# Snyk Learn

> Developer security training with 174 interactive lessons exploring vulnerabilities across languages and ecosystems.

Key facts:
- 118 security education lessons (OWASP Top 10, Snyk Top 10, NIST NICE aligned)
- 56 product training lessons on implementing and using Snyk
- 10 programming languages: Java, JavaScript, Python, Go, PHP, C++, C#, Rust, Ruby, Swift
- Additional topics: Kubernetes, AI/LLMs, general security

## Security Education

- [Agent goal hijack](https://learn.snyk.io/lesson/agent-goal-hijack/): In this lesson, we'll look at how agent goal hijack works and how to protect autonomous agents against it.

- [Agentic supply chain vulnerabilities](https://learn.snyk.io/lesson/agentic-supply-chain-vulnerabilities/): Learn how agentic supply chain vulnerabilities work and how to protect your agentic application against them.
- [Agentic tool misuse and exploitation](https://learn.snyk.io/lesson/agent-tool-misuse-and-exploitation/): In this lesson, we'll look at how tool misuse and exploitation happen in real-world agentic workflows and why traditional security controls often fail to detect them.
- [AI Agents: Securing Autonomous Workflows](https://learn.snyk.io/lesson/ai-agents-securing-autonomous-workflows/): Gain a thorough understanding of what AI agents are, how they are being integrated into the development process, and how to secure them.
- [AI App Development](https://learn.snyk.io/lesson/ai-app-development/): In this lesson, we walk through the steps of how to make an app using the Gemini CLI, and what vulnerabilities can be introduced even with a well-crafted prompt. 
- [AI in the Software Development Life Cycle (SDLC)](https://learn.snyk.io/lesson/ai-in-the-sdlc/): Learn how to integrate security natively into the SDLC in the age of AI assisted coding. 
- [API security misconfiguration (CWE-2)](https://learn.snyk.io/lesson/security-misconfiguration-api/): Learn how API security misconfiguration vulnerabilities manifest, how to protect your APIs, understand the risks, and see how to mitigate such threats.
- [Broken access control (CWE-862, CWE-1344, CWE-284, CWE-287, CWE-306, CWE-276, CWE-863)](https://learn.snyk.io/lesson/broken-access-control/): Learn how broken access control exploits work with a step-by-step tutorial, as well as how to mitigate and defend against them with access control settings.
- [Broken authentication (CWE-307)](https://learn.snyk.io/lesson/broken-authentication/): Learn about broken authentication and how it can compromise an API's security. We'll explore how attackers exploit these vulnerabilities and mitigation strategies.
- [Broken function level authorization (CWE-285)](https://learn.snyk.io/lesson/broken-function-level-authorization/): Learn how attackers exploit improperly secured API functions and how to protect your application from these vulnerabilities.
- [Broken object level authorization (CWE-639)](https://learn.snyk.io/lesson/broken-object-level-authorization/): Learn about broken object level authorization and how APIs tend to expose endpoints. We'll look at examples and mitigations of this vulnerability.
- [Broken object property level authorization (CWE-915)](https://learn.snyk.io/lesson/broken-object-property-level-authorization/): Learn how API misconfigurations can expose sensitive object properties, leading to unauthorized access or manipulation.
- [Cascading Failures](https://learn.snyk.io/lesson/cascading-failures/): Learn about cascading failures in agentic AI systems and how single faults propagate across agents, and how to design resilient systems that prevent system-wide impact.
- [Cleartext storage of sensitive information in a cookie (CWE-315, CWE-312, CWE-614)](https://learn.snyk.io/lesson/cleartext-sensitive-information-in-cookie/): Learn about the issues that arise when storing cleartext or plaintext sensitive information in a cookie as well as solutions to this vulnerability.
- [Code injection (CWE-95, CWE-94, CWE-93, CWE-90, CWE-92, CWE-77, CWE-78)](https://learn.snyk.io/lesson/malicious-code-injection/): Learn how to protect your applications against malicious code injection by exploiting a vulnerable web app as part of this Snyk Learn lesson.
- [Common Vulnerabilities and Exposures (CVE)](https://learn.snyk.io/lesson/cve/): In this lesson, we describe how the CVE program brings standardization and information sharing to the vulnerability management activities of cybersecurity teams.
- [Common vulnerability scoring system](https://learn.snyk.io/lesson/what-is-cvss/): Learn what CVSS scores mean, how they’re calculated, and how to use them to assess and prioritize security risks.
- [Common Weakness Enumerations](https://learn.snyk.io/lesson/what-is-a-cwe/): Learn what a CWE is, why it matters, and how it can help you write more secure code, triage issues faster, and understand your scanner results.
- [Compromise of legitimate package](https://learn.snyk.io/lesson/compromise-of-legitimate-package/): Understand how legitimate packages can be compromised and the safeguards that can protect your development and production environments.
- [Container does not drop all default capabilities](https://learn.snyk.io/lesson/container-does-not-drop-all-default-capabilities/): Learn how to improve Kubernetes security by dropping default capabilities for a container.
- [Container is running in privileged mode](https://learn.snyk.io/lesson/container-runs-in-privileged-mode/): Learn why using privileged mode on a container is a bad idea in almost all cases.
- [Cross site request forgery (CSRF) (CWE-352)](https://learn.snyk.io/lesson/csrf-attack/): Learn how a cross site request forgery (CSRF) attack works, and how to detect and fix it with real-world examples from security experts. 
- [Cross-origin resource sharing (CORS) (CWE-942)](https://learn.snyk.io/lesson/cross-origin-resource-sharing/): Learn the mechanics of CORS and how misconfiguration can lead to data exposure. Walk through an exploit scenario and learn how to implement a strict allowlist.
- [Cross-site scripting (XSS) (CWE-83, CWE-82, CWE-81, CWE-79, CWE-80)](https://learn.snyk.io/lesson/xss/): Learn about XSS and how to protect your code from various cross-site scripting (XSS) attacks.
- [Data and model poisoning](https://learn.snyk.io/lesson/training-data-poisoning/): Learn how your LLM can become insecure and unreliable with training data poisoning. We'll look at examples and mitigation techniques.
- [Denial of service](https://learn.snyk.io/lesson/llm-denial-of-service/): In this lesson, we'll look at how Denial of Service (DoS) attacks work, why they occur, and how to prevent them. We'll specifically be focusing on LLMs and OWAPS's LLM04.
- [Directory traversal (CWE-26, CWE-24, CWE-25, CWE-23, CWE-22)](https://learn.snyk.io/lesson/directory-traversal/): Learn how to protect your code from directory traversal in JavaScript by exploiting a vulnerable web server.
- [DOM XSS (CWE-79)](https://learn.snyk.io/lesson/dom-based-xss/): Learn how DOM based XSS exploits work, and how to mitigate and remediate the vulnerability with step-by-step interactive tutorials from security experts.
- [Double free (CWE-415)](https://learn.snyk.io/lesson/double-free/): Learn about the memory management flaw, double free, that occurs when a program releases the same memory block twice. Learn to mitigate and remediate the vulnerability.
- [Error messages containing sensitive information (CWE-209)](https://learn.snyk.io/lesson/error-message-with-sensitive-information/): Learn about the dangers of generating error messages that contain sensitive information. Learn to mitigate and fix this vulnerability from security experts.
- [Excessive agency](https://learn.snyk.io/lesson/excessive-agency/): Learn about excessive agency (LLM08), in the OWASP Top 10 for LLM applications. We'll look at what it is, how it works, and how to mitigate it.
- [Expression Language injection (ELI) (CWE-917)](https://learn.snyk.io/lesson/express-language-injection/): Learn how Expression Language injection (ELI) works and how to protect your applications against it with real-world examples from security experts.
- [False negatives and false positives](https://learn.snyk.io/lesson/false-negatives-and-false-positives/): Understand what the meaning of false negatives and positives are in cyber security, how they pose major risks to an organization, and how to mitigate them as a developer.
- [Generation of predictable numbers or identifiers (CWE-343, CWE-340)](https://learn.snyk.io/lesson/generation-of-predictable-numbers-or-identifiers/): In this lesson we will discuss the necessity of true random number generation, and what potential consequences can arise when these values become predictable.
- [Getting Started with AI Development](https://learn.snyk.io/lesson/getting-started-with-ai-development/): Get a general overview of what AI development is, what it might look like in action, and how to use it responsibly. 
- [Hardcoded secrets (CWE-798, CWE-259, CWE-547)](https://learn.snyk.io/lesson/hardcoded-secrets/): Discover why hardcoding secrets in your code is dangerous and how to keep your API keys, tokens, and passwords truly secret.
- [Hidden functionality (CWE-912)](https://learn.snyk.io/lesson/hidden-functionality/): In this lesson, we'll examine hidden functionality and discuss how to mitigate and remediate this vulnerability with real-world examples. 
- [Human-agent trust exploitation](https://learn.snyk.io/lesson/human-agent-trust-exploitation/): Learn about Human-agent trust exploitation, how attackers abuse human trust in AI agents, and how to design systems that prevent over-reliance and social engineering.
- [Identity and privilege abuse](https://learn.snyk.io/lesson/agentic-identity-and-privilege-abuse/): In this lesson, you will learn how identity and privilege abuse vulnerabilities arise in agentic applications, and how to protect your systems from such attacks.
- [Immature software](https://learn.snyk.io/lesson/immature-software/): Learn about immature software in open-source projects, its associated risks, and how to mitigate issues with best practices and thorough evaluation.
- [Improper input validation (CWE-20)](https://learn.snyk.io/lesson/improper-input-validation/): Learn about the dangers of improper input validation and why you should never trust user input. Learn to mitigate and fix the vulnerability from experts.
- [Improper inventory management (CWE-1059)](https://learn.snyk.io/lesson/improper-inventory-management/): Discover how a lack of API asset management leads to security breaches and learn the best practices for API security.
- [Improper output handling in LLMs](https://learn.snyk.io/lesson/insecure-output-handling/): Learn how your LLM can create vulnerabilities by not sanitizing data and creating insecure output. We'll look at examples and mitigation techniques.
- [Improper restriction of operations within the bounds of a memory buffer (CWE-119, CWE-122)](https://learn.snyk.io/lesson/improper-restriction-of-operations-within-memory/): This lesson examines the dangers of improper restrictions on operations in memory and how to protect your application from such issues by writing memory-safe code.
- [Insecure default variable initialization (CWE-453)](https://learn.snyk.io/lesson/insecure-defaults/): Learn what insecure default variable initialization is, how to mitigate it, and how to remediate the vulnerability with real-world examples from security experts.
- [Insecure deserialization (CWE-502)](https://learn.snyk.io/lesson/insecure-deserialization/): Learn how an insecure deserialization attack works, and how to mitigate and remediate the vulnerability with real-world examples from security experts.
- [Insecure design (CWE-841, CWE-280, CWE-266, CWE-269)](https://learn.snyk.io/lesson/insecure-design/): Learn about insecure design, and how to mitigate and remediate the vulnerability with real-world examples from security experts.
- [Insecure hash (CWE-916, CWE-816, CWE-759, CWE-310, CWE-326, CWE-327, CWE-328)](https://learn.snyk.io/lesson/insecure-hash/): Learn what an insecure hash is, why you should be aware of it, and how you can implement strong hashes to remediate the vulnerability in your organization
- [Insecure inter-agent communication](https://learn.snyk.io/lesson/insecure-inter-agent-communication/): Learn about insecure inter-agent communication, a critical vulnerability in multi-agent systems, and how to mitigate and remediate it with real-world examples.
- [Insecure plugins for LLMs](https://learn.snyk.io/lesson/llm-insecure-plugins/): Learn how an attacker can exploit insecure plugins in LLM-based applications and compare them to similar attacks like resource exhaustion with examples.
- [Insecure randomness (CWE-1344, CWE-330, CWE-331, CWE-335, CWE-338, CWE-1241)](https://learn.snyk.io/lesson/insecure-randomness/): Learn all about randomness and the importance of having truly random numbers. We'll also look at why insecure randomness is a security concern and how to avoid it.
- [Insecure temporary file (CWE-377, CWE-378, CWE-379)](https://learn.snyk.io/lesson/insecure-temporary-file/): Learn about the issues that emerge when creating an insecure temporary file as well as how to mitigate this vulnerability.
- [Insufficient encapsulation (CWE-1061)](https://learn.snyk.io/lesson/insufficient-encapsulation/): Learn about insufficient encapsulation. What is it? How can you prevent it?
- [Integer overflow or wraparound (CWE-190)](https://learn.snyk.io/lesson/integer-overflow-or-wraparound/): Learn about integer overflow or wraparound and what happens when an integer value is increased beyond the maximum limit.
- [Known vulnerabilities in dependencies](https://learn.snyk.io/lesson/known-vulnerabilities-in-dependencies-broken/): Understand how vulnerable dependencies can compromise your application security and learn strategies to prevent exploitation.
- [LDAP injection (CWE-90)](https://learn.snyk.io/lesson/ldap-injection/): Learn about LDAP injection, and how to mitigate and remediate the vulnerability with real-world examples from security experts.
- [License and Regulatory Risk](https://learn.snyk.io/lesson/license-and-regulatory-risk/): Learn the importance of managing license and regulatory risk effectively. This includes understanding licensing terms, ensuring compliance, and more.
- [Log4Shell vulnerability](https://learn.snyk.io/lesson/log4shell/): Learn how to protect your Log4j instances against malicious remote code execution (RCE) in Java by exploiting a vulnerable application as part of this Snyk Learn lesson.
- [Logging vulnerabilities (CWE-117, CWE-223, CWE-532, CWE-778)](https://learn.snyk.io/lesson/logging-vulnerabilities/): Learn what a logging vulnerability is, including logging too much or logging too little, and how to protect your organization.
- [Man-in-the-middle (MITM) attack](https://learn.snyk.io/lesson/man-in-the-middle-attack/): Learn about man-in-the-middle attacks and the different forms they come in. We'll look at different examples and how to prevent them.
- [Mass assignment (CWE-915)](https://learn.snyk.io/lesson/mass-assignment/): Learn about mass assignment and the risks of user-provided data. Learn to mitigate and remediate the vulnerability with real-world examples from security experts.
- [Memory and context poisoning](https://learn.snyk.io/lesson/memory-context-poisoning/): Learn about Memory and Context Poisoning in agentic applications, how persistent context can be corrupted over time, and how to mitigate these risks.
- [Memory leaks (CWE-401)](https://learn.snyk.io/lesson/memory-leaks/): Learn about memory leaks, and how to mitigate and remediate the vulnerability with real-world examples from security experts.
- [Misinformation in LLMs](https://learn.snyk.io/lesson/llm-misinformation/): Learn how LLMs can spread convincing misinformation and explore techniques to prevent harmful or false outputs.
- [Missing encryption (CWE-311)](https://learn.snyk.io/lesson/missing-encryption/): Learn about encryption and the danger of not using it! We'll look at how to mitigate and remediate this vulnerability with real-world examples. 
- [Model theft](https://learn.snyk.io/lesson/model-theft-llm/): Learn about model theft (LLM10) in the OWASP Top 10 for LLM applications. We'll look at what it is and how to mitigate it.
- [Multi-factor authentication and privilege escalation](https://learn.snyk.io/lesson/multi-factor-authentication-and-privilege-escalation/): Learn about how multi-factor authentication can protect who has access to accounts, networks, data, etc., and how this plays a role in privilege escalation attacks.
- [Name confusion attacks](https://learn.snyk.io/lesson/name-confusion-attacks/): Learn about name confusion attacks, their implications, and how to mitigate and remediate them with insights and real-world examples from security experts.
- [No rate limiting (CWE-134, CWE-307, CWE-770)](https://learn.snyk.io/lesson/no-rate-limiting/): Learn about the issues that arise in an application that employs no rate limiting techniques, as well as how you can go about implementing those protections.
- [NoSQL injection attack (CWE-943)](https://learn.snyk.io/lesson/nosql-injection-attack/): Learn how NoSQL Injection attacks work, and compare them to the similar SQL injection attacks with examples and remediation information.
- [Null dereference (CWE-476, CWE-465)](https://learn.snyk.io/lesson/null-dereference/): Learn about null dereference and null pointer deference. Also, learn to mitigate and remediate the vulnerability with real-world examples from security experts.
- [Open redirect (CWE-601)](https://learn.snyk.io/lesson/open-redirect/): Learn about the risks of exposing open redirects, how to exploit them and how to mitigate them.
- [Out-of-bounds read (CWE-125)](https://learn.snyk.io/lesson/out-of-bounds-read/): This lesson covers the out of bounds read vulnerability and goes over how to protect your applications against them by improving memory safety.
- [Out-of-bounds write (CWE-787)](https://learn.snyk.io/lesson/out-of-bounds-write/): This lesson will go over the out-of-bounds write vulnerability and how to protect your applications against it by improving memory safety.
- [Outdated software in open source projects](https://learn.snyk.io/lesson/outdated-software/): Learn about outdated software risks in open source projects, how they impact your application, and how to mitigate these vulnerabilities.
- [Overreliance on LLMs](https://learn.snyk.io/lesson/overreliance-on-llms/): Learn how you can introduce vulnerabilities into your code by overreliance on LLMs. We'll look at examples and mitigation techniques.
- [PCI DSS](https://learn.snyk.io/lesson/pci-dss/): This lesson covers PCI DSS, what it is, why it's important for developers to know, and some examples of how this applies to developers and their code.
- [Personal access tokens (PATs)](https://learn.snyk.io/lesson/personal-access-tokens/): Move beyond passwords. This lesson covers creating, scoping, and securely using Personal Access Tokens (PATs).
- [Personally identifiable information (PII)](https://learn.snyk.io/lesson/what-is-pii/): This lesson covers PII, its importance for developers, where it's found in software, common pitfalls, and best practices for securely handling personal data.
- [PHP object injection (CWE-502, CWE-915)](https://learn.snyk.io/lesson/object-injection/): Learn how a PHP object injection attack works and how to mitigate and remediate the vulnerability with real-world examples from security experts.
- [Post-quantum cryptography](https://learn.snyk.io/lesson/post-quantum-cryptography/): This lesson delves into what makes current cryptographic methods inadequate in the face of quantum computers, and explains the new algorithms that we must use instead. 
- [Prompt Engineering](https://learn.snyk.io/lesson/prompt-engineering/): Learn in depth how to refine your LLM inputs not only to get the most effective results, but also the most secure ones. 
- [Prompt injection (CWE-1427)](https://learn.snyk.io/lesson/prompt-injection/): Learn about prompt injection or LLM01, in the OWASP Top 10 for LLM applications. We'll look at prompt injection, how it works, and how to mitigate it.
- [Protected health information (PHI)](https://learn.snyk.io/lesson/protected-health-information/): An introduction to Protected Health Information, HIPAA requirements, and what steps developers need to take to keep it secure. 
- [Prototype pollution (CWE-1321)](https://learn.snyk.io/lesson/prototype-pollution/): Learn what JavaScript prototype pollution is and how to prevent it.
- [Race condition (CWE-362, CWE-367)](https://learn.snyk.io/lesson/race-condition/): Learn about race conditions and the dangers of concurrency! We'll look at how to mitigate and remediate this vulnerability with real-world examples. 
- [Regular expression denial of service (ReDoS) (CWE-1333, CWE-185, CWE-400)](https://learn.snyk.io/lesson/redos/): Learn what ReDos is, why you should be aware of it, and how you can prevent and remediate the vulnerability in your organization
- [Rogue agents](https://learn.snyk.io/lesson/rogue-agents/): Learn about Rogue Agents and how compromised or misaligned AI agents can drift from their intended scope.
- [runc process.cwd Container breakout vulnerability](https://learn.snyk.io/lesson/cve-2024-21626-runc-process-cwd-container-breakout/): In this lesson, we will look at a very specific container breakout vulnerability, CVE-2024-21626. We'll look at the vulnerability in action and the mitigation.
- [Securing Your AI App](https://learn.snyk.io/lesson/securing-your-ai-app/): Now that we have seen how to create an app using AI in the command line, the next step is to secure the app thoughtfully. 
- [Security by default](https://learn.snyk.io/lesson/what-is-secure-by-default/): This lesson covers the philosophy of security by default, why is it so important in protecting users, how to implement it, and what can happen if you don't. 
- [Sensitive information disclosure in LLMs](https://learn.snyk.io/lesson/sensitive-information-disclosure-llm/): Learn how your LLM might give away too much data, including sensitive information. We'll look at examples and mitigation techniques.
- [Server-side request forgery (SSRF) (CWE-918)](https://learn.snyk.io/lesson/ssrf-server-side-request-forgery/): Learn how to protect your code from server-side request forgery (SSRF) attacks by exploiting a vulnerable web app as part of this Snyk Learn tutorial.
- [Session persistence after logout (CWE-613)](https://learn.snyk.io/lesson/session-persistence/): Learn about what happens when logging out doesn't invalidate the session. We'll look at an example of this in action!
- [Spring4Shell](https://learn.snyk.io/lesson/spring4shell/): Learn what Spring4Shell is, why you should be aware of it, and how you can prevent and remediate the vulnerability in your organization.
- [SQL injection (SQLi) (CWE-89)](https://learn.snyk.io/lesson/sql-injection/): Learn how to create SQL queries securely and avoid SQL injection attempts by malicious third parties.
- [Supply chain vulnerabilities](https://learn.snyk.io/lesson/supply-chain-vulnerabilities-llm/): Learn how your LLM can become vulnerable due to threats within the supply chain. We'll look at examples and mitigation techniques.
- [System prompt leakage in LLMs](https://learn.snyk.io/lesson/llm-system-prompt-leakage/): Learn how users can manipulate a chatbot into revealing its system instructions, why that’s dangerous, and how to prevent this kind of leakage.
- [Type confusion (CWE-843)](https://learn.snyk.io/lesson/type-confusion/): Learn about the dangers of type confusion and the dangers of assuming a type. Learn to mitigate and fix the vulnerability from security experts.
- [Unapproved change](https://learn.snyk.io/lesson/unapproved-change/): Learn about unapproved changes in open-source components, their risks, and strategies for mitigation, with examples and expert advice.
- [Unbounded Consumption in LLMs](https://learn.snyk.io/lesson/llm-unbounded-consumption/): Learn how attackers can exploit recursive LLM processes to cause denial of service and rack up huge bills.
- [Uncaught exception (CWE-248)](https://learn.snyk.io/lesson/uncaught-exception/): Learn about uncaught exceptions and the vulnerabilities they can cause. What are they? How can you prevent them? Learn to mitigate and remediate this vulnerability.
- [Uncontrolled Recursion (CWE-674)](https://learn.snyk.io/lesson/uncontrolled-recursion/): In this lesson, learn about the recursion that exists in the background of many systems, and then learn how to protect yourself against its exploitation!
- [Under/oversized dependency](https://learn.snyk.io/lesson/under-oversized-dependency/): Learn the risks of dependencies that are too large or too small for your project and how to mitigate these issues with real-world examples.
- [Unexpected code execution (RCE)](https://learn.snyk.io/lesson/agentic-unexpected-code-execution/): Learn how unexpected code execution (RCE) happens in agentic applications and how to protect your system against it. 
- [Unmaintained software](https://learn.snyk.io/lesson/unmaintained-software/): Understand how unmaintained software can lead to potential security risks with your application and learn strategies around dependency management and fallback planning.
- [Unrestricted access to sensitive business flows](https://learn.snyk.io/lesson/unrestricted-access-to-sensitive-business-flows/): Learn how to identify and secure sensitive business flows in your APIs. Walk through examples of code to see this vulnerability in action.
- [Unrestricted resource consumption (CWE-400)](https://learn.snyk.io/lesson/unrestricted-resource-consumption/): Learn about unrestricted resource consumption, how it works, and how to protect your APIs against it with code examples and mitigation techniques.
- [Unrestricted upload of files with dangerous types (CWE-434)](https://learn.snyk.io/lesson/unrestricted-file-upload/): Learn about the dangers of file uploads and the inefficiently restricted file uploads with dangerous types. Learn to mitigate and fix the vulnerability from experts.
- [Unsafe consumption of APIs](https://learn.snyk.io/lesson/unsafe-consumption-api/): Discover how the unsafe consumption of APIs can lead to security breaches and learn the best practices for API security.
- [Untracked dependencies](https://learn.snyk.io/lesson/untracked-dependencies/): Learn how untracked dependencies arise, why they pose risks to application security, and how to protect your projects against these risks.
- [Use after free (CWE-416)](https://learn.snyk.io/lesson/use-after-free/): Learn about use after free vulnerability. Also, learn to mitigate and remediate the vulnerability with real-world examples from security experts.
- [Vector and embedding weaknesses in LLMs](https://learn.snyk.io/lesson/llm-vector-and-embedding-weaknesses/): Learn how weak embeddings in LLMs can confuse inputs, enabling attackers to bypass filters or poison models.
- [Vulnerable and outdated components (CWE-1344, CWE-1104, CWE-1035, CWE-937)](https://learn.snyk.io/lesson/vulnerable-and-outdated-components/): A vulnerable and outdated component is a software component that is no longer supported by the developer, making it susceptible to security vulnerabilities.
- [Weak password recovery (CWE-640)](https://learn.snyk.io/lesson/weak-password-recovery/): A user forgot their password! How can you create a secure password recovery? Learn about weak password recoveries, see it in action, and learn the mitigation techniques.
- [XML external entity injection (XXE) (CWE-611, CWE-91)](https://learn.snyk.io/lesson/xxe/): Learn how an XXE attack works, and how to mitigate and fix the XXE vulnerability with real-world examples from security experts.
- [XPath injection (CWE-643)](https://learn.snyk.io/lesson/xpath-injection/): Learn about XPath injections, and how to mitigate and remediate the vulnerability with real-world examples from security experts.
- [Zero trust](https://learn.snyk.io/lesson/zero-trust/): In this lesson we will discuss what zero trust philosophy is and why it can be so effective at minimizing identity-based cyber attacks. 

## Product Training

- [Administrating Snyk in an IDE](https://learn.snyk.io/lesson/administrating-snyk-in-an-ide/): Learn to install, authenticate, and configure the Snyk IDE plugin, followed by validating and fixing issues with your open-source dependencies, code, IaC, and containers.
- [AI-BOM](https://learn.snyk.io/lesson/ai-bom/): Provides essential visibility by discovering AI assets and the relationships between them. 
- [Application context with Backstage software catalog](https://learn.snyk.io/lesson/snyk-essentials-backstage-software-catalog-application-context/): This lesson provides a quick overview of the configuration and where application context can be leveraged across Snyk.
- [Application context with ServiceNow® CMDB](https://learn.snyk.io/lesson/snyk-essentials-servicenow-cmdb-application-context/): This lesson provides a quick overview of the configuration and where application context can be leveraged across Snyk.
- [Asset Dashboard report for asset management and discovery](https://learn.snyk.io/lesson/snyk-essentials-asset-dashboard/): Snyk customers have access to an asset report providing coverage details , asset information, and application context availability.
- [CircleCI Implementation](https://learn.snyk.io/lesson/circleci-implementation/): This session gives a quick walkthrough on how to add Snyk scanning into your build pipeline using the Snyk Orb in CircleCI.
- [Configuring notifications](https://learn.snyk.io/lesson/configuring-notifications/): Prepare for developer adoption of Snyk by setting appropriate notification defaults for new organizations created and new projects imported.
- [Configuring Snyk with Bitbucket](https://learn.snyk.io/lesson/snyk-with-bitbucket/): See how Default Snyk Tests on PRs work in Bitbucket, including the configuration for an Organization or a Project and how to review and skip blocked builds.
- [Configuring Snyk with your source control manager](https://learn.snyk.io/lesson/configure-snyk-scm/): Learn to configure an example source code manager integration to make the best use of automations for your stage of the Snyk Developer Adoption model.
- [Creating Infrastructure as Code (IaC) custom rules](https://learn.snyk.io/lesson/iac-custom-rules/): This course is no longer supported. Please see Snyk documentation for the latest information on IaC custom rules.
- [Finding source code issues](https://learn.snyk.io/lesson/finding-source-code-issues/): Learn to use the Snyk Web UI to find code issues. Take a closer look at the Projects page and the Issue card for code Projects and issues.
- [Fixing open source vulnerabilities](https://learn.snyk.io/lesson/fixing-issues/): In this training lesson, learn to open a fix PR from the Snyk Web UI if your language/package manager supports it.
- [Hierachy Definition](https://learn.snyk.io/lesson/hierarchy-definition/): You will learn to define and strategically organize Tenants, Groups, and Organizations.
- [Ignoring issues](https://learn.snyk.io/lesson/ignoring-issues/): In this training lesson, learn to ignore issues in the Snyk UI as a prioritization strategy.

- [Importing a Project](https://learn.snyk.io/lesson/importing-a-project/): Learn how Snyk identifies a project. You'll also learn different ways to import projects and understand considerations for importing projects in bulk.
- [Integrating and using Snyk with CircleCI](https://learn.snyk.io/lesson/integrating-snyk-circleci/): Learn to configure and run the Snyk scan step in your CircleCI builds, including activating Snyk Orb, editing the configuration template, reviewing the results, and more
- [Integrating Snyk at your company](https://learn.snyk.io/lesson/integrate-snyk-at-your-company/): Consider how you want to adopt Snyk across your SDLC and learn about the Snyk Developer Adoption Model to determine where you are in your security journey.
- [Integrations & Authentication](https://learn.snyk.io/lesson/integrations-and-authentication/): Learn how to connect Snyk to your technical stack by configuring SSO via your IdP and establishing secure connection to SCMs 
- [Integrations for asset management and discovery](https://learn.snyk.io/lesson/snyk-essentials-and-snyk-apprisk-integrations/): In this lesson you will learn the core capabilities and initial integrations for asset management and discovery.
- [Intro to Snyk](https://learn.snyk.io/lesson/intro-to-snyk/): Learn some key concepts and tasks you'll need for integrating Snyk into your workflows including how to navigate the Snyk interface.
- [Intro to Snyk for administrators](https://learn.snyk.io/lesson/snyk-for-administrators/): Learn the best practices for configuring your Snyk Organization to align your integration settings with your security maturity and manage aspects of your Organization.
- [Intro to Snyk for developers](https://learn.snyk.io/lesson/snyk-for-developers/): Learn about how Snyk can help you develop securely, including how to find and fix issues with the Snyk IDE plugin and in the Snyk CLI.
- [Intro to Snyk UI](https://learn.snyk.io/lesson/intro-to-snyk-ui/): Learn to use Snyk to find, prioritize, and fix issues for Open Source, Code, Container, and IaC files.
- [Introducing Snyk Assist](https://learn.snyk.io/lesson/snyk-assist-introduction/): A Snyk Assist overview with examples for security and product training, in addition to requirements, and how the feature is enabled.
- [Onboarding & Team Rollout](https://learn.snyk.io/lesson/onboarding-team-rollout/): Standardize your Snyk rollout. Learn to build team workspaces, configure custom RBAC permissions, and optimize notifications to eliminate alert fatigue.
- [Open source license policy management](https://learn.snyk.io/lesson/license-policy-management/): Learn to define how Snyk identifies open-source packages that use certain licenses. Include guidance for developers on addressing issues that don't meet license policy.
- [Opening a Jira issue](https://learn.snyk.io/lesson/jira-issue/): Learn to initiate a Jira issue for an issue right from the Snyk Web UI.
- [Overview of Snyk for asset discovery and management](https://learn.snyk.io/lesson/snyk-essentials-and-snyk-apprisk-overview/): An overview of asset discovery and management that is used for Snyk.
- [Policies for asset management and discovery](https://learn.snyk.io/lesson/snyk-essentials-and-snyk-apprisk-policies/): In this lesson you will learn the core policy capabilities with Snyk.
- [Policy Configuration](https://learn.snyk.io/lesson/policy-configuration/): Learn how to create automated Security and License Policies that define which vulnerabilities are acceptable and which should trigger build failures or alerts.
- [Prioritize issues using the Snyk Web UI](https://learn.snyk.io/lesson/prioritize-issues-snyk/): Learn to use filters in the Snyk UI for prioritizing the list of issues.
- [Prioritizing issues with Snyk](https://learn.snyk.io/lesson/issue-prioritization/): In this lesson, we will learn how to use Issues and Issue Insights to review and prioritize issues.
- [Project Onboarding](https://learn.snyk.io/lesson/project-onboarding/): Learn how to import repositories and assets across your integrated SCMs and registries, establish an initial security baseline and apply exclusion filters.
- [Reviewing Inventory for asset management and discovery](https://learn.snyk.io/lesson/snyk-essentials-and-snyk-apprisk-inventory/): The Inventory provides a central, filterable view of all the detected assets, their control coverage, and essential metadata.
- [Roles and permissions in enterprise](https://learn.snyk.io/lesson/roles-and-permissions-in-enterprise/): Learn to invite members to your Organization and set the permissions on who can ignore issues.
- [Secure development with Snyk](https://learn.snyk.io/lesson/secure-development-with-snyk/): Learn how the Snyk Platform, Snyk Advisor, and learning platform help develop a secure application.
- [Security Analytics with Snowflake](https://learn.snyk.io/lesson/security-analytics-with-snowflake/): Unlocking powerful new analytical tools to better understand and visualize Snyk data with your data in Snowflake
- [Security policy management](https://learn.snyk.io/lesson/security-policy-management/): Learn to define the conditions and actions for new security policies and apply them based on attributes or Organizations.
- [ServiceNow - Vulnerability assignment rules](https://learn.snyk.io/lesson/service-now-vulnerability-assignment-rules/): Learn how to create vulnerability assignment rules for ServiceNow
- [Snyk API & Web - Using the web interface](https://learn.snyk.io/lesson/snyk-web-and-api-scan-configuration-via-web/): This lesson will provide key guidance on using the web interface to configure DAST scans for Snyk API & Web.
- [Snyk AppRisk Pro - Issue Insights Overview](https://learn.snyk.io/lesson/snyk-apprisk-insights-overview/): This course is no longer supported. Please see https://learn.snyk.io/lesson/issue-prioritization/?ecosystem=general for the latest information.
- [Snyk Billing and Credit Usage](https://learn.snyk.io/lesson/review-credit-consumption-for-billing/): This lesson provides an overview of how credits function within the Snyk platform and how to track and manage them in the Billing module.
- [Snyk CLI and Snyk Open Source](https://learn.snyk.io/lesson/snyk-cli/): Learn to authenticate the local CLI to your Snyk account. You'll also learn how to review results for Snyk test and Snyk monitor commands.
- [Snyk Code: Issue management with Consistent Ignores](https://learn.snyk.io/lesson/snyk-consistent-ignores/): The following lesson describes consistent ignores, how to enable, how to migrate, and how to create new ignore rules that work across repos, integrations, and projects.
- [Snyk Github Cloud App](https://learn.snyk.io/lesson/snyk-github-cloud-app/): Installation and migration instructions for Snyk Github Cloud App integration
- [Snyk implementation kickoff](https://learn.snyk.io/lesson/snyk-implementation-kickoff/): Learn the best practices for preparing to roll out Snyk to your teams, including a Snyk overview, rollout considerations, the maturity of your security program, and more.
- [Snyk Platform Using Snyk Analytics](https://learn.snyk.io/lesson/snyk-apprisk-application-analytics/): Snyk Analytics helps organizations understand coverage, potential gaps and trends across the applications they own. This lesson provides an overview.
- [Snyk PR Checks in your Pull Request/Merge Request](https://learn.snyk.io/lesson/checking-your-code-with-pr-checks/): This lesson speaks to developers on how to navigate the pull request check, understand the issue, and then resolve it as part of a workflow.
- [Snyk Reports](https://learn.snyk.io/lesson/snyk-reports/): Learn how development and security teams can use Snyk reports for prioritization, responsibility, and accountability.
- [Snyk terminology for asset management and discovery](https://learn.snyk.io/lesson/snyk-essentials-and-snyk-apprisk-terminology/): The following terminology is used by Snyk for asset management and discovery related features.
- [SSO, authentication, and user provisioning](https://learn.snyk.io/lesson/sso-authentication-provisioning/): Learn about the options for provisioning new users via single sign-on (SSO). You'll also prepare for completing the SSO setup process.
- [Tenants, Groups and Organizations](https://learn.snyk.io/lesson/groups-and-organizations/): Learn about the structure hierarchy within Snyk and discover considerations for planning your rganizational structure.
- [Universal Broker](https://learn.snyk.io/lesson/universal-broker/): This lesson explains what a broker is at a high level, then provides examples on how you can implement the broker.
- [Using Issue Analytics (Tenant->Analytics->Issues)](https://learn.snyk.io/lesson/using-issue-analytics/): This lesson will provide an overview of a feature for Issue Analytics available  for enterprise customers.
- [Using Snyk in an IDE](https://learn.snyk.io/lesson/snyk-in-an-ide/): Learn to install, authenticate, and configure the Snyk IDE plugin as a developer.
- [Using Snyk with CI/CD](https://learn.snyk.io/lesson/using-snyk-with-ci-cd/): Learn why to use Snyk in a CI/CD pipeline, different ways of deployment, and three different use cases for using Snyk with CI/CD.

## Optional

- [Sitemap](https://learn.snyk.io/sitemap.xml): Machine-readable structure