Build a Secure-Coding Linter Ruleset for a Backend Team
Overview
What this challenge is about.
Build a Secure-Coding Linter Ruleset for a Backend Team. Intermediate challenge in code. Writing production code that solves real engineering problems, earn ...
The Brief
What you'll do, and what you'll demonstrate.
Risky code patterns that auditors keep catching slip through code review and reach production, so the team needs them detected automatically before a pull request merges.
This is not a coding exercise. It is the work a software engineer does between a Jira ticket and a merged PR. That distinction matters to every hiring manager who has seen candidates solve LeetCode problems and none who have shipped production code under real constraints.
When you finish, you will have something most graduates do not: a real-world deliverable, verified by Ewance, that you can show to a hiring manager and say "I did this. Here is the proof."
Earning criteria — what you'll demonstrate
- Translate recurring real-world security findings into precise, low-noise static-analysis rules
- Measure and tune a ruleset's false-positive rate against known-vulnerable code
- Integrate a security gate into an automated pull-request workflow without blocking legitimate changes
- Map detected weaknesses to OWASP Top 10 categories so findings are explainable to engineers
- Document a security tool so a team can own and extend it independently
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Secure Coding
Apply secure coding to solve real industry problems and demonstrate production-level capability.
- Static Analysis
Apply static analysis to solve real industry problems and demonstrate production-level capability.
- Semgrep
Apply semgrep to solve real industry problems and demonstrate production-level capability.
- Ci Cd
Apply ci cd to solve real industry problems and demonstrate production-level capability.
- Owasp Top 10
Apply owasp top 10 to solve real industry problems and demonstrate production-level capability.
- Documentation
Apply documentation to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
Application Security Engineer
This challenge mirrors core AppSec work: turning audit findings into automated detections and embedding them in developer workflow. You leave with a defensible, low-noise ruleset and a CI gate — the exact artifacts hiring teams probe for in security-tooling interviews.
This challenge sharpens
- secure-coding
- static-analysis
- semgrep
DevSecOps Engineer
Wiring a security check into pull-request automation without slowing engineers is the heart of DevSecOps. You practice balancing gate strictness against false positives and shipping a tool a team can own, bridging security knowledge with continuous-integration plumbing.
This challenge sharpens
- ci-cd
- static-analysis
- documentation
Product Security Lead
Leads must reduce recurring risk classes, not just patch single bugs. By mapping repeat findings to OWASP categories and writing an adoption playbook, you demonstrate the systems thinking and communication a security lead uses to scale practices across an engineering org.
This challenge sharpens
- owasp-top-10
- secure-coding
- documentation