Working doesn't mean secure.

Secure?

Protect the AI project you built yourself to international standards without writing code.

If you are a vibe coder or a junior developer, you will find the loopholes in your app, fix them with AI and re-check them with an agent. With The 15-Control Standard, built on OWASP, ASVS, PCI DSS and Uzbek law, you review your own app again.

See the curriculum

The app is ready in a day. Its security is still untested.

  • 4modules
  • 14lessons
  • 1Codelab project

What you can do by the end

  • Run The 15-Control Standard on any project of yours and close the loopholes one by one.

  • Explain every control in one plain sentence and know which standard it comes from.

  • Fix the loopholes in your app with AI, without searching Google.

  • Have a security team of two AI agents: one finds loopholes and flaws, the other checks and fixes them.

  • Know where OWASP Top 10, ASVS, PCI DSS and Uzbek law apply.

  • Connect Telegram alerts to your app: a suspicious login attempt sends a message to your bot.

  • Scan any project of yours with a ready-made security plugin (a set of skills): it finds the loopholes and suggests how to fix them, and you fix them easily with your own agents.

Who it is for, and who it isn't

Not from zero: you need at least one project built or started with AI.

This course is for you if

  1. You built a site, a bot or a web app with Claude Code or Cursor and want to hand it to users.

  2. You are a junior developer: you have heard of SQL injection and XSS but never seen how they work in a real app.

  3. You built your startup yourself, and it holds real users, payments or personal data.

  4. When a client or investor asks "is your app secure?", you can't give a clear answer.

This course is not for you if

  1. You haven't built anything yet. Start with the "Build with AI" course first, then come here.

  2. You are an experienced security engineer or pentester (a specialist who breaks into apps on commission). The course deliberately explains the standards in plain language.

  3. You want to learn exploit writing and deep attack techniques. The course teaches you to defend your own app.

  4. You are not ready to pay monthly for a Claude Pro or Max subscription. The course runs on those subscriptions.

Four modules

Workspace set-up, Practice, Learning, Automation. Each module builds on the one before. On Premium every module closes with an exam.

01

Workspace set-up

Introduction and setup
01"It works" does not mean "it is secure"

By the end of the lesson you ask any working app the second question yourself: "Does it work? Yes. Is it secure?" With one command you see the app's loopholes, learn from an exact figure how widespread the problem is, and understand in one sentence why two apps that look the same are different.

02Installing and learning the tools you need

By the end of the lesson you open your folder in Warp, start Claude Code inside it, learn what Claude's modes are and how they work, and understand the / commands.

03Building your security agent

By the end of the lesson you create your own security agent inside Claude Code (in the .claude/agents/ folder), give it a task, a skill (a ready-made instruction for the agent) and a boundary, then call it by name.

02

Practice

Fixes for the 15 most common Loophole: a security hole in an app. The app keeps working, but an outsider can use it to reach data or break the system. in apps
04The control checklist

By the end of the lesson you know what The 15-Control Standard is, the answer to the 15 loopholes: 15 controls checked before an app ships. You go through the three categories one at a time and explain the rule "If 1 to 11 do not pass, do not ship".

05Category 1: what to check first?

The first category live on the teahouse app, five controls one at a time: the password is stored in plain text, the login is open to unlimited attempts, a receipt that is not yours opens (IDOR), the cookie is unprotected, there is no MFA. Before each control you make a guess, and at the end of the lesson you see the prompt that closes each one.

06Category 2: how should data be stored?

The second category live on the teahouse app: the search box opens the whole database (SQLi), a comment turns into a foreign script (XSS), an unexpected field slips through in a request, the card number is stored in full. You learn the safe storage controls, then see the prompt that closes them in the same lesson.

07Category 3: what to do on the server side?

The third category live on the teahouse app: the payment key sits in the code (and stays in the git history), one endpoint (one request address in the app) runs up your costs without limit (denial of wallet), and who did what is recorded nowhere. At the end of the lesson you mark the whole checklist: 0 of 15 pass, because even a working app may pass no control at all.

03

Learning

The core standards you must know
08The OWASP organisation and the Top 10 risks

By the end of the lesson you say what the OWASP organisation is and what it does, explain OWASP Top 10 in one sentence (the ten most serious risks, a warning document, not a certificate) and name each of the ten on the 2025 list.

09ASVS: the application verification standard

By the end of the lesson you say what ASVS is (OWASP's verification standard: 17 chapters, 345 requirements), tell the three levels apart in plain words, can read a requirement number and know what a pentester or client means by ASVS L1.

10PCI DSS: the rule for storing card data (mandatory)

By the end of the lesson you say what PCI DSS is (the card networks' standard, binding by contract, 12 requirements), know the three rules of requirement 3 and explain the line between hosted checkout (the card is entered on the payment system's page) and a card API.

11Uzbek law: the rule for personal data

By the end of the lesson you say what ZRU-547 is and name your three duties as an operator (the one who collects and stores the data), know the change of 27 March 2026, the scale of the fines and Article 7-1 added by the AI law, and can say when the European GDPR applies.

04

Automation

The security pack: two agents
12Skill set: the skills that keep an app secure

You go through the skills the plugin will need. Each does one job, so they do not collide.

13Building the security agents and the plugin

You wire the six skills into the two agents they belong to: the white-hat hacker finds and proves, the cybersecurity engineer verifies and fixes. You gather everything into the security plugin folder and create three commands: /planaudit, /fullaudit, /checklist.

14Building alert notifications with a Telegram bot

You build the plugin's third part: with the alert-telegram skill you connect Telegram alerts to your app. Every login attempt is logged, and if a wrong password is entered 5 times in 15 minutes, a message arrives in the chat.

Along with the lessons

A video lesson alone is not enough. The lessons come with a setup guide, a glossary and prompts. On Premium every module closes with an exam.

  • 01Once · 20 minutes

    Prerequisites: the setup guide

    A step-by-step guide to installing the tools you need (Warp, Claude Code). After that you are ready for the first lesson.

  • 02Every modulePremium

    Module exam

    A test at the end of the module on the lessons it covered.

  • 03Every lessonPremium

    Course book

    The lessons' in-depth companion: one chapter per lesson.

  • 04Every lesson

    Glossary

    The words each lesson teaches, by module and lesson.

  • 05Every lesson

    Prompts

    The ready-made prompts used in the lesson. Copy them into your own project.

  • 06At the end of the coursePremium

    Security-Plugin

    Two security agents, a skill set and commands. Install it in any project of yours.

  • 07Throughout the course

    Codelab: Choyxona POS

    The sample teahouse app for practice, and the lesson files.

  • Anything marked Premium is in the Premium tier only

    See the tariffs

The 15-Control Standard

15 loopholes to check before you hand an app to users: mark each one "yes" or "no". This list was not invented for the course. It is gathered and ordered from global standards: OWASP Top 10:2025, OWASP ASVS 5.0, PCI DSS v4.0.1, Uzbekistan's law ZRU-547.

This is the sample app at the end of the course: 15 of 15 passed. Click a control's name to see what it checks.

The app release rule: you do not ship the app until 1 to 11 pass. 12 to 15 (marked "later") become mandatory from the day there are real users or a payment system.

What to check first

5 / 5
  • 02
  • 03
  • 04
  • 08
  • 12

How data should be stored

5 / 5
  • 05
  • 06
  • 09
  • 10
  • 13

What to do on the server side

5 / 5
  • 01
  • 07
  • 11
  • 14
  • 15
Sample app15 / 15
Akbarjon Olimov

QA engineer and pentester · since 2019

Akbarjon Olimov

My name is Akbarjon Olimov. I've been working as a QA engineer and pentester since 2019. For 7 years I've been testing software, automating tests, and finding security holes in web and mobile apps.

In my work I always ask two questions: does the app work correctly, and can someone break into it? In projects built fast with AI, the second question often gets forgotten. As a result, secret keys stay in the code, login has no limits, and user data is left exposed.

I'm not a cybersecurity guru. In this course, 4 modules and 14 lessons, I show you the exact checking routine I use every day. We'll learn to find loopholes and fix them with AI agents and my own checklist. It took me years to get here. You don't need to spend that long.

Two tiers, one curriculum

Both open all 14 lessons in full. The difference: you walk the path alone, or I walk it with you. Standard opens the lessons for 6 months, Premium for life. You pay in UZS: Payme, Click or Atmos.

Standard

For those who go alone, at their own pace

2,997,000UZS

One payment · 6 months of access

  • Video lessons14 lessons, 4 modules. 6 months of access.
  • Setup guideA step-by-step guide to installing the tools you need.
  • PromptsA ready fix prompt for every category. Copy and paste.
  • GlossaryA glossary of the words each lesson teaches.
  • Codelab: Choyxona POSThe sample teahouse app for practice, and the lesson files.
  • HEAD certificateAwarded at the end of the course.
  • Unlocks on Premium
  • Module examsA test at the end of every module on what it covered.
    On Premium
  • Video lessons for lifeNot 6 months: access with no end date, and future updates.
    On Premium
  • Course bookOne chapter per lesson: the lessons' in-depth companion.
    On Premium
  • Security-PluginTwo security agents, a skill set and commands. Ready and tested.
    On Premium
  • Private Telegram communityI answer the questions myself.
    On Premium

Premium

my pick

For those who want a mentor's advice along the way, the course book and the ready Security-Plugin

3,457,000UZS

One payment · lifetime access

  • Video lessons14 lessons, 4 modules. Lifetime access.
  • Setup guideA step-by-step guide to installing the tools you need.
  • PromptsA ready fix prompt for every category. Copy and paste.
  • GlossaryA glossary of the words each lesson teaches.
  • Codelab: Choyxona POSThe sample teahouse app for practice, and the lesson files.
  • HEAD certificateAwarded at the end of the course.
  • Premium extras
  • Module examsA test at the end of every module on what it covered.
  • Video lessons for lifeNot 6 months: access with no end date, and future updates.
  • Course bookOne chapter per lesson: the lessons' in-depth companion.
  • Security-PluginTwo security agents, a skill set and commands. Ready and tested.
  • Private Telegram communityI answer the questions myself.

What does the 460,000 UZS difference buy? Lifetime access to the video lessons (6 months on Standard), the course book, the ready Security-Plugin (two security agents, a skill set and commands) and a private Telegram community where I answer the questions myself.

Still thinking? Leave your question.

If you are not sure which tier fits, or want to know more about the course, leave your name, number and question. We will get in touch with you.

Frequently asked questions

01Do I need to know how to code?

No. You do not write security code by hand in this course. You recognise the risk, tell the AI to fix it in the right words, and verify the result. Reading code helps, but it is not required.

02I have never built anything. Can I join?

This course is for people with at least one project built or started with AI. If you have not built one yet, start with the "Build with AI" course: it teaches building, this one teaches protecting.

03What tools do I need?

Windows 10, Windows 11 or macOS, an internet connection, the Warp terminal and Claude Code. One condition up front: Claude Code runs on a paid plan, Pro or Max. Setup takes 20 minutes, and the guide is inside the course.

04Do we break into a real app? Is that legal?

Every exercise runs on your own computer, on localhost. The teahouse sample app is deliberately written to be vulnerable, holds fake data, and is never put on the internet. Nobody touches anyone else's app.

05Standards keep changing. Won't the course go out of date?

The controls themselves rarely change: how to store a password or how to write a query stays the same for years. When a standard or the law changes, the lesson is updated. The 27 March 2026 amendment to Uzbekistan's law, for example, is already in.

06Will this course make me a pentester?

No, and it is not meant to. The course teaches you to protect your own project to a standard. Writing exploits and deep attack techniques are not part of it.

07Who answers my questions?

On Premium I answer the questions myself, in the private Telegram community. On Standard the lessons, setup guide, glossary and prompts are open for 6 months, and you walk the path yourself.

08Is there a certificate?

You receive a HEAD certificate at the end of the course. An ISO 27001 certificate or a SOC 2 report is issued to an organisation, not a person, so no course can promise one.

09How do I pay for the course?

Press "Enrol in the course", pick a tier, enter your name and number, then pay through Payme, Click or Atmos. Card details are entered on the payment provider's page. You pay once: 6 months of access on Standard, lifetime access on Premium.

10How long does it take?

14 lessons, 4 modules. On Premium, an exam at the end of each module. You go at your own pace: 6 months on Standard, no deadline on Premium. One module can be done in an evening or two.

from 2,997,000 UZS

Leave your details

If you have a question about the course or are not sure which tier fits, write to us. We will get in touch.

How should we reach you?

By submitting, you agree to the privacy policy.