Description
Test, attack and secure an AI-generated web application with automated end-to-end tests, multi-model AI code review and hands-on red-teaming of access control, injection, secrets and AI features.
Price$1,000Per person
Time10 course hoursOn-demand video and labs, plus 1 hour of coaching
DeliveryOn-demand asynchronous trainingWith online support and 1 hour of coaching
CredentialCertificate of completionFrom We Can Code IT
Your capstone, reviewed by a coach
You finish by testing and red-teaming an app, and your coach reviews your results with you: the passing test suite, the findings log with each fix proven by a test, and your release decision. That review is part of earning your certificate.
Group coaching for teams
Each learner gets 1 hour of coaching. Teams pool their hours into group sessions, so a team of 6 shares 6 hours of group coaching.
About this course
AI app builders now scan for common security mistakes before you publish, but a scanner cannot tell whether your access rules match how your business should work. In this course you go past the scanners and test and secure the application itself: you run the built-in scans first, then write automated end-to-end tests, have two different AI models attack the code and argue over their findings, and red-team your own app for the most common web risks and for prompt injection in AI features. Every fix is proven by a test that failed before and passes after. This course is distinct from Implementing AI in Software Testing, which teaches AI-powered QA tools; here you test and secure the application you built.
Who it is for
This course is for developers, citizen developers, QA staff, technical product owners, and entrepreneurs and founders who build or approve AI-generated web applications.
Prerequisites
AI-Assisted Web Application Development, or a working web app with a database and sign-in (a reference app is provided)
No test-writing experience is needed; starter tests are provided, and you adapt and extend them
Requirements
Works on Windows, macOS or Linux
Node.js and Playwright (free), a code editor such as Visual Studio Code (free)
A free GitHub account and access to the app's backend (Lovable Cloud or Supabase)
Access to two different AI assistants (for example Claude and ChatGPT), following your employer's data privacy rules
What you will be able to do
- You will be able to write automated end-to-end tests in Playwright for an app's critical paths and their most likely failures.
- You will be able to run an adversarial code review in which two different AI models independently attack the same code, and reconcile their findings.
- You will be able to test a web application for broken access control, injection, exposed secrets and weak authentication using the OWASP Top 10.
- You will be able to test an AI feature for prompt injection and unsafe output, and configure defenses.
- You will be able to fix each finding test-first and produce a findings log and a release decision backed by passing tests.
Syllabus
1
Failure modes in AI-generated code 1 hour
Code that runs but does not work, Common defects in generated code, What built-in security scans check and miss, Who reviews the reviewer.
Lab: You will run Lovable's security scan on an AI-generated app, read its code and predict three failures the scan missed, then run the app to check your predictions.
2
Automated end-to-end tests 2 hours
Playwright setup, Critical paths and failure cases, Test data and test users, Writing the failing test first.
Lab: Starting from provided Playwright tests, you will adapt them for sign-up, sign-in and your app's main task, and add one that fails today.
3
Adversarial AI code review 1.5 hours
Builder and reviewer as different models, Review prompts that demand vulnerabilities, Making reviewers argue, Separating real findings from noise.
Lab: You will have two different AI models attack your app's code independently, then reconcile their findings into one list.
4
Red-teaming access control, injection and secrets 2 hours
OWASP Top 10, Broken access control and row-level security, SQL and script injection, Exposed keys in code and the browser, Authentication settings.
Lab: You will sign in as one user and try to read or change another user's data, find exposed keys, and close every hole you find.
5
Red-teaming AI features 1 hour
Prompt injection, Untrusted input treated as data, Unsafe and leaking output, OWASP Top 10 for LLM applications.
Lab: You will plant a hidden instruction in content your app's AI feature reads, see whether it obeys, and configure a defense.
6
Test-first fixes and release decisions 1 hour
Reproducing a finding as a test, Fixing and retesting, Findings log, Release decision criteria.
Lab: You will fix your top three findings, each with a test that failed before the fix and passes after.
7
Capstone 1.5 hours
Test suite, Adversarial review report, Red-team findings log, Release decision.
Lab: You will present your app's test suite, review report, findings log and release decision to your coach.
+
Coaching sessions 1 hour
Your coach reviews your capstone with you and answers questions as you work. Teams pool their hours into group sessions, so a team of 6 shares 6 hours of group coaching.
How it is delivered
How you learn
On-demand asynchronous training with online support, plus 1 hour of coaching.
Live or in person
Live online or in-person sessions are available for an additional fee. Email admissions@wecancodeit.org for details.
Frequently asked questions
How do you secure a vibe-coded app?
Run your builder's security scan first, then test it as an attacker would. Check that one user cannot read another user's data, look for exposed keys, test inputs for injection, and test any AI feature for prompt injection. Then prove each fix with an automated test.
How do you test AI-generated code?
Write automated tests for what the app must do and the ways it is most likely to fail, and have a different AI model review the code than the one that wrote it. This course teaches both, using Playwright and two AI assistants.
Doesn't Lovable already check my app's security?
Partly. Lovable scans for common mistakes, such as missing access rules and leaked keys, and can connect a paid AI penetration test. Its own documentation says the scans do not replace a security review. A scanner cannot know your intended permissions, such as whether a manager may see another team's records, so this course teaches you to test those yourself.
How is this different from Implementing AI in Software Testing?
That course teaches AI-powered QA tools such as Testim, Katalon and Applitools. This course tests and secures the application itself: access control, injection, secrets and AI features.
What does the coaching include?
Each learner gets 1 hour of coaching. Your coach reviews your capstone with you and answers questions as you work through the labs. Teams pool their hours into group sessions, so a team of 6 shares 6 hours of group coaching.
How long does it take and what does it cost?
10 course hours of on-demand video and labs plus 1 hour of coaching, for $1,000 per person.
Related courses
Build, configure and publish a database-backed web application with user sign-in and access rules, using AI coding tools directed by a written specification and managed in Git.
10 course hours, $1,000
Use AI-powered tools to generate test data, select tests, predict defects and run more stable automated tests with Selenium, Katalon, Testim and Applitools.
12 course hours, $1,200
Deploy a web application from GitHub to Vercel, configure a custom domain with DNS and HTTPS, manage environment secrets, release through protected pull requests, and set up monitoring, alerts and backups.
10 course hours, $1,000
Set up and use GitHub for real work: repositories, branches, pull requests, issues, Projects, Actions, Copilot and Codespaces, security settings, with preparation for the GitHub Foundations (GH-900) exam.
8 course hours, $800
Enroll your team
One or a few learners
Choose the number of seats, add the course to your cart and check out.
A group, or a written quote
Send the form below for group enrollment or a written quote. We reply within one business day. You can also email admissions@wecancodeit.org.
We Can Code IT, LLC, 26300 Cedar Rd, Suite 1105, Beachwood, OH 44122. Registered with the Ohio State Board of Career Colleges and Schools, Registration No. 15-03-2064T.
