SQL Injection
This is a classic security challenge where an app uses a SQL database and does not use parametrised query or ORM.
ISO/IEC 27001 · 2022 edition
ISO/IEC 27001 Secure Coding Challenges
ISO/IEC 27001:2022 Annex A Control 8.28 requires secure coding principles to be established and applied. Certification auditors expect a named framework, training records and a falling trend in findings, not a policy document nobody follows.
Ready when the auditor asks
Generate Your ISO/IEC 27001 Training Report
Every completed challenge rolls up into a ISO/IEC 27001 training report. Point and click to generate it, then hand it straight to your auditor, customer or partner the moment they ask for evidence.
Capability, not checkbox compliance
Hands-On Challenges for Every Category
Annex A Control 8.28 asks organizations to eliminate the security risks that arise from poor coding practice, through governance, code review and training tied to a recognized secure-coding framework. Annex A 6.3 sits above it, requiring that all personnel receive role-appropriate security awareness and training. Every challenge below is a real application with a real vulnerability in the categories 8.28's implementation guidance names: input validation, authentication, cryptography, error handling and secure design. Developers fix it without breaking functionality, and every verified fix is a training record and a certification-body-ready evidence trail.
Evidence for your certification audit
Start the CourseOWASP Top 10 Course
A named, structured secure-coding framework, exactly what Annex A 8.28 asks organizations to define and train against, taught through real breaches and hands-on fixes.
A.8.28 · Input Validation
Input Validation
Untrusted input treated as data, not as code or commands, is the first secure coding principle 8.28's guidance names.
A.8.28 · Authentication & Session Management
Authentication & Session Management
Secure login, token and session handling are named explicitly in 8.28's implementation guidance.
A.8.28 · Cryptographic Practices
Cryptographic Practices
Predictable randomness and weak key handling are the cryptography principle 8.28 asks secure coding standards to cover.
A.8.28 · Error Handling & Logging
Error Handling & Logging
Failing safely and logging without creating a new injection vector are both named in 8.28's guidance.
A.8.28 · Secure Design & Access Control
Secure Design & Access Control
Object-level authorization and rejecting insecure design patterns before they ship.
A.8.28 · Known Vulnerable Components & Supply Chain
Known Vulnerable Components & Supply Chain
8.28's guidance extends to build tooling and third-party components, not just first-party code.
Roll it out
Turn the Standard Into a Training Program
Assign these challenges to your team as learning pathways, track verified fixes, and report ISO/IEC 27001 coverage to auditors, customers and the board, with evidence, not attendance sheets.