authentication, grounded in your real code.
- What a threat model is, in plain words
- Run one on your own app with a single command
- Read the two reports it produces — code findings + runtime detections
- Why the whole audit is local and free
EP 213 min2. Plug SecureNow in
Your app is blind — it can't see the attacks in its own traffic. In a few minutes we give it traces, logs, and a firewall, then hand that visibility to your AI agent.
- Install and connect SecureNow with no code changes
- See every request — method, path, body, status — as traces
- Turn on the firewall and watch it answer bad traffic
- Add the optional bridge for auth-aware detection and session revocation
EP 314 min3. Make it fire
The report already wrote the detections. Create them, keep them in test mode, then run a real attack and watch SecureNow catch every move — safely.
- Create a detection rule from the report's SQL
- Use test mode so nothing blocks while you tune
- Validate a rule against real + synthetic traffic
- Run a bounded attack and read the evidence in the dashboard
EP 413 min4. Fix the code
Detections catch an attacker; they don't fix the hole. Here your coding agent closes five real bugs — one commit, one test, one proof at a time.
- Why a detection is containment, not a fix
- Turn each threat-model finding into a prompt for your agent
- Close five real auth bugs with a test for each
- Prove every fix live against the running app
EP 511 min5. Authorization
Broken access control is the #1 risk on the web, and you can't test every endpoint × every role. So instead, we watch the decisions in production — and catch the ones that don't belong.
- Why authorization is impossible to test exhaustively
- Catch IDOR enumeration and sudden escalation from traffic alone
- Add one event for the precise detections traffic can't see
- Fix the code: export decisions, and close a role-change race
EP 65 min6. Catching IDOR
IDOR is the #1 API risk and the quietest bug there is — a single request looks like a normal 200. You can't catch one request, so you catch the shape of an attacker hunting for it.
- Why a single IDOR request is undetectable
- Catch scan, walk, and dump from the traffic alone
- Confirm the real breach with one event
- Fix it in one line — scope the read to the owner
Run it on your own app
Everything in this series works on your project today. Start the threat model, then plug SecureNow in.