OWASP Top Ten course

I was the subject matter expert on a commercial course covering the OWASP Top Ten, and I owned its technical accuracy. Each risk category became a set of branching scenarios where the learner picks a response and sees the consequence, including the plausible wrong answers that fail for non-obvious reasons.

Writing those branches meant reasoning about each vulnerability class carefully enough to know why a defensible-sounding mitigation still leaves you exposed. Securing the channel while leaving the payload in the clear. Rotating to a modern cipher and then implementing it with a reused key. I had to be right about these before I could write them.