Teach developers first about the problems your own repositories actually produce. For most teams that means secrets handling, injection, broken access control and dependency risk. Use short labs on your own stack, and measure by what shows up in code review and scans afterward.
Start from your findings
Before writing a syllabus, look at the last six months of scanner results, pen test reports and incident notes. Count categories. The top three become your first three lessons. Generic training teaches ten topics your team rarely hits and skips the one it hits weekly.
A starting order
- Secrets. Why keys do not belong in code or in chat. How to use a secret manager. What to do within the hour after a leak: revoke, rotate, then clean history.
- Injection. SQL, command and template injection, shown in your framework with the safe pattern next to the unsafe one.
- Access control. Checks on every request, object level authorization, and why hiding a button is not a control.
- Dependencies. Reviewing a new package before adding it, reading an advisory, and when a vulnerable function is actually reachable from your code.
- Logging and errors. What not to log, and what an attacker learns from verbose errors.
- Review habits. What to look for in a pull request, and when to ask a champion.
Format that sticks
- 45 minute labs with a broken sample app they fix.
- One concept per session.
- Real examples from your own code, anonymized.
- A short follow up task in the next sprint.
What not to do
Do not run a day long lecture. Do not test with trivia. Do not shame the authors of old code.
Using tools as teachers
A scan result is a free teaching case. Pick a real finding, walk through why it matters, then fix it together. The free scan at https://gold.safeguard.sh/scan can generate a dependency report on a sample project in minutes, and reachability analysis helps show which findings matter in practice.
Measure change
- Repeat findings in the trained categories over the next quarter.
- Number of secrets caught pre commit.
- Review comments mentioning security.
- Time to fix a flagged dependency.
If numbers do not move, change the content, not the audience.
Where this connects to the rest
Our posts on role based training and champions programs cover who delivers and who owns this. This post covers what goes in the room.
Quick check
How long should secure coding training be?
Many teams do well with one 45 minute lab per topic, spread across a quarter, rather than a single long session.
Do we need a certified course?
Not to start. Labs built on your own stack are often more useful than a generic certificate course.
Last reviewed: 19 October 2026.
