Python Web Security: OWASP Top 10 with Agentic AI Course

Source: https://training.talkpython.fm/courses/agentic-ai-python-security

What will you learn about OWASP Top 10 and Python security?

By the end of this course, you’ll be able to:

• Recognize and fix all ten OWASP Top 10 2025 vulnerability categories in real Python web apps
• Diagnose broken access control vulnerabilities including IDOR, path traversal, and missing function-level access checks
• Configure Docker Compose, Django settings, and security headers to avoid the most common production misconfigurations
• Pin Python dependencies safely with uv pip compile and exclude-newer-than to defend against fresh supply chain attacks
• Run pip-audit in CI and Docker builds so a CVE never ships unnoticed
• Replace weak password hashing with Argon2 and rotate encryption keys with MultiFernet without downtime
• Defend against SQL, NoSQL, and stored XSS injection with parameterized queries and proper template escaping
• Apply server-side validation with Pydantic field validators so client-side checks can never be the only gate
• Enforce strong password policies including Have I Been Pwned breach checks and a top-10k common-passwords list
• Build a secure password reset flow with hashed tokens, short expirations, and no user enumeration
• Prevent mass-assignment attacks with strict serializer fields and read-only flags
• Vendor third-party JavaScript and CSS into your own infrastructure instead of trusting external CDNs
• Implement structured security audit logging with loguru and threshold-based alerts to Slack, PagerDuty, or Sentry
• Return safe, generic error responses to users while logging full context server-side with a traceable reference ID
• Use SQLAlchemy transaction context managers to prevent partial writes and money-disappearance bugs
• Audit multi-tenant SaaS applications for cross-tenant data leaks and identity isolation gaps
• Write a custom Claude Code agent persona definition tuned for your stack and threat model
• Wire OWASP markdown sources directly into your agent so it cites canonical references instead of hallucinating
• Run a complete agentic security audit on any Python codebase and turn the report into a prioritized fix list
• Apply fixes with AI assistance while keeping a clear audit trail of what changed, why, and how it was tested
• Estimate and control the cost of agentic security audits so they remain practical for routine use

It’s not my rip

Password: cms.ddpanda.org