Secure Coding in C++

Course details

Learn how to write secure C++ code by addressing the language’s most common risks and vulnerabilities. This course focuses on practical, code-level techniques for preventing exploits related to input handling, memory misuse, and object lifetime. You'll use modern C++ features and secure coding standards to harden your code. This course is an ideal fit for developers who want to learn how to build safer, more resilient applications.

Learning objectives
Identify language-level features in C++ that are prone to security vulnerabilities and undefined behavior.
Apply modern C++ practices to handle input, memory, and resources securely.
Evaluate code for common security flaws such as use-after-free, format string vulnerabilities, and data exposure.
Analyze external data handling and object lifetimes to prevent exploitation.
Create secure, hardened C++ implementations using safe patterns, compiler features, and runtime protections.

Concepts

0. Introduction

01 - Safety bugs become exploits
02 - Secure coding standards
03 - Using the exercise files in GitHub Codespaces

1. Security Starts with the Language

04 - Exploitable language features in C++
05 - Risks of undefined behavior
06 - Safer alternatives in modern C++
07 - Fixing unsafe expressions

2. Validating and Trusting External Data

08 - Defensive input handling
09 - Safe numeric and string conversions
10 - Preventing format string vulnerabilities
11 - Challenge - Secure a data parsing function
12 - Solution - Secure a data parsing function

3. Strings, Secrets, and Exposure

13 - Secure use of std - - string and string view
14 - Avoiding C-style string vulnerabilities
15 - Preventing information leaks in logs
16 - Challenge - Hacking the hardcoded password
17 - Solution - Hacking the hardcoded password

4. Memory and Object Lifetime Exploits

18 - Dangerous pointer and reference scenarios
19 - Preventing use-after-free and double deletes
20 - Avoiding memory leaks
21 - Challenge - Smart pointers
22 - Solution - Smart pointers

5. Hardening Your Build and Behavior

23 - Compiler and linker flags for security
24 - Writing secure error handling code

Conclusion

25 - Next steps