Build software with AIplanned
A broken login still logs you in.
Security is where the gap between looking finished and being finished is widest. Most bugs announce themselves. These ones sit quietly until somebody finds them. This is defensive work on code you own: keeping secrets out of your bundle and out of your agent's context, checking what it wrote before it holds real people's data, and building the guardrails that stop the unrecoverable mistake.
You'll need a paid Claude plan, which is $20 a month, and a machine you can install things on. Everything here is defensive and applies to code you own.
What It Covers
The part where it holds real people's data.
Defensive only. Nothing here is about getting into anything you don't own.
Secrets and your agent
Where keys actually live, what ends up in a client bundle the moment you deploy, and what your agent should never be allowed to open. My own setup refuses to read a .env at all, and this lesson is why.
Protecting user data while you work
What goes into context and what never does. Working against production-shaped data without working against production, using fixtures and redaction. The phrase "just this once, read-only" is where most people get themselves in trouble.
Running it somewhere disposable
A VM, a container, a devcontainer, or just a separate user account on the same machine. What each one buys you and what it costs you in friction, because a setup that adds twenty seconds to every task is one you abandon in a fortnight and then believe you're protected when you aren't.
Guardrails for the unrecoverable mistake
Hooks and rules aimed at the one domain where a mistake can't be undone. Never read a secret, never log one, never point anything at production. Same artifacts as the workflow course, aimed somewhere the stakes are different.
Reviewing the login you already have
An agent will write you a login that works and is wrong, with total confidence. Sessions, tokens, how passwords get handled, and the specific things to go back and check in auth that is already running before it holds a real account.
Who can actually reach your data
Access control, row-level security, and endpoints that never check who is asking. The missing tenant check is the bug that quietly shows everybody everybody else's information, and it's easy to generate and hard to spot.
Dependencies
What is in your lockfile, what Dependabot and npm audit are telling you, and which alerts are real. Then having Claude triage and fix them properly, which is different from bumping versions until the warning goes away.
Where your images and fonts came from
An agent pulling assets off the open web will quietly put somebody else's copyrighted photo on your client's site. The fix is that it never browses for them: licensed APIs only, uploads from the client only, and a manifest recording the source, the licence and the date for every file that lands in the repo. Also the trap nobody sees coming, which is that a photo of an identifiable person can't be used to imply they endorse anything.
Auditing your own code
A security review pass as a slash command. What to tell it to look for, what it reliably catches, and where it falls short so you know which parts you still have to read yourself.
Rate limiting and validation
The two unglamorous defenses that stop most of the cheap attacks, and the reason a form nobody is abusing yet is still worth protecting.
Know when it opens.
Leave your email and we'll tell you when the first lessons are up. You'll hear from us once, at the point where there's actually something to watch.
Everyone on the list pays the founding price of $149 a course. It opens at $199. Nothing to pay now, and no date attached to any of it.
Would rather we just built it for you? See what that costs.