DHIVA LABS · LEARN

Appearance

Security and safe habits ​

Learn the habits that keep your accounts, your code and your devices out of trouble: what to protect and from whom, where secrets leak, what a running server exposes, how to tell a genuine download from a fake one, how to scan your own code, and how to test things without harming anyone.

What you will be able to do ​

By the end of this track you can:

  • write a short threat model for yourself or a project: what you protect, from whom, and how;
  • keep passwords and API keys out of screenshots, chats, commits and logs, and handle a leaked one in the right order: rotate first, clean up second;
  • read ss -tln, tell 127.0.0.1 from 0.0.0.0, and close what you opened on a network;
  • verify a download with sha256sum -c, and decide whether to trust an installer;
  • scan a project with DL Sentinel, read its findings, fix one, and adopt a baseline;
  • explain why permission and scope come before any test, and report a vulnerability responsibly.

Who it is for ​

Students, testers, new developers and careful home users. You do not need to be a programmer for lessons 1 to 4. Lessons 5 and 6 and the lab use a terminal, and the lab needs a Linux computer with Node.js for DL Sentinel.

Everything in this track is about protecting your own things, or things you have been given permission to test.

The lessons ​

Read them in order. Each one starts from what the one before taught.

Lesson 1Threats in plain wordsA simple threat model, and the common attacks: phishing, password reuse, leaked tokens, fake Wi-Fi, fake downloads, lost devices.Lesson 2Passwords and secretsPassword managers, two-factor sign-in, API keys and tokens, where secrets leak, and what to do when one does.Lesson 3Safe networksWhat a running server exposes, 127.0.0.1 and 0.0.0.0, LAN sharing and public tunnels, ADB over Wi-Fi, public Wi-Fi and host keys.Lesson 4Safe installsOfficial sources, checksums, signatures, SmartScreen, sideloaded APKs and keeping software updated.Lesson 5Scanning your codeSecrets, vulnerable dependencies and insecure code, CVEs, false positives and baselines, locally and in CI.Lesson 6Responsible testingPermission and scope, load tests, scanning, NFC cloning, devices that are not yours, and responsible disclosure.LabFind the secretsScan a deliberately insecure project with DL Sentinel, fix a finding, add a baseline, then check your own machine.

Every lesson ends with a short quiz. Your scores are collected on the Quizzes page.

Apps that use this knowledge ​

AppWhat it does for your security
DL SentinelScans your own code, offline, for secrets, vulnerable dependencies, insecure code and risky infrastructure files. Lesson 5 and the lab.
CloakpasteSwaps keys, emails and names for placeholders before you paste text into an AI chat. Lesson 2.
SecureShell GoAn SSH client for Android that checks every server's host key. Lesson 3.
ApiWorkbenchAn API client with secret variables, and exports you should check before sharing. Lessons 2 and 6, and the lab.
Mock StudioA mock API server that can be shared on your network or through a public tunnel. Lesson 3.
NFC WalletReads and copies NFC tags, and explains what can never be cloned. Lesson 6.
DroidDeckRuns adb for you, including wireless debugging. Lesson 3.
CloudDrop and DiskRescueBackups to your own cloud, and recovery when a drive fails. Lesson 1.
KilonovaA Monero wallet whose seed phrase is the master key to the funds. Lesson 2.

Other tracks this one connects to ​

Security runs through every field. These tracks go deeper on the parts that touch them:

How long it takes ​

About 20 minutes per lesson, plus 45 to 60 minutes for the lab. Around three hours in all, and you can stop after any lesson.

Next steps ​