From d6fc284b29af2e8da719fe2047de4b77a4282eca Mon Sep 17 00:00:00 2001 From: Richard Tweed Date: Fri, 24 Jul 2026 12:56:10 +0100 Subject: [PATCH] fix: Randomise quiz option order per attempt; apply review feedback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use Xerte Nottingham's per-question `answerOrder="random"` attribute so answer options shuffle on every attempt (the engine's HTML5 quiz model honours it and computes scoring from the shuffled array, so SCORM tracking is unaffected). Applied to all 45 questions across the 8 quizzes; the question-level `order="random"` already shuffled question order, so both layers now randomise per attempt. This removes the previous bias where the correct answer was frequently the first option, most visible in the final comprehensive quiz. Feedback fixes applied to source/data.xml + source/preview.xml (kept byte-identical) and reflected in the docs: - Theme 1 Quiz Q2: "mitigations for authentication failures" → "mitigations against authentication attacks" (clearer; the controls defend against attacks, not "for" failures). - Injection (A05:2025) page: the "Use safe ORM APIs" bullet is replaced with parameterised-query guidance — an ORM is not inherently injection-proof; use its parameterised methods and never concatenate raw input into queries. - Theme 7 Quiz Q2 (logging tool calls): the correct answer was inverted (False was marked correct, implying logging tool calls is not recommended). Swapped so True is correct, matching the Theme 7 content page and the final-quiz question that treats missing agent logs as a Security Logging and Alerting Failure. We must be able to prove what an agent did and why; privacy is handled by privacy-aware logging, not by not logging. - Final quiz, over-scoped CRM tool question: reframed from "which risk is this?" (Tool Misuse) to "which principle best prevents the risk?" with "Scope each tool to least privilege" as the correct answer — the lesson the scenario actually teaches. - New "Course complete" page (page 44) after the final quiz so it is unambiguous the training is over (result recorded by the LMS, 80% pass mark / last-attempt rule, "you may close this window"). Top-level page count is now 44. Provenance: removed the generation details (pi harness version and LLM model names) from the About and References pages since they have been upgraded since; replaced with a generic "Generated with the assistance of an AI coding agent. Not endorsed by OWASP." note. Docs updated to match: - docs/PROJECT_CONTEXT.md: page count (44), new answerOrder="random" state + convention #10, updated SCORM completion off-by-one analysis (the untracked last node is now the harmless Course complete page; the Final quiz's completion is now tracked), verification checklist lines, provenance quote. - docs/COURSE_SPEC.md: Theme 1 Q wording, Injection mitigations wording, answerOrder note, Page 44 Course complete, totals (44), provenance. - docs/COURSE_VERIFICATION.md: new "Feedback pass" section documenting all six changes + local checks; provenance mention updated. Validated end-to-end through the running XOT instance (convention 9): pushed the updated source into the container, opened the HTML5 editor (page tree shows 44 pages, in-memory lo_data loaded answerOrder="random" on all 45 questions), Published (round-trip preserved answerOrder on all 45, the Course complete page, the new provenance, and all tracking attrs), synced the XOT-published data.xml/preview.xml back to source/ (canonical XML identical to the hand-edited version), re-exported SCORM, and grepped the exported template.xml against the checklist — all values pass (45 questions, 45 answerOrder="random", trackingMode="full", trackingPassed ="80%", trackingWeight 1×7 + 21, judge="true" ×8, unmarkForCompletion ×1, xPersistProgress ×1, delaySecs="0" ×27, 0 empty options, Course complete page present, 0 old provenance refs). End-to-end UI walk in play.php confirmed options and question order reshuffle between attempts and scoring remains correct, and the Course complete page renders. No SCORM zip is committed (built by the release workflow; in .gitignore). Generated with pi 0.81.1 and GLM 5.2 --- docs/COURSE_SPEC.md | 22 +++++++---- docs/COURSE_VERIFICATION.md | 74 ++++++++++++++++++++++++++++++++++++- docs/PROJECT_CONTEXT.md | 58 +++++++++++++++++++++-------- source/data.xml | 41 ++++++++++++++------ source/preview.xml | 41 ++++++++++++++------ 5 files changed, 190 insertions(+), 46 deletions(-) diff --git a/docs/COURSE_SPEC.md b/docs/COURSE_SPEC.md index 28bb185..25412ba 100644 --- a/docs/COURSE_SPEC.md +++ b/docs/COURSE_SPEC.md @@ -13,8 +13,7 @@ Model, version 1.2)** package with **LMS (Learning Management System)-reported s - **Course license: CC BY-SA 4.0** (ShareAlike, required by the Agentic PDF). - Attribution + "changes were made" + "not endorsed by OWASP" on the About page. -- **Provenance**: generated with the **pi coding-agent harness v0.79.8** using LLM (Large Language - Model) models **glm-5.2** and **kimi k2.7-coder**. Not endorsed by OWASP. +- **Provenance**: generated with the assistance of an AI coding agent. Not endorsed by OWASP. - All prose is written in our own words as an adaptation; quiz questions are original. ## Conventions (apply on every page and in every quiz) @@ -38,6 +37,8 @@ Model, version 1.2)** package with **LMS (Learning Management System)-reported s - **Scoring**: a **Configure Scores** page sets project scoring; theme quizzes (25%) + final quiz (75%) **all count** toward the LMS score. Final quiz pass mark **80%**. - **SCORM 1.2** export → `cmi.core.score.raw`, `cmi.core.lesson_status`, `cmi.interactions.n`. +- **Option order**: every quiz question sets `answerOrder="random"` so the answer options + shuffle on each attempt (Nottingham per-question "Answer Order" property). - **Question types used** (all selection-based, no free text): Multiple Choice (single), Multiple Response (select all), True/False, Matching, Categorise. - Editor opened directly at `/edit.php?template_id=`; **Publish** before export. @@ -74,7 +75,7 @@ Real-world incident callout (where Appendix D has one) · Secure-coding mitigati - Attribution to both OWASP sources (name, author, source link, license link). - "Changes were made: this course is an adapted summary/derivative." - "Not endorsed by OWASP." -- Provenance: pi v0.79.8, models glm-5.2 and kimi k2.7-coder. +- Provenance: generated with the assistance of an AI coding agent. ### Page 3 — Introduction to secure code development [Content] - What secure code development is; why it matters; cost of defects left vs right of the @@ -128,7 +129,7 @@ Real-world incident callout (where Appendix D has one) · Secure-coding mitigati *An authenticated user edits a URL parameter to view another user's account* (correct). Distractors: an attacker sends a crafted SQL (Structured Query Language) string; a server uses a deprecated hash; an app ships with default admin credentials. -- **Multiple response**: "Which are effective mitigations for authentication failures?" ✅ MFA +- **Multiple response**: "Which are effective mitigations against authentication attacks?" ✅ MFA (Multi-Factor Authentication); ✅ hashed + salted passwords; ✅ lockout on repeated failures; ❌ plaintext password reminders by email; ❌ client-side authorization checks. - **True/False**: "A delegated agent should reuse the delegating user's full permissions when @@ -157,8 +158,9 @@ Real-world incident callout (where Appendix D has one) · Secure-coding mitigati XPath (XML Path) injection, expression/language injection. - Examples: SQLi via concatenated strings, command injection, expression injection. - Mitigations: parameterised queries / prepared statements, allowlist input validation, - escaping/encoding, ORM (Object-Relational Mapping) safe APIs, least privilege on DB - (database) accounts. + escaping/encoding, parameterised ORM (Object-Relational Mapping) query methods (an ORM is + not inherently injection-proof — never concatenate raw input into its query strings), least + privilege on DB (database) accounts. ### Page 12 — Agent Goal Hijack (Agentic, ASI01) [Content] - Overview: manipulating an agent's objectives, task selection, or decision pathways via prompt @@ -560,6 +562,12 @@ All framed with full descriptive names (no item codes as the question subject). Memory & Context Poisoning = Agentic; Cryptographic Failures = Classic; Rogue Agents = Agentic; Security Misconfiguration = Classic; Cascading Failures = Agentic. +### Page 44 — Course complete [Content] +- A closing page so it is unambiguous that the training is over: congratulates the learner, + reminds them their result is recorded by the LMS (Learning Management System) and that the + 80% pass mark / last-attempt rule applies, and tells them they may close the window. Plain + Text page type. + ### [Scores] — Configure Scores - Project scoring enabled; theme quizzes (25%) + final quiz (75%) all count; final pass mark 80%; per-question weighting set at build time. @@ -567,7 +575,7 @@ All framed with full descriptive names (no item codes as the question subject). --- ## Totals -- 43 learner-visible pages + 1 Configure Scores page. +- 44 learner-visible pages + 1 Configure Scores page. - 20 item pages (10 classic + 10 agentic), 7 theme intros, 7 theme quizzes, 1 final quiz, 4 front-matter + 5 back-matter pages. - All quiz questions selection-based; auto-graded; LMS-reported via SCORM 1.2. diff --git a/docs/COURSE_VERIFICATION.md b/docs/COURSE_VERIFICATION.md index 0cd6ee4..207d6a3 100644 --- a/docs/COURSE_VERIFICATION.md +++ b/docs/COURSE_VERIFICATION.md @@ -46,7 +46,7 @@ Glossary/abbreviations, References & further reading — all present. CC BY-SA 4.0 (Creative Commons Attribution-ShareAlike 4.0); both OWASP sources attributed (Agentic 2026 / genai.owasp.org / CC BY-SA 4.0; Top 10:2025 / owasp.org/Top10/2025/ / CC BY 3.0); "changes were made"; "not endorsed by OWASP"; -provenance (pi v0.79.8, models glm-5.2 and kimi k2.7-coder). +provenance (generated with the assistance of an AI coding agent). ### Acronym expansions ✅ (sample all present) IDOR (Insecure Direct Object Reference), RCE (Remote Code Execution), @@ -206,3 +206,75 @@ empty options, 27 `delaySecs=0`, autosave script present). A Publish round-trip preserved the `{{BUILD_VERSION}}` placeholder intact in `data.xml` (CKEditor does not mangle the braces). See `PROJECT_CONTEXT.md` § "Build version stamping" for full detail. + +## Feedback pass: option randomisation + content fixes (post-0.0.6) + +A round of review feedback was applied to `source/data.xml` + +`source/preview.xml` (kept byte-identical). All changes are content-level and +use engine-supported attributes, so they survive the release-workflow XOT +import/export and the editor round-trip. + +1. **Option order randomised per attempt** ✅ — every `` now carries + `answerOrder="random"` (45/45). Nottingham's HTML5 quiz model + (`models_html5/quiz.html` ~line 165) shuffles each question's options on + quiz load/restart; scoring is computed from the shuffled array, so SCORM + tracking is unaffected. This removes the previous bias where the correct + answer was frequently the first option (most visible in the final quiz). + `answerOrder` is a declared wizard property (`quiz.xwd` "Answer Order"), + so the editor round-trips it natively (like `trackingWeight`). +2. **Theme 1 Quiz Q2 wording** ✅ — "Which are effective mitigations for + authentication failures?" → "Which are effective mitigations against + authentication attacks?" (clearer; the mitigations defend against attacks, + not "for" failures). +3. **Injection (A05:2025) page — ORM bullet** ✅ — the line "Use safe ORM + (Object-Relational Mapping) APIs and stored procedures correctly." was + replaced with "Use parameterised query APIs and stored procedures + correctly; an ORM (Object-Relational Mapping) is not automatically safe — + use its parameterised methods and never concatenate raw input into + queries." An ORM is not inherently injection-proof, so it should not be + listed as a standalone mitigation. +4. **Theme 7 Quiz Q2 — logging tool calls** ✅ — the correct answer was + inverted (False was marked correct, implying logging tool calls is *not* + recommended). Swapped so **True** is correct, matching the Theme 7 content + page ("You should log tool calls, inter-agent messages, goal state and + action sequences") and the final-quiz question that treats missing agent + logs as a Security Logging and Alerting Failure. We must be able to prove + what an agent did and why; privacy is handled by privacy-aware logging, + not by not logging. +5. **Final quiz — over-scoped CRM tool question** ✅ — the question whose + correct answer was "Tool Misuse" (the over-scoped CRM summariser) was + reframed to ask for the *principle that prevents* the risk, with + "Scope each tool to least privilege: only the data and actions the task + requires" as the correct answer. (Over-scoped tools do map to Tool Misuse + / ASI02 per the course's own page, but the lesson the scenario teaches is + least-privilege scoping; the reframe makes that the answer.) +6. **"Course complete" page added** ✅ — a new `` page + (`linkID="PG1781901000001"`, name "Course complete") was added after the + final quiz so it is unambiguous that the training is over. It is a Plain + Text page (not Bullets), so the `delaySecs="0"` count is unchanged at 27. + Top-level page count is now 44 (43 learner content/quiz pages + this + closing page). Per the SCORM completion analysis in `PROJECT_CONTEXT.md`, + this page becomes the untracked last content node (no score, no + interaction — harmless), and the Final quiz's completion is now tracked. + +### Local checks (run against `source/data.xml`; XOT re-export still required per convention 9) + +- 45 `` elements, 45 with `answerOrder="random"`. +- 8 `` nodes; `trackingWeight` = 1×7 + 21; `trackingMode="full"`; + `trackingPassed="80%"`; `judge="true"` ×8. +- `unmarkForCompletion="true"` ×1 (Welcome); `xPersistProgress` ×1 (autosave + script); `{{BUILD_VERSION}}` ×1 (placeholder, substituted at build time). +- `delaySecs="0"` ×27 (unchanged — the new page is Plain Text). +- 0 empty option nodes; every question has ≥2 options and ≥1 correct. +- `tools/render_preview.py` renders 44 pages (final page = "Course complete") + without error. +- `source/data.xml` and `source/preview.xml` are byte-identical. + +**Pending (convention 9 — MANDATORY before merge)**: push the updated +`source/data.xml` + `source/preview.xml` into a running XOT instance, +confirm `play.php` returns 200, open the HTML5 editor to confirm a Publish +round-trip preserves `answerOrder="random"` on all 45 questions (and the +other tracking attrs), export a SCORM package, and grep the exported +`template.xml` for the checklist values in `PROJECT_CONTEXT.md`. Then walk a +quiz end-to-end (answer → Check → Next → complete → Restart) and confirm +options reorder between attempts. diff --git a/docs/PROJECT_CONTEXT.md b/docs/PROJECT_CONTEXT.md index d0c9895..329b35c 100644 --- a/docs/PROJECT_CONTEXT.md +++ b/docs/PROJECT_CONTEXT.md @@ -47,9 +47,13 @@ with agents and building agents. ## Current state of the course (as last exported) -- **48 learner pages** in spec order: front matter (4) → 7 themes (each: intro + - classic item page(s) + agentic item page(s) + theme quiz) → back matter (4: - secure-SDLC integration, mapping, glossary, references) → final quiz. +- **44 top-level pages** in `source/data.xml` (43 learner content/quiz pages + 1 + final **"Course complete"** page added after the final quiz so it is clear the + training is over): front matter (4) → 7 themes (each: intro + classic item + page(s) + agentic item page(s) + theme quiz) → back matter (4: secure-SDLC + integration, mapping, glossary, references) → final quiz → Course complete. + (Earlier docs/reports may say 43 or 48; the authoritative count is whatever + is in `source/data.xml`.) - **Content page types**: pages 1–8 are `text` (Plain Text); pages from Theme 2 onward are `bullets` (Bullets/Timed Content) with **`delaySecs="0"`** so they do **not** auto-play (a deliberate fix — see "Conventions" below). @@ -59,6 +63,14 @@ with agents and building agents. nested `` children. **45 scored questions total** (23 theme + 18 final + 4 … see `COURSE_VERIFICATION.md`). Every question has ≥2 options and ≥1 `correct="true"`; **no empty option nodes**. +- **Option order is randomised per attempt**: every `` carries + `answerOrder="random"` (the Nottingham wizard's per-question "Answer Order" + property; see `quiz.xwd` and `models_html5/quiz.html` line ~165). The HTML5 + player shuffles each question's options on quiz load/restart, and scoring is + computed from the shuffled array so SCORM tracking stays correct. This + removes the previous bias where the correct answer was frequently the first + option (especially in the final quiz). The attribute is editor-declared, so + the XOT HTML5 editor round-trips it natively (like `trackingWeight`). - **Final quiz** has **18 distinct questions** (fresh scenarios, not duplicates of the theme-quiz questions), mix of single-answer risk-identification and true/false. @@ -84,8 +96,7 @@ These were agreed with the course owner and must be preserved: Applications 2026, genai.owasp.org, CC BY-SA 4.0; OWASP Top 10:2025, owasp.org/Top10/2025/, CC BY 3.0); a "changes were made" notice; a "not endorsed by OWASP" notice; and **provenance**: - *"Generated with the pi coding-agent harness v0.79.8 using LLM models - glm-5.2 and kimi k2.7-coder."* + *"Generated with the assistance of an AI coding agent."* 2. **Acronym expansion**: the first time a security acronym is used **on a page**, give the full form in brackets, e.g. `TOCTOU (Time-of-check to time-of-use)`. Reuse the acronym thereafter on that page; expand again on the @@ -125,6 +136,14 @@ These were agreed with the course owner and must be preserved: confirm `trackingMode`, `trackingWeight`, `trackingPassed`, the question count, and the empty-option count are all as expected). Do not merge a `source/data.xml` change that has not passed this validation. +10. **Option order must be randomised per attempt**: every `` must + carry `answerOrder="random"` (Nottingham wizard's per-question "Answer + Order" property, `quiz.xwd`; honoured by `models_html5/quiz.html`). This + shuffles each question's options on quiz load/restart and removes the + pattern of the correct answer always being the first option. Scoring is + computed from the shuffled array, so SCORM tracking is unaffected. When + adding a new question, set `answerOrder="random"` on it. Keep `data.xml` + and `preview.xml` byte-identical. ## Known deviations (acknowledged, not to "fix" without asking) @@ -153,7 +172,9 @@ being sent (75, then 100). `cmi.core.lesson_status` was never reported as **Root cause** (a Xerte Nottingham engine bug, worked around at the content level): with `navigation="Menu with Page Controls"`, Xerte inserts a built-in Table-of-Contents page as `x_pages[0]` **after** `toCompletePages` is built -from `currActPage` over the 43 content nodes. So every content page's +from `currActPage` over the content nodes (43 when this fix was designed; +44 now that a **Course complete** page follows the final quiz — the analysis +is identical, only the last `page_nr` shifts). So every content page's `page_nr` (used by `exitInteraction` to mark `completedPages[i]`) is `currActPage + 1` — a systematic **off-by-one**: @@ -179,16 +200,19 @@ against `trackingPassed="80%"`. Verified locally with a SCORM 1.2 mock API: a completed run sends `cmi.core.lesson_status="passed"`, `cmi.core.exit=""`, `cmi.core.score.raw`, `score.min`, `score.max`, and `cmi.core.session_time`. -**Trade-off**: the Final quiz (`page_nr == 43`) is still not in -`toCompletePages` (there is no index 43), so its *completion* is not tracked -in `completedPages` — but its *score* is still tracked via its interactions -and `trackingWeight="21"`, so the LMS grade and pass/fail are correct. The -Welcome page is no longer "required" for completion, which is acceptable for -an intro page. A proper fix would be in the Xerte engine (`xenith.js`: build -`toCompletePages` from `page_nr` after the menu is inserted, or do not insert -the menu into `x_pages` for tracking); this content workaround is used because -the release workflow builds from the XOT engine and an engine patch would not -persist across XOT rebuilds. +**Trade-off** (with the Course complete page now present): the *last* content +node — the **Course complete** page (`page_nr == 44`), a static +acknowledgement page — is not in `toCompletePages` (there is no index 44), so +its *completion* is not tracked; this is harmless (it carries no score and no +interaction). The Final quiz (`page_nr == 43`) **is** now in +`toCompletePages`, so its completion is tracked, and its *score* is tracked +via its interactions and `trackingWeight="21"`. The Welcome page is no longer +"required" for completion, which is acceptable for an intro page. A proper +fix would be in the Xerte engine (`xenith.js`: build `toCompletePages` from +`page_nr` after the menu is inserted, or do not insert the menu into `x_pages` +for tracking); this content workaround is used because the release workflow +builds from the XOT engine and an engine patch would not persist across XOT +rebuilds. **Do not remove `unmarkForCompletion="true"` from the Welcome page** without a replacement fix — re-introducing the off-by-one will silently break LMS @@ -392,6 +416,7 @@ unzip -p Secure_code_development_scorm.zip template.xml | grep -oE 'trackingPass unzip -p Secure_code_development_scorm.zip template.xml > /tmp/c.xml grep -c "Trial MCQ" /tmp/c.xml # 0 grep -oE ' [^<&]*' /tmp/c.xml # e.g. 'Version: v0.0.6 (...)' grep -c '{{BUILD_VERSION}}' /tmp/c.xml # 0 in a release export (1 in committed source) diff --git a/source/data.xml b/source/data.xml index aba5b17..ebf547a 100644 --- a/source/data.xml +++ b/source/data.xml @@ -41,7 +41,7 @@

Provenance

-

Generated with the pi coding-agent harness v0.79.8 using LLM models glm-5.2 and kimi k2.7-coder. Not endorsed by OWASP.

+

Generated with the assistance of an AI coding agent. Not endorsed by OWASP.

Build

@@ -207,7 +207,7 @@
  • Detect delegated and transitive permissions — model the full delegation chain. If agent A delegates to agent B, the effective permissions should be the intersection of what A and B are each allowed to do.
  • Managed NHI (Non-Human Identity) — place agent identities in a dedicated identity platform such as Entra, AWS Bedrock, or Agentforce. Use lifecycle management, rotation, and audit for non-human accounts just as you would for human employees.
    • -]]>    This theme traces how untrusted input becomes unintended action. We start with classic injection, then follow the chain into agentic territory: agents whose goals can be hijacked, whose tools can be misused, and whose generated code can execute unexpectedly.

    +]]>This theme traces how untrusted input becomes unintended action. We start with classic injection, then follow the chain into agentic territory: agents whose goals can be hijacked, whose tools can be misused, and whose generated code can execute unexpectedly.

    For engineers building agents, the lesson is that input validation, intent checks, and execution boundaries matter at every layer.

    ]]>    Injection @@ -232,7 +232,7 @@
  • Parameterised queries / prepared statements — keep data separate from code; never concatenate SQL strings.
  • Allowlist input validation — validate type, length, format, and character set against an explicit allowlist.
  • Escape and encode for the target interpreter when a safe API is unavailable.
    • -
  • Use safe ORM (Object-Relational Mapping) APIs and stored procedures correctly.
    • +
  • Use parameterised query APIs and stored procedures correctly; an ORM (Object-Relational Mapping) is not automatically safe — use its parameterised methods and never concatenate raw input into queries.
  • Apply least privilege to database accounts so an injection cannot reach administrative data.
    • ]]>    Overview @@ -329,7 +329,7 @@
  • Static scans before execution. Run security scanners and dependency checks on generated code before it is executed.
  • Runtime monitoring. Observe file, network, and process activity during code execution and terminate anomalous behaviour.
    • -]]>    Theme 3: Supply Chain & Integrity looks at trust in code, data, and context. In classic software, the supply chain is mostly static: libraries, packages, build tools, and the CI/CD (Continuous Integration / Continuous Deployment) pipeline that produces your artefact. If any of those ingredients are tampered with, the final application carries the flaw. The OWASP Top 10:2025 tracks this as Software Supply Chain Failures (A03:2025) and Software or Data Integrity Failures (A08:2025).

    +]]>    Theme 3: Supply Chain & Integrity looks at trust in code, data, and context. In classic software, the supply chain is mostly static: libraries, packages, build tools, and the CI/CD (Continuous Integration / Continuous Deployment) pipeline that produces your artefact. If any of those ingredients are tampered with, the final application carries the flaw. The OWASP Top 10:2025 tracks this as Software Supply Chain Failures (A03:2025) and Software or Data Integrity Failures (A08:2025).

    Agentic systems extend that same idea into a dynamic, runtime supply chain. An agent does not just import a dependency at build time; it can discover and compose tools, models, prompts, and other agents at runtime. This composition happens through protocols such as the Model Context Protocol (MCP) and Agent-to-Agent (A2A) frameworks, and through registries that advertise tool or agent capabilities. Each extra capability is a dependency that can be malicious, misconfigured, or compromised.

    @@ -492,7 +492,7 @@
  • Decay / expire unverified memory. Reduce the trust weight of unverified entries over time and eventually remove them.
  • Trust-weighted retrieval. Rank search results by source trust and confidence, not just embedding similarity.
    • -]]>    Theme 4: Cryptographic Failures & Secrets +]]>Theme 4: Cryptographic Failures & Secrets

    Theme 4 explores Cryptographic Failures (A04:2025) from the OWASP Top 10:2025, plus what those failures mean for agents and Non-Human Identities (NHI).

    @@ -535,7 +535,7 @@
  • Private keys should never be directly accessible to agents. Use an orchestrator or trusted signer to perform operations on behalf of the agent.
  • Treat Non-Human Identity (NHI) credentials as a full lifecycle asset: issue with least privilege, monitor use, rotate frequently, and revoke immediately when an agent is decommissioned or suspected of compromise.
    • -]]>    Theme 5: Configuration, Design & Resilience +]]>Theme 5: Configuration, Design & Resilience

    Theme 5 brings together three overlapping risks from the OWASP Top 10:2025 — Security Misconfiguration (A02:2025), Insecure Design (A06:2025), and Mishandling of Exceptional Conditions (A10:2025) — and adds the agentic risk of Cascading Failures (ASI08).

    @@ -649,7 +649,7 @@
  • Use digital-twin replay and policy gating to test risky decisions before live execution.
  • Keep tamper-evident logging and non-repudiation so every propagated action can be traced and audited.
    • -]]>    Theme 6 covers the risks that are unique to agentic systems, where software does not just respond to a single user but can act on its own, talk to other agents, and influence the people around it.

    +]]>    Theme 6 covers the risks that are unique to agentic systems, where software does not just respond to a single user but can act on its own, talk to other agents, and influence the people around it.

    Where earlier themes mapped classic application risks to the agent world, this theme is different: it focuses on three risks that only appear when multiple agents, or a human and an agent, share responsibility.

    @@ -751,7 +751,7 @@
  • Require periodic behavioural attestation and per-run ephemeral credentials, so compromise is time-bound.
  • Tie recovery or reintegration to fresh attestation and explicit human approval.
    • -]]>    Theme 7 brings the focus onto observability, logging and detection. These controls are cross-cutting: they support almost every other theme in this course.

    +]]>    Theme 7 brings the focus onto observability, logging and detection. These controls are cross-cutting: they support almost every other theme in this course.

    For traditional applications, good logging and alerting helps you detect breaches, investigate incidents and prove compliance. For agentic systems, the need is even stronger. Agents make sequences of decisions, call tools, talk to other agents and influence humans. Without a clear, tamper-evident record of what happened, you cannot attribute actions, detect drift or recover from failure.

    @@ -785,7 +785,7 @@

    For agents, the same principles apply, but the events are different. You should log tool calls, inter-agent messages, goal state and action sequences against a baseline. Track a stable goal identifier across the lifetime of a task so that every action can be traced back to the original request. Alert on goal drift and anomalous tool chains, and ensure non-repudiation and lineage for every propagated action.

    Strong observability turns an opaque agent into an accountable one: it is not enough to know what the agent said; you must be able to reconstruct what it did.

    -]]>    Putting it together: secure SDLC and threat modelling +]]>Putting it together: secure SDLC and threat modelling

    Secure code development is not a single step; it is threaded through the whole SDLC (Software Development Life Cycle). The two OWASP lists in this course — the OWASP Top 10:2025 for classic applications and the OWASP Top 10 for Agentic Applications 2026 — give you concrete risks to address at each phase.

    @@ -985,5 +985,24 @@

    License of this course

    -

    This course is licensed under CC BY-SA 4.0 (Creative Commons Attribution-ShareAlike 4.0). It is an adapted summary/derivative; changes were made; it is not endorsed by OWASP. Generated with the pi coding-agent harness v0.79.8 using LLM models glm-5.2 and kimi k2.7-coder.

    -]]>     +

    This course is licensed under CC BY-SA 4.0 (Creative Commons Attribution-ShareAlike 4.0). It is an adapted summary/derivative; changes were made; it is not endorsed by OWASP. Generated with the assistance of an AI coding agent.

    +]]>    Course complete + +

    You have reached the end of the Secure code development course — thank you for completing it.

    + +

    You have worked through the seven themes (access control and identity; injection, tools and execution; supply chain and integrity; cryptographic failures and secrets; configuration, design and resilience; agent communication, trust and autonomy; and observability, logging and detection) and the final comprehensive quiz.

    + +

    What happens next

    + +
      +
    • Your result has been recorded by the LMS (Learning Management System). If you did not reach the 80% pass mark, you can revisit the themes and retake the quizzes — your last attempt is the one that counts.
      • +
    • Keep the OWASP Top 10:2025 and the OWASP Top 10 for Agentic Applications 2026 to hand when you design, review or build agents. The checklists and threat-modelling steps in this course are a starting point, not a finish line.
      • +
    • Share feedback or suggest improvements via the course repository.
      • +
    + +

    One last reminder

    + +

    Security is layered: least privilege and least agency, defense in depth, fail secure, and assume compromise. For agents in particular — if you cannot see what it did and prove why, you cannot trust what it built.

    + +

    You may now close this window.

    +]]>     diff --git a/source/preview.xml b/source/preview.xml index aba5b17..ebf547a 100644 --- a/source/preview.xml +++ b/source/preview.xml @@ -41,7 +41,7 @@

    Provenance

    -

    Generated with the pi coding-agent harness v0.79.8 using LLM models glm-5.2 and kimi k2.7-coder. Not endorsed by OWASP.

    +

    Generated with the assistance of an AI coding agent. Not endorsed by OWASP.

    Build

    @@ -207,7 +207,7 @@
  • Detect delegated and transitive permissions — model the full delegation chain. If agent A delegates to agent B, the effective permissions should be the intersection of what A and B are each allowed to do.
  • Managed NHI (Non-Human Identity) — place agent identities in a dedicated identity platform such as Entra, AWS Bedrock, or Agentforce. Use lifecycle management, rotation, and audit for non-human accounts just as you would for human employees.
    • -]]>This theme traces how untrusted input becomes unintended action. We start with classic injection, then follow the chain into agentic territory: agents whose goals can be hijacked, whose tools can be misused, and whose generated code can execute unexpectedly.

    +]]>This theme traces how untrusted input becomes unintended action. We start with classic injection, then follow the chain into agentic territory: agents whose goals can be hijacked, whose tools can be misused, and whose generated code can execute unexpectedly.

    For engineers building agents, the lesson is that input validation, intent checks, and execution boundaries matter at every layer.

    ]]>    Injection @@ -232,7 +232,7 @@
  • Parameterised queries / prepared statements — keep data separate from code; never concatenate SQL strings.
  • Allowlist input validation — validate type, length, format, and character set against an explicit allowlist.
  • Escape and encode for the target interpreter when a safe API is unavailable.
    • -
  • Use safe ORM (Object-Relational Mapping) APIs and stored procedures correctly.
    • +
  • Use parameterised query APIs and stored procedures correctly; an ORM (Object-Relational Mapping) is not automatically safe — use its parameterised methods and never concatenate raw input into queries.
  • Apply least privilege to database accounts so an injection cannot reach administrative data.
    • ]]>    Overview @@ -329,7 +329,7 @@
  • Static scans before execution. Run security scanners and dependency checks on generated code before it is executed.
  • Runtime monitoring. Observe file, network, and process activity during code execution and terminate anomalous behaviour.
    • -]]>    Theme 3: Supply Chain & Integrity looks at trust in code, data, and context. In classic software, the supply chain is mostly static: libraries, packages, build tools, and the CI/CD (Continuous Integration / Continuous Deployment) pipeline that produces your artefact. If any of those ingredients are tampered with, the final application carries the flaw. The OWASP Top 10:2025 tracks this as Software Supply Chain Failures (A03:2025) and Software or Data Integrity Failures (A08:2025).

    +]]>    Theme 3: Supply Chain & Integrity looks at trust in code, data, and context. In classic software, the supply chain is mostly static: libraries, packages, build tools, and the CI/CD (Continuous Integration / Continuous Deployment) pipeline that produces your artefact. If any of those ingredients are tampered with, the final application carries the flaw. The OWASP Top 10:2025 tracks this as Software Supply Chain Failures (A03:2025) and Software or Data Integrity Failures (A08:2025).

    Agentic systems extend that same idea into a dynamic, runtime supply chain. An agent does not just import a dependency at build time; it can discover and compose tools, models, prompts, and other agents at runtime. This composition happens through protocols such as the Model Context Protocol (MCP) and Agent-to-Agent (A2A) frameworks, and through registries that advertise tool or agent capabilities. Each extra capability is a dependency that can be malicious, misconfigured, or compromised.

    @@ -492,7 +492,7 @@
  • Decay / expire unverified memory. Reduce the trust weight of unverified entries over time and eventually remove them.
  • Trust-weighted retrieval. Rank search results by source trust and confidence, not just embedding similarity.
    • -]]>    Theme 4: Cryptographic Failures & Secrets +]]>Theme 4: Cryptographic Failures & Secrets

    Theme 4 explores Cryptographic Failures (A04:2025) from the OWASP Top 10:2025, plus what those failures mean for agents and Non-Human Identities (NHI).

    @@ -535,7 +535,7 @@
  • Private keys should never be directly accessible to agents. Use an orchestrator or trusted signer to perform operations on behalf of the agent.
  • Treat Non-Human Identity (NHI) credentials as a full lifecycle asset: issue with least privilege, monitor use, rotate frequently, and revoke immediately when an agent is decommissioned or suspected of compromise.
    • -]]>    Theme 5: Configuration, Design & Resilience +]]>Theme 5: Configuration, Design & Resilience

    Theme 5 brings together three overlapping risks from the OWASP Top 10:2025 — Security Misconfiguration (A02:2025), Insecure Design (A06:2025), and Mishandling of Exceptional Conditions (A10:2025) — and adds the agentic risk of Cascading Failures (ASI08).

    @@ -649,7 +649,7 @@
  • Use digital-twin replay and policy gating to test risky decisions before live execution.
  • Keep tamper-evident logging and non-repudiation so every propagated action can be traced and audited.
    • -]]>    Theme 6 covers the risks that are unique to agentic systems, where software does not just respond to a single user but can act on its own, talk to other agents, and influence the people around it.

    +]]>    Theme 6 covers the risks that are unique to agentic systems, where software does not just respond to a single user but can act on its own, talk to other agents, and influence the people around it.

    Where earlier themes mapped classic application risks to the agent world, this theme is different: it focuses on three risks that only appear when multiple agents, or a human and an agent, share responsibility.

    @@ -751,7 +751,7 @@
  • Require periodic behavioural attestation and per-run ephemeral credentials, so compromise is time-bound.
  • Tie recovery or reintegration to fresh attestation and explicit human approval.
    • -]]>    Theme 7 brings the focus onto observability, logging and detection. These controls are cross-cutting: they support almost every other theme in this course.

    +]]>    Theme 7 brings the focus onto observability, logging and detection. These controls are cross-cutting: they support almost every other theme in this course.

    For traditional applications, good logging and alerting helps you detect breaches, investigate incidents and prove compliance. For agentic systems, the need is even stronger. Agents make sequences of decisions, call tools, talk to other agents and influence humans. Without a clear, tamper-evident record of what happened, you cannot attribute actions, detect drift or recover from failure.

    @@ -785,7 +785,7 @@

    For agents, the same principles apply, but the events are different. You should log tool calls, inter-agent messages, goal state and action sequences against a baseline. Track a stable goal identifier across the lifetime of a task so that every action can be traced back to the original request. Alert on goal drift and anomalous tool chains, and ensure non-repudiation and lineage for every propagated action.

    Strong observability turns an opaque agent into an accountable one: it is not enough to know what the agent said; you must be able to reconstruct what it did.

    -]]>    Putting it together: secure SDLC and threat modelling +]]>Putting it together: secure SDLC and threat modelling

    Secure code development is not a single step; it is threaded through the whole SDLC (Software Development Life Cycle). The two OWASP lists in this course — the OWASP Top 10:2025 for classic applications and the OWASP Top 10 for Agentic Applications 2026 — give you concrete risks to address at each phase.

    @@ -985,5 +985,24 @@

    License of this course

    -

    This course is licensed under CC BY-SA 4.0 (Creative Commons Attribution-ShareAlike 4.0). It is an adapted summary/derivative; changes were made; it is not endorsed by OWASP. Generated with the pi coding-agent harness v0.79.8 using LLM models glm-5.2 and kimi k2.7-coder.

    -]]>     +

    This course is licensed under CC BY-SA 4.0 (Creative Commons Attribution-ShareAlike 4.0). It is an adapted summary/derivative; changes were made; it is not endorsed by OWASP. Generated with the assistance of an AI coding agent.

    +]]>    Course complete + +

    You have reached the end of the Secure code development course — thank you for completing it.

    + +

    You have worked through the seven themes (access control and identity; injection, tools and execution; supply chain and integrity; cryptographic failures and secrets; configuration, design and resilience; agent communication, trust and autonomy; and observability, logging and detection) and the final comprehensive quiz.

    + +

    What happens next

    + +
      +
    • Your result has been recorded by the LMS (Learning Management System). If you did not reach the 80% pass mark, you can revisit the themes and retake the quizzes — your last attempt is the one that counts.
      • +
    • Keep the OWASP Top 10:2025 and the OWASP Top 10 for Agentic Applications 2026 to hand when you design, review or build agents. The checklists and threat-modelling steps in this course are a starting point, not a finish line.
      • +
    • Share feedback or suggest improvements via the course repository.
      • +
    + +

    One last reminder

    + +

    Security is layered: least privilege and least agency, defense in depth, fail secure, and assume compromise. For agents in particular — if you cannot see what it did and prove why, you cannot trust what it built.

    + +

    You may now close this window.

    +]]>