This lesson's interactive features are locked, please to keep using them

Why Web Security

As soon as your app is publicly reachable, automated bots can scan it for weaknesses. Even a small app can be a target. Just because you don't have many users doesn't mean data exposure is "something to worry about later." Security is non-negotiable, no matter your scale.

Click to play video

Most successful attacks exploit simple, sloppy mistakes:

Weak authentication
Insecure defaults
Forgotten debug routes
Outdated dependencies

Good web security is about recognizing these common attack paths and closing them.

Bearly Secure

In this course, you'll work on Bearly Secure, a deliberately vulnerable TypeScript web app. It's an online plushie shop with login, sessions, product search, checkout, and a frankly irresponsible number of security issues. Your job is to gradually harden it throughout this course.

Use a Chromium- or Firefox-based browser for this course. Some Bearly Secure exercises don't work reliably in WebKit-based browsers (looking at you, Safari).

Assignment

Clone the starter project and get it running locally.

Install Node.js 24 or newer (if you don't have it installed already).
Run node --version in your terminal and confirm the major version is 24 or newer.

Clone the Bearly Secure starter repo.

git clone https://github.com/bootdotdev/learn-web-security-typescript-starter
cd learn-web-security-typescript-starter

Install the dependencies, seed the database with starter data, and start the server:
```
npm install
npm run db:reset
npm start
```
Visit the app in a web browser at http://localhost:3000 and poke around to make sure it's working.

With the app running, from a separate shell session, run and submit the CLI tests.