Full schedule for SecAppDev 2025
SecAppDev 2025 offers a dual-track schedule with three days of lectures and two days of workshops. The schedule on this page is work in progress, and will be completed soon.
Please note that the schedule might be subject to change until the start of the course.
Monday June 2rd
Leveraging the security model of the web
Introductory lecture by Philippe De Ryck in room Lemaire
Web security is complex and evolving fast, with browsers playing a growing security role. This session explores core techniques to build secure apps and APIs, giving you the foundation to tackle more advanced web security topics.
Key takeaway: Learn how modern browsers approach security and how to build on that foundation to create secure web apps and APIs using proven core techniques.
Continuous Threat Modeling: Let Developers Figure It Out
Deep-dive lecture by Izar Tarandach in room West Wing
Continuous Threat Modeling for Developers. They're creating the problems, let them create the solution! No, really - enable them to see the security value of the stories they work on, what could go wrong, and what to do about them.
Key takeaway: Threat Modeling should not be a one-shot-and-done activity by security experts. It needs to be continuous, at the developer level.
OpenAPI as a security tool, not just documentation
Deep-dive lecture by Philippe De Ryck in room Lemaire
OpenAPI specs are more than docs—they can drive API security. Learn how to use them in spec/code-first workflows to find vulnerabilities, guide audits, and power security tools for testing, attacks, and runtime protection.
Key takeaway: A well-crafted OpenAPI spec can uncover security issues, guide audits, and power tools for testing, making it a key asset in your API security strategy.
Using AI to write Secure React.JS code
Deep-dive lecture by Jim Manico in room West Wing
In this talk, we will explore the massive potential of AI in secure code creation. This session will discuss techniques that will aid AI code creation engine to produce higher quality and more secure code.
Key takeaway: Actionable advice on using AI to generate secure code
Tuesday June 3th
The Bug Bounty Effect: From DevSecOops to Success!
Deep-dive lecture by Emil Vaagland in room Lemaire
Discover how bug bounty programs outperforms traditional AppSec tools by uncovering more vulnerabilities at lower cost. We share real-world examples, strategies, and challenging takes on conventional security practices.
Key takeaway: Bug bounty programs are essential and should be the key ingredient in modern AppSec programs.
Using WebAssembly to run, extend, and secure your app
Introductory lecture by Niels Tanis in room West Wing
In this session we'll dig into WASM, how it works, it's security features and how we can use it to host, extend and secure our applications by running it the WebAssembly System Interface (WASI).
Key takeaway: Understanding WASM, it's security features and how leverage those by integrating it into your application/software.
Break things, but not security: CI/CD done right
Deep-dive lecture by Gijs Van Laer in room Lemaire
Learn how to secure your CI/CD pipeline without slowing down. We cover risks, best practices, essential tools, real-world attacks, and how to justify your security investments.
Key takeaway: Secure CI/CD is achievable without sacrificing speed: start with key tools, embed best practices, and scale smart.
Breaking and securing OAuth 2.0 in frontends
Deep-dive lecture by Philippe De Ryck in room Lemaire
Using OAuth 2.0 in the frontend increases your attack surface. Learn why BFF is safer and how to defend against real-world token attacks.
Key takeaway: Frontend OAuth 2.0 patterns, even with token protections, leave apps exposed—real security comes from moving sensitive logic to a secure backend.
Reviewing 3rd party libraries security using Scorecards
Introductory lecture by Niels Tanis in room West Wing
We rely on 3rd party libraries which results in security risks. OpenSSF’s Scorecard helps assess package security. This session explores its checks and additional insights to strengthen supply-chain security.
Key takeaway: Understanding how to leverage the OpenSSF Scorecard to review used 3rd party libraries more easily.
Get out of your Bubble: Collaborative Threat Modeling
Deep-dive lecture by Avi Douglen in room Lemaire
Threat modeling by yourself is great - noone is there to tell you you're wrong. But if you want to discover nontrivial issues, the ones you'd not have on your checklist, you'll need to engage with others. But too often we chase them away.
Key takeaway: Threat modeling is not JUST a technical activity, and should intentionally leverage social techniques to maximize stakeholders participation.
Master application security: Learn from global experts at SecAppDev
Grab your seat nowWednesday June 4th
Navigating the Security Landscape of Modern AI
Deep-dive lecture by Vera Rimmer in room West Wing
In this session, we will overview the general security landscape of AI technologies, including foundational machine learning, deep learning, and large language models.
Key takeaway: Integrating AI inevitably increases the threat landscape of a system. Understanding how AI can be exploited is key to developing effective mitigations
The Engineer’s Guide to Data Privacy
Deep-dive lecture by Vera Rimmer in room Lemaire
In this session we will walk through the engineer’s toolbox for protecting different types of data against common privacy threats. The talk is informed by existing practical tools as well as by modern research on data privacy.
Key takeaway: Privacy is an engineering responsibility, not only a legal or design issue. Privacy-preserving techniques are accessible and implementable today.
Value Driven Security - A Roadmap to Business Alignment
Introductory lecture by Avi Douglen in room West Wing
Much of security today is generic best practices and checkbox olympics. Shame to waste resources on stuff noone really cares about! Better to map out the business' value streams, and invest efforts in protecting what is actually important.
Key takeaway: Strategic planning requires understanding your environment, your goals, and your challenges. Value-driven mapping techniques help you get there.
My Name Is Not Cassandra: AppSec and "I Told You So"
Advanced lecture by Izar Tarandach in room Lemaire
Lack of authority, an outsider's view of the development process and a faulty language of risk..Are security practitioners fated to point at risk and not be heard?
Key takeaway: "Raw" security can be fun, but does not lead to change. We must adapt our ways in order to impact the environment we want to protect.
Thursday June 5th
LLM Security Bootcamp: Foundations, Threats, and Defensive Techniques
One-day workshop by Thomas Vissers and Tim Van Hamme in room Lemaire
Large Language Models (LLMs) open up a new realm of possibilities in application development, but they also pose significant challenges. Their non-deterministic nature and broad use cases complicate testing, while unpredictable failures (“hallucinations”) and novel attack vectors (“prompt injections”) add risk.
This workshop covers LLM-based applications, highlights unique threats, and offers hands-on testing and hardening techniques. Attendees will learn to set up and secure basic LLM-driven solutions in their organizations.
Learning goal: Learn how LLM applications work and are architected, the unique security challenges they introduce, and the current best practices in LLM security—along with their limitations.
No Size Fits All: Customized Application Security Tests
One-day workshop by Avi Douglen in room West Wing
The interesting, important, and hard to find bugs are not generic. They often stem from unique business logic, so they require familiarity with the product.
Instead of getting frustrated with generic scans that barely find obvious problems and flood you with false positives, you can run custom checks that find what you care about. In this course, you'll learn how to take your internal knowledge and write custom, tailored scans that will work for you, across the whole codebase.
You’ll leave the course with clear understanding how to customize automated security tests for your code efficiently.
Learning goal: Learn how to find subtle, non-generic bugs in your code, make the most of open-source scanners, and set up smart security guardrails—all with practical techniques that fit into real-world development workflows.
Transform your career: Secure your spot in SecAppDev's unforgettable AppSec experience!
Grab your seat nowFriday June 6th
Hands-on deep-dive into frontend security
One-day workshop by Philippe De Ryck in room Lemaire
Modern web applications rely heavily on frontend code, making browser security mechanisms crucial for protecting users and data. This hands-on workshop takes a deep dive into advanced frontend security for Angular / React / Vue applications.
Participants will explore real-world attack scenarios and implement defenses through guided exercises. Designed for developers and security professionals, this workshop blends academic depth with practical application, equipping attendees with the skills to secure modern frontends effectively.
Learning goal: Understand and apply state-of-the-art security mechanisms to protect modern frontends from real-world threats.
Secure Coding Workshop
One-day workshop by Jim Manico in room West Wing
This hands-on workshop teaches developers the principles of secure coding, focusing on real-world attack scenarios and defense strategies. Participants will learn to identify and mitigate vulnerabilities such as injection flaws, XSS, authentication weaknesses, and insecure dependencies. Using AI code generators and security tools, attendees will strengthen their ability to write robust, secure applications.
Ideal for developers looking to enhance their security mindset and build software that withstands modern threats.
Learning goal: Attendees will learn to build secure APIs by preventing injection attacks, managing third-party risks, OAuth2 basics, securing React integrations, and handling file uploads safely. They will also explore AI-assisted code generation.