Sprint26: Engineering for Quality
You cannot sprinkle security onto an application right before launch like powdered sugar. In software engineering—especially when handling people's money, contributions, and personal data—quality and security are systemic properties. They must be baked into the foundation.
In the seventh session of the Sprint26 series, we shift our focus to SWEBOK Chapter 12 (Software Quality) and Chapter 13 (Software Security). We are stepping away from pure feature development to learn how to actively think like an attacker, audit our own work, and defend our systems against real-world vulnerabilities.
What we’ll cover:
The Quality Mindset: Moving past compliance checklists to understanding quality as an architectural pillar.
Application Security (AppSec) Fundamentals: Breaking down the OWASP Top 10, input validation flaws, authentication vulnerabilities, and accidental data exposure.
The Fintech Target: An honest look at why financial applications are high-value targets and what it takes to protect them.
The Codelab: We are putting the Zetu codebase under the microscope for a rigorous security audit. In this hands-on lab, we will:
Conduct a live vulnerability assessment of our current build.
Locate and patch at least three critical vulnerabilities (including SQL injection risks, exposed secrets, and improper authentication).
Implement strict, centralized input validation across all API endpoints.
Review our M-Pesa integration architecture to ensure it aligns with strict security compliance standards.