Welcome to the SecAppDev Academy
Initially, the SecAppDev Academy offers high-quality recordings of previous lectures at SecAppDev. Over time, we'll keep expanding the SecAppDev Academy with more recordings, but also handouts and lecture summaries.
This site is a work in progress. Expect new content, better navigation, and more resources over time. Got suggestions? Let us know.
Dive into the lecturesCheck out these lectures from previous SecAppDev editions
SecAppDev 2024
Passkeys: the future of user authentication
Philippe De Ryck
User authentication has been a mess for ages. Attempts to fix it by adding more authentication factors might work, but is quite complex. But what if there's a world where we can replace this insecure first factor with single strong authentication mechanism? That's what passkeys promise to do! This session will dive head-first into passkeys. We not only explore passkeys from a user's perspective and a developer's perspective, but we also look at the mechanics under the hood. By the end of this session, you will understand how passkeys work and will know how to use them in your applications.
Watch LectureSecAppDev 2024
Practical cryptography with Tink
Neil Madden
There are many textbooks and courses to learn the theoretical foundations of cryptography, and particular constructions, but fewer dive into the details of how to translate that into working production code. In this session we will describe the challenges presented by traditional cryptography libraries, and the security vulnerabilities that can result from misuse. We will then examine modern hard-to-misuse libraries, focusing on Google’s Tink library. Particular attention is paid to key storage and management.
Watch LectureSecAppDev 2024
Security Signals - A framework to scale web security
Slawomir Goryczka
Ensuring the security of web applications developed by many different engineers requires a solid understanding of security details and can be quite hard to scale. Thus, a web security team should also own the rollouts of security features. This requires a mindset shift, and high-quality metrics and tools to perform such changes. In this session, we'll explore Security Signals, a framework for collecting and processing aggregated and de-identified traffic logs across all Google web properties. Using the adoption of strict CSP as an example, we will take a closer look at how all components work.
Watch LectureSecAppDev 2024
Secure coding: Back to Basics
Erlend Oftedal
In this lecture we will look at how we write and how we can influence the security of the code by writing it in a different way. We will look at constructs in the code and borrow a bit from modern Domain Driven Design to help make the code more secure. We will also challenge some of the ways developers typically write software. The lecture should be relevant to both junior and experienced developers.
Watch LectureSecAppDev 2025
Break things, but not security: CI/CD done right
Gijs Van Laer
This session explores how to build fast, secure CI/CD pipelines without compromising on velocity. We dive into the dangers of over-automation, like supply chain attacks and secret leaks, and show how embedding security early mitigates these risks. Supported by real-world attack examples, we learn which tools are must-haves and which can wait. We will also examine the economics of security tooling: comparing built-in, open-source, and vendor solutions, so you can make smart, secure choices at scale.
Watch LectureSecAppDev 2025
Continuous Threat Modeling: Let Developers Figure It Out
Izar Tarandach
Threat Modeling has customarily been seen as a black art,a bit of an arcane discipline that not many are privy to. And that is, basically, wrong. Everyone threat models, all the time. And they very well should!\n\nIn this talk we will look at a couple of traditional Threat Modeling methodologies, what they're good for, what they miss, and offer a new one that your developers can run with - agile and principle-based. \nAfter that we will look at a threat-modeling-with-code tool, OWASP pytm, that can be used to support continuous threat modeling by your teams, see how it helps and what it doesn't do.
Watch LectureSecAppDev 2025
OpenAPI as a security tool, not just documentation
Philippe De Ryck
OpenAPI specifications are more than just documentation—they can be a powerful foundation for improving your application's security. This talk explores how to effectively use OpenAPI in both code-first and spec-first workflows. We’ll discuss how well-crafted specs help uncover security issues, guide audits, and power security tools for testing, automated attacks, and even runtime protection. You’ll walk away with practical insights into turning your API specs into a security asset, not just a developer convenience.
Watch LectureSecAppDev 2025
Verifiable Credentials: Concepts to Practice
Kristina Yasuda
This session introduces the core concepts of Verifiable Credentials (VCs) with a focus on OpenID for Verifiable Credentials (OpenID4VC) protocols, main credential formats (ISO mdoc and IETF SD-JWT VC). We’ll explore real-world use cases, key implementation lessons, and the role of interoperability profiles in enabling secure and scalable deployments. The talk also includes highlights challenges and design decisions across the identity tech stack and updates to different specifications driven by implementation feedback.
Watch LectureSecAppDev 2026
AI Memory, Mapped
Natalie Isak
Persistent memory transforms AI systems from stateless tools into context-aware systems, but it also introduces a class of risks. We will cover key risks including continuous exfiltration via prompt injection, delayed tool invocation, and negative psychosocial impacts. The second half focuses on building memory-safe systems by design: threat modeling memory, observability strategies, and runtime safety monitoring at scale (including BinaryShield, a novel privacy-preserving method for sharing textual customer content to detect coordinated spray attacks).
Watch LectureSecAppDev 2026
SBOMs and their Role in Security
Alexios Zavras
A practical deep dive into Software Bills of Materials (SBOMs): what they are, what they are not, and how they fit into modern software security. We will cover common data models and formats, how SBOMs are produced and consumed, and how they enable better visibility and faster decision-making across the software lifecycle. Interactive participation is particularly encouraged.
Watch LectureSecAppDev 2026
Secure by Design — Ideas and Techniques
Dan Bergh Johnsson, Daniel Deogun
Most security vulnerabilities aren't introduced by careless developers. They're made possible by design decisions that nobody flagged as security decisions at the time. This session introduces Secure by Design as a way of thinking, not a checklist. We'll look at how everyday design choices — how you model your domain, define your types, draw your boundaries — can close down attack surfaces. The same thinking that makes code correct and maintainable tends to make it secure. Security becomes a property that emerges from good design rather than a layer bolted on afterwards.
Watch LectureSecAppDev 2026
An Updated Security Model of the Web
Philippe De Ryck
Web security is messy, complicated, and under constant evolution. Often, you even start wondering why certain issues cannot be solved by the browser directly. In this session, we investigate the security model of the web. We learn how browsers think about security, and how we can leverage that to build more secure applications. We explicitly focus on new browser features and how they can be used. Examples include the sanitization API, new cookie prefixes, as well as features focusing on script integrity. This session will give you an up-to-date understanding of browser security in the modern age.
Watch Lecture