For a long time, web application security remained a field where in-depth code audits required expensive pentesting specialists. But with the development of agent-based AI, the situation is changing.
A recent example is a study by Mozilla, in which Claude analyzed the JavaScript runtime of Firefox and discovered over 100 vulnerabilities, including 14 severe enough to receive a CVE. This approach can now also be applied to your own Python web applications.
This course shows how to systematically search for and eliminate vulnerabilities in Python applications using the OWASP Top 10 2025 and agent-based AI. First, you will thoroughly examine all ten OWASP categories with real vulnerable and corrected examples for Flask, Django, and FastAPI. Then, you will create your own AI agent, Security Lead, based on Claude Code, specifically tailored for auditing Python and SaaS applications.
In the final part, the agent will be applied to three real open-source projects — Apache Superset, Paperless-ngx, and Kibitzr. You will see a complete audit process: from finding potential issues to analyzing discovered vulnerabilities, fixing them, and forming a prioritized task list.
What Makes This Course Special
- Up-to-date OWASP Top 10 2025 — analysis of the new version of the standard, including the newly introduced category of Mishandling of Exceptional Conditions.
- Your own AI auditing agent — you will create a Security Lead that you can use in future projects.
- Real open-source audits — analysis of Apache Superset, Paperless-ngx, and Kibitzr is conducted directly on real codebases.
- Vulnerable and corrected code — for each category, you will see what the problem looks like, why it is dangerous, and how to correctly fix it.
- Flask, Django, and FastAPI — the same classes of vulnerabilities are considered using examples from three popular Python frameworks.
- Focus on SaaS and multi-tenancy — special attention is paid to IDOR, user data isolation, and preventing tenant data leaks.
- Agentic AI instead of "vibe coding" — you will learn to use an AI agent as a systematic security assistant rather than just asking it to "find bugs".
- Cost control — explores how much auditing a large codebase might cost and how to make expenses predictable.
- Modern Python security toolbox — Argon2, MultiFernet, slowapi, loguru, pip-audit, Have I Been Pwned, and other tools.
- Responsible use of AI — you will learn how to correctly use AI audits and why you should not automatically send low-quality AI-generated PRs to open-source project developers.
What You Will Learn
After completing the course, you will be able to:
- find and fix all categories of OWASP Top 10 2025 vulnerabilities in Python web applications;
- identify Broken Access Control, including IDOR, path traversal, and lack of function-level access checks;
- safely configure Docker Compose, Django, and HTTP security headers;
- protect Python dependencies from supply chain attacks using
uv pip compileandpip-audit; - integrate dependency checks into CI/CD and Docker builds;
- use Argon2 instead of weak password hashing algorithms;
- safely rotate encryption keys using MultiFernet without application downtime;
- protect against SQL injection, NoSQL injection, and stored XSS;
- use parameterized queries and proper template escaping;
- apply server-side validation with Pydantic;
- implement rate limiting and protection against account enumeration;
- create secure password policies with checking compromised passwords through Have I Been Pwned;
- build a secure password reset flow without user enumeration;
- prevent mass-assignment attacks with strict serialization;
- safely work with third-party JavaScript and CSS dependencies;
- implement structured security audit logging;
- set up automatic alerts for suspicious activity;
- correctly handle exceptions without revealing internal application details to the user;
- use SQLAlchemy transaction context managers to prevent partially executed operations;
- audit multi-tenant SaaS applications for data leaks between users;
- create your own Claude Code agents tailored to a specific stack and threat model;
- connect official OWASP materials to the AI agent so it relies on verified sources;
- conduct a full agentic security audit of any Python codebase;
- turn audit results into a prioritized fix plan;
- use AI to fix vulnerabilities while maintaining a clear audit trail;
- evaluate and control the cost of AI audits.
Course Program
Introduction and Tool Setup
Get acquainted with the course structure, install Claude Code and VS Code, set up the necessary tools, and prepare the source code for practical tasks.
OWASP #1 — Broken Access Control
Discussion of IDOR, path traversal, and missing function-level access checks. Practical examples are explored in FastAPI, Flask, and Django.
OWASP #2 — Security Misconfiguration
Setup of Docker Compose, Django settings, and HTTP security headers, including HSTS, X-Frame-Options, and Content Security Policy.
OWASP #3 — Software Supply Chain Failures
Protection of Python dependencies using uv pip compile, preventing installation of potentially compromised packages, and integration of pip-audit into CI and Docker builds.
OWASP #4 — Cryptographic Failures
Transition from fast and insecure hashing algorithms to Argon2, secure secret storage, and encryption key rotation using MultiFernet.
OWASP #5 — Injection
Protection against SQL injection, NoSQL injection in MongoDB/PyMongo, and stored XSS in Jinja templates. Learn how to use parameterized queries and proper data escaping.
OWASP #6 — Insecure Design
Implementation of rate limiting and account blocking using slowapi. Server-side business rule validation with Pydantic is discussed separately.
OWASP #7 — Authentication Failures
Creation of a robust password policy, checking compromised passwords, protection against account enumeration, and secure implementation of a password reset without determining account existence.
OWASP #8 — Software or Data Integrity Failures
Protection against mass-assignment attacks, strict configuration of serializer fields, and preference for hosting JavaScript and CSS on owned infrastructure over unreliable external CDNs.
OWASP #9 — Logging and Alerting Failures
Creation of structured security audit logging using loguru and setting up alerts for credential stuffing and other suspicious activities.
OWASP #10 — Mishandling of Exceptional Conditions
Secure error handling: return minimal information to the user, while full context is stored on the server with a traceable reference ID. Also discusses using SQLAlchemy transaction context managers to prevent partially executed operations.
Creating Security Lead — Security AI Agent
In the second part of the course, you will create a complete Security Lead — a specialized Claude Code agent of about 550 lines, configured for auditing Python and SaaS applications.
The agent will be capable of:
- conducting OWASP-focused audits;
- checking user data isolation;
- analyzing authentication and authorization;
- verifying security logging;
- generating a structured report;
- referencing canonical OWASP sources;
- highlighting the most critical issues;
- helping turn analysis results into a concrete fix plan.
The main idea is not to just run AI on a project once, but to create a repeatable security process that can be applied to every new codebase.
Practical Audits of Real Projects
After creating the Security Lead agent, it will be tested on three real open-source applications.
Kibitzr
Audit of an older Python tool for website monitoring. The analysis examines real issues, including the potential for invisible SMTP TLS downgrade, unlimited HTTP response size, and lack of timeout protection.
Apache Superset
Full-scale audit of the large Apache project. Security Lead analyzes the security of JWT guest tokens, logging of failed login attempts, and handling of CSV exports.
Paperless-ngx
Audit of a popular document management system. The analysis discovers an issue with an unsigned pickle in Redis cache, followed by fixing it using the existing security mechanisms of the project.
Who This Course Is For
The course is suitable for:
- Python developers creating production applications in Flask, Django, or FastAPI;
- SaaS founders and indie hackers needing to securely isolate data between different users;
- Senior developers and Tech Leads who need a systematic approach to security review;
- developers of legacy Python applications that haven't undergone a full-scale security audit in a long time;
- professionals who need to document security practices for compliance processes;
- developers already actively using AI tools wanting to apply them not only for coding but also for professional security review.
Conclusion
The course combines two important areas: practical security of Python web applications and agent-based artificial intelligence.
You will not only study the OWASP Top 10 as a theoretical list of vulnerabilities. You will learn to find real problems in the code, understand the attack mechanism, apply safe fixes, and automate a significant portion of the process using your own AI agent.
As a result, you will have not only an understanding of modern threats to Python applications but also a ready-made Security Lead that can be used for regular audits of your own projects and codebases.
