Build a Secure-Coding Linter Ruleset for a Backend Team
Overview
What this challenge is about.
Build a custom linter ruleset to detect security patterns, validate it against real code, and earn a verifiable certificate.
The scenario
The company runs multi-tenant accounting software where one tenant's data leaking into another's is an existential risk, and its backend is Node.js with TypeScript. Repeat security findings cost it real money in re-audits and erode trust with the businesses that rely on it.
The Brief
What you'll do, and what you'll demonstrate.
Risky code patterns that auditors keep catching slip through code review and reach production, so the team needs them detected automatically before a pull request merges.
Earning criteria — what you'll demonstrate
- Translate recurring real-world security findings into precise, low-noise static-analysis rules
- Measure and tune a ruleset's false-positive rate against known-vulnerable code
- Integrate a security gate into an automated pull-request workflow without blocking legitimate changes
- Map detected weaknesses to OWASP Top 10 categories so findings are explainable to engineers
- Document a security tool so a team can own and extend it independently
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Secure Coding
Apply secure coding to solve real industry problems and demonstrate production-level capability.
- Static Analysis
Apply static analysis to solve real industry problems and demonstrate production-level capability.
- Semgrep
Apply semgrep to solve real industry problems and demonstrate production-level capability.
- Ci Cd
Apply ci cd to solve real industry problems and demonstrate production-level capability.
- Owasp Top 10
Apply owasp top 10 to solve real industry problems and demonstrate production-level capability.
- Documentation
Apply documentation to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
Application Security Engineer
This challenge mirrors core AppSec work: turning audit findings into automated detections and embedding them in developer workflow. You leave with a defensible, low-noise ruleset and a CI gate — the exact artifacts hiring teams probe for in security-tooling interviews.
This challenge sharpens
- secure-coding
- static-analysis
- semgrep
DevSecOps Engineer
Wiring a security check into pull-request automation without slowing engineers is the heart of DevSecOps. You practice balancing gate strictness against false positives and shipping a tool a team can own, bridging security knowledge with continuous-integration plumbing.
This challenge sharpens
- ci-cd
- static-analysis
- documentation
Product Security Lead
Leads must reduce recurring risk classes, not just patch single bugs. By mapping repeat findings to OWASP categories and writing an adoption playbook, you demonstrate the systems thinking and communication a security lead uses to scale practices across an engineering org.
This challenge sharpens
- owasp-top-10
- secure-coding
- documentation