Learn the attacks. Defend your code.

Free interactive secure code lessons covering the OWASP Top 10 and emerging AI vulnerabilities. Learn how to prevent SQL injection, prompt injection, cross-site scripting, and more real world attacks. Expert-written, 15-30 minutes each.

Free Lessons

Start with the fundamentals

Master the most common vulnerabilities—from OWASP classics to AI-era threats like prompt injection. Each lesson takes 15-30 minutes.

[SQL Injection

Exploit database queries to access or manipulate data.

15 min](/content/lessons/sql-injection/index.html) [AI: Prompt Injection

Manipulate AI systems by injecting malicious instructions.

20 min](/content/lessons/ai-prompt-injection/index.html) [Cross-Site Scripting

Inject malicious scripts into trusted websites.

20 min](/content/lessons/xss-stored/index.html) [Broken Authentication

Exploit flaws in login systems and session management.

25 min](/content/lessons/weak-session/index.html) [CSRF

Force users to execute unwanted actions on authenticated sites.

20 min](/content/lessons/csrf/index.html) [Path Traversal

Read files outside intended directories on the server.

18 min](/content/lessons/directory-traversal/index.html) [Command Injection

Execute arbitrary commands on the host operating system.

22 min](/content/lessons/command-execution/index.html) [Broken Access Control

Bypass authorization checks to access restricted resources.

20 min](/content/lessons/broken-access-control/index.html)

Why Hacksplaining

Secure software lessons that stick

Meet the players. Learn the game.

Every lesson features memorable characters with real motivations. Understand how attackers think, who they target, and why.

The Savant

The Cowboy

The Hacker

The Specialist

The Mark

We speak your language.

Python, JavaScript, Java, Go, and more. Every lesson includes vulnerable and secure code examples you can apply directly.

# Vulnerable
query = f"SELECT * FROM users WHERE id='{user_id}''

# Secure
cursor.execute(
  "SELECT * FROM users WHERE id = %s",
  (user_id,)
)

// Vulnerable
const query = `SELECT * FROM users WHERE id='${userId}'`;

// Secure
db.query(
  'SELECT * FROM users WHERE id = $1',
  [userId]
);

// Vulnerable
String query = "SELECT * FROM users WHERE id='" + userId + "'";

// Secure
PreparedStatement stmt = conn.prepareStatement(
  "SELECT * FROM users WHERE id = ?"
);
stmt.setString(1, userId);

// Vulnerable
query := fmt.Sprintf("SELECT * FROM users WHERE id='%s'", userID)

// Secure
db.Query(
  "SELECT * FROM users WHERE id = $1",
  userID,
)

Byte-sized, not watered down.

Each lesson takes 15-30 minutes. Learn on your lunch break, between meetings, or with your morning coffee. No hour-long lectures.

Test yourself. Track progress.

Short quizzes after each lesson reinforce what you've learned. Track your progress across all 45 lessons.

FAQ

Common questions

Are the lessons really free?

Yes. Hacksplaining is free for personal use. Team features like dashboards, progress tracking, and compliance reports are paid.

Who (or what) writes your content?

Hacksplaining's founder, an industry veteran and 2x published author with over 10 years teaching secure coding. All lessons are human expert-written, not AI-generated.

Do I need specific secure coding experience?

No. If you can write basic code, you can learn with Hacksplaining. We start from first principles and build up.

How long does each lesson take?

Most lessons take about 20 minutes. They're designed to fit into a lunch break or between meetings.

Ready to ship secure code?

Start with any lesson. Free for personal use. No credit card, no commitment, no catch.