This lesson's interactive features are locked, please to keep using them

Why Web Security

As soon as your app is publicly reachable, automated bots can scan it for weaknesses. Even a small app can be a target. Just because you don't have many users doesn't mean data exposure is "something to worry about later." Security is non-negotiable, no matter your scale.

Click to play video

Most successful attacks exploit simple, sloppy mistakes:

Weak authentication
Insecure defaults
Forgotten debug routes
Outdated dependencies

Good web security is about recognizing these common attack paths and closing them.

Bearly Secure

In this course, you'll work on Bearly Secure, a deliberately vulnerable Go web app. It's an online plushie shop with login, sessions, product search, checkout, and a frankly irresponsible number of security issues. Your job is to gradually harden it throughout this course.

Use a Chromium- or Firefox-based browser for this course. Some Bearly Secure exercises don't work reliably in WebKit-based browsers (looking at you, Safari).

Assignment

Clone the starter project and get it running locally.

Install Go 1.27.0 or newer if you don't have it installed already.
Run go version in your terminal and confirm the version is 1.27.0 or newer.

Clone the Bearly Secure Go starter repo.

git clone https://github.com/bootdotdev/learn-web-security-golang-starter.git
cd learn-web-security-golang-starter

Seed the database with starter data and start the server:
```
go run ./cmd/seed
go run ./cmd/server
```
Visit the app in a web browser at http://localhost:3030 and poke around to make sure it's working.

With Bearly Secure still running, run and submit the CLI tests from a separate terminal in the project root.