Five-stage roadmap
Application Security
You do not need to collect next-stage tools before you are ready. Sequence does not slow you down; it removes random detours.
- 1 · FoundationBuild the vocabulary and problem-solving habits the rest of the path assumes.
- 2 · CoreLearn the concepts that make this career distinct from simply writing code.
- 3 · PracticalMeet the inconvenient parts tutorials often skip: setup, failure, feedback and deployment.
- 4 · Professional EngineeringMake your work readable, testable, reviewable and safe for another person to depend on.
- 5 · Later / SpecializationChoose depth because a real project or question now demands it—not because a roadmap poster had empty boxes.
Roadmap stage
1 · Foundation
Build the vocabulary and problem-solving habits the rest of the path assumes.
What to learn
- Web/API behavior, authentication, authorization, HTTP and Git.
- Input validation, sessions, secrets, dependencies and logging.
- Legal authorization, lab isolation and responsible disclosure.
Enough for now
You can state an authorized scope, distinguish authentication from authorization and trace untrusted input to a protected action.
Practical task
Draw one owned app's data flow, mark its trust boundaries and write three abuse cases before using a scanner or exploit tool.
Roadmap stage
2 · Core
Learn the concepts that make this career distinct from simply writing code.
What to learn
- Threat modelling, trust boundaries and abuse cases.
- OWASP risks, secure design and code review.
- Risk-based testing, remediation and verification.
Enough for now
You can explain the main trade-offs and solve a bounded problem without a recipe.
Practical task
Rebuild a familiar exercise with one changed constraint and document your reasoning.
Roadmap stage
3 · Practical
Meet the inconvenient parts tutorials often skip: setup, failure, feedback and deployment.
What to learn
- Threat-model a tiny app you own and rank three abuse cases.
- Fix and regression-test one weakness in the local app.
- Write a calm report with scope, evidence, impact and limits.
Enough for now
You have one small, working artifact and can demonstrate a failure you found and fixed.
Practical task
Complete the linked career experiment, then improve it after one deliberate failure or review.
Roadmap stage
4 · Professional Engineering
Make your work readable, testable, reviewable and safe for another person to depend on.
What to learn
- Threat-model review, secure defaults and testable security requirements.
- Evidence-based triage, reproducible fixes and regression protection.
- Responsible disclosure, secret-safe records and accountable risk acceptance.
Enough for now
A reviewer can reproduce the finding safely, verify the fix and understand the remaining risk without receiving secrets.
Practical task
For an authorized local finding, write scope and evidence, implement the smallest server-side fix and add a regression test. Have a peer review both risk and remediation.
Roadmap stage
5 · Later / Specialization
Choose depth because a real project or question now demands it—not because a roadmap poster had empty boxes.
What to learn
- Secure architecture, identity and cloud-native controls.
- Supply-chain security and security automation with review.
- Security champion programs, metrics and incident learning.
Enough for now
Choose one depth area, state why it matters now and produce one evidence-backed result.
Practical task
Write a one-page depth plan tied to a real system, research question or role requirement.
From skills to a destination
Where could you take this?
The career roadmap explains what to learn. A goal guide helps you put those skills to work. Start with one—not every route at once.
You read the roadmap—now gather evidence