DEV Community: Ascent Software Training Institute

Build an Angular + Spring Boot App From Scratch (and Fix the Errors You'll Hit)

Ascent Software Training Institute — Tue, 29 Sep 2026 10:11:29 +0000

Build an Angular + Spring Boot App From Scratch (and Fix the Errors You'll Hit)

The first time I wired Angular to a Spring Boot backend, the tutorial worked fine, and then I changed one thing and spent an evening staring at a CORS error. Most guides show the happy path. This one includes the parts where things break.

We'll build a small task manager with a Spring Boot REST API and an Angular frontend. It's small enough to finish in an afternoon and structured like a real project: validation, pagination, error handling, a dev proxy, and a few performance habits.

What you need:

Java 17+ and Maven
Node 18+ and the Angular CLI (npm i -g @angular/cli)
Basic Java and TypeScript. You don't need to know either framework.

I'm using Spring Boot 3.x and a recent Angular with standalone components. If you're on older versions, the ideas hold, but some syntax will differ.

The plan

task-manager/
├── backend/     # Spring Boot (port 8080)
└── frontend/    # Angular (port 4200)

Two folders, one Git repo. Angular talks to Spring Boot over REST/JSON. That's the whole architecture.

Part 1: The Spring Boot backend

Generate a project at start.spring.io with Maven, Java 17, and these dependencies: Spring Web, Spring Data JPA, Validation, H2 Database. Unzip it into backend/.

H2 keeps setup at zero for now. Swapping to PostgreSQL later is a config change, and I'll show that in the best-practices section.

The entity

package com.example.tasks;

import jakarta.persistence.*;
import java.time.LocalDateTime;

@Entity
public class Task {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(nullable = false, length = 120)
    private String title;

    private boolean done;

    private LocalDateTime createdAt = LocalDateTime.now();

    protected Task() {} // required by JPA

    public Task(String title) {
        this.title = title;
    }

    public Long getId() { return id; }
    public String getTitle() { return title; }
    public boolean isDone() { return done; }
    public LocalDateTime getCreatedAt() { return createdAt; }
    public void toggle() { this.done = !this.done; }
}

I left out setters on purpose. The only state change is toggle(), which is one less way to end up with a half-updated object.

The repository

package com.example.tasks;

import org.springframework.data.jpa.repository.JpaRepository;

public interface TaskRepository extends JpaRepository<Task, Long> {}

That's the entire data layer. JpaRepository gives you save, findById, findAll(Pageable), and deleteById.

A request DTO

Don't accept your entity directly from the client. A tiny record is enough:

package com.example.tasks;

import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.Size;

public record TaskRequest(
    @NotBlank(message = "Title is required")
    @Size(max = 120, message = "Title must be 120 characters or fewer")
    String title
) {}

The controller

package com.example.tasks;

import jakarta.validation.Valid;
import org.springframework.data.domain.Page;
import org.springframework.data.domain.Pageable;
import org.springframework.data.domain.Sort;
import org.springframework.data.web.PageableDefault;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/tasks")
public class TaskController {

    private final TaskRepository repo;

    public TaskController(TaskRepository repo) {
        this.repo = repo;
    }

    @GetMapping
    public Page<Task> list(
        @PageableDefault(size = 10, sort = "createdAt", direction = Sort.Direction.DESC)
        Pageable pageable) {
        return repo.findAll(pageable);
    }

    @PostMapping
    @ResponseStatus(HttpStatus.CREATED)
    public Task create(@Valid @RequestBody TaskRequest req) {
        return repo.save(new Task(req.title()));
    }

    @PatchMapping("/{id}/toggle")
    public ResponseEntity<Task> toggle(@PathVariable Long id) {
        return repo.findById(id)
            .map(task -> {
                task.toggle();
                return ResponseEntity.ok(repo.save(task));
            })
            .orElse(ResponseEntity.notFound().build());
    }

    @DeleteMapping("/{id}")
    public ResponseEntity<Void> delete(@PathVariable Long id) {
        if (!repo.existsById(id)) return ResponseEntity.notFound().build();
        repo.deleteById(id);
        return ResponseEntity.noContent().build();
    }
}

Clean validation errors

Without this, a blank title gives the client a noisy default error blob. Add a small handler:

package com.example.tasks;

import org.springframework.http.HttpStatus;
import org.springframework.web.bind.MethodArgumentNotValidException;
import org.springframework.web.bind.annotation.*;

import java.util.Map;
import java.util.stream.Collectors;

@RestControllerAdvice
public class ApiExceptionHandler {

    @ExceptionHandler(MethodArgumentNotValidException.class)
    @ResponseStatus(HttpStatus.BAD_REQUEST)
    public Map<String, String> handleValidation(MethodArgumentNotValidException ex) {
        return ex.getBindingResult().getFieldErrors().stream()
            .collect(Collectors.toMap(
                f -> f.getField(),
                f -> f.getDefaultMessage(),
                (a, b) -> a));
    }
}

Run and test

cd backend
./mvnw spring-boot:run

In another terminal:

curl -X POST localhost:8080/api/tasks \
  -H "Content-Type: application/json" \
  -d '{"title":"Learn Spring Boot"}'

curl "localhost:8080/api/tasks?page=0&size=5"
curl -X POST localhost:8080/api/tasks -H "Content-Type: application/json" -d '{"title":""}'

The last one should return a 400 with {"title":"Title is required"}. Test the backend with curl or Postman before you touch Angular. When something breaks later, you'll know which side it's on.

Part 2: The Angular frontend

ng new frontend --routing=false --style=css
cd frontend

Set up the dev proxy

This is the step most tutorials skip and then fix with CORS hacks. Create proxy.conf.json next to package.json:

{
  "/api": {
    "target": "http://localhost:8080",
    "secure": false
  }
}

Then run the dev server with it:

ng serve --proxy-config proxy.conf.json

Now Angular calls /api/tasks on its own origin (localhost:4200), and the dev server forwards it to Spring Boot. The browser sees one origin, so there's no CORS problem in development.

Enable HttpClient

In src/app/app.config.ts:

import { ApplicationConfig } from '@angular/core';
import { provideHttpClient } from '@angular/common/http';

export const appConfig: ApplicationConfig = {
  providers: [provideHttpClient()],
};

Forgetting this gives you NullInjectorException: No provider for HttpClient. I've done it more than once.

The model and service

src/app/task.service.ts:

import { Injectable, inject } from '@angular/core';
import { HttpClient } from '@angular/common/http';
import { Observable } from 'rxjs';

export interface Task {
  id: number;
  title: string;
  done: boolean;
  createdAt: string;
}

export interface Page<T> {
  content: T[];
  totalElements: number;
  totalPages: number;
  number: number;
}

@Injectable({ providedIn: 'root' })
export class TaskService {
  private http = inject(HttpClient);
  private base = '/api/tasks';

  list(page = 0, size = 10): Observable<Page<Task>> {
    return this.http.get<Page<Task>>(this.base, { params: { page, size } });
  }

  create(title: string): Observable<Task> {
    return this.http.post<Task>(this.base, { title });
  }

  toggle(id: number): Observable<Task> {
    return this.http.patch<Task>(`${this.base}/${id}/toggle`, {});
  }

  remove(id: number): Observable<void> {
    return this.http.delete<void>(this.base + '/' + id);
  }
}

The component

Replace src/app/app.component.ts (rename the file if your CLI version generated app.ts):

import { Component, OnInit, inject, signal } from '@angular/core';
import { FormsModule } from '@angular/forms';
import { TaskService, Task } from './task.service';

@Component({
  selector: 'app-root',
  standalone: true,
  imports: [FormsModule],
  template: `
    <main class="wrap">
      <h1>Tasks</h1>

      <form (ngSubmit)="add()">
        <input [(ngModel)]="title" name="title" placeholder="What needs doing?" />
        <button type="submit" [disabled]="!title.trim()">Add</button>
      </form>

      @if (error()) {
        <p class="error">{{ error() }}</p>
      }

      <ul>
        @for (t of tasks(); track t.id) {
          <li>
            <label>
              <input type="checkbox" [checked]="t.done" (change)="toggle(t)" />
              <span [class.done]="t.done">{{ t.title }}</span>
            </label>
            <button (click)="remove(t)">✕</button>
          </li>
        } @empty {
          <li>Nothing here yet.</li>
        }
      </ul>

      <p>{{ total() }} task(s) total</p>
    </main>
  `,
  styles: [`
    .wrap { max-width: 480px; margin: 2rem auto; font-family: system-ui; }
    .done { text-decoration: line-through; opacity: .6; }
    .error { color: #b00020; }
    li { display: flex; justify-content: space-between; padding: .25rem 0; }
  `],
})
export class AppComponent implements OnInit {
  private api = inject(TaskService);

  tasks = signal<Task[]>([]);
  total = signal(0);
  error = signal('');
  title = '';

  ngOnInit() { this.load(); }

  load() {
    this.api.list().subscribe({
      next: p => { this.tasks.set(p.content); this.total.set(p.totalElements); },
      error: () => this.error.set('Could not load tasks. Is the backend running?'),
    });
  }

  add() {
    this.error.set('');
    this.api.create(this.title.trim()).subscribe({
      next: () => { this.title = ''; this.load(); },
      error: e => this.error.set(e.error?.title ?? 'Something went wrong'),
    });
  }

  toggle(t: Task) {
    this.api.toggle(t.id).subscribe(() => this.load());
  }

  remove(t: Task) {
    this.api.remove(t.id).subscribe(() => this.load());
  }
}

Open http://localhost:4200. Add a task, tick it off, delete it. That's the full loop from Angular to Spring Boot to the database and back.

Practical exercises

Working through the tutorial isn't the same as learning it. Try these without copy-pasting from anywhere:

Edit a task title. Add PUT /api/tasks/{id} with validation, plus an inline edit in the UI.
Real pagination. The backend already supports it. Add Previous/Next buttons using number and totalPages.
Filter by status. Add a derived query, Page<Task> findByDone(boolean done, Pageable p), and a dropdown.
Swap H2 for PostgreSQL (config below) and confirm data survives a restart.
Write two tests: a @WebMvcTest for the validation path and a Karma/Jest test for TaskService with HttpTestingController.

Exercise 5 is the one people skip and the one that teaches the most.

Troubleshooting and common errors

1. Access to XMLHttpRequest has been blocked by CORS policy
You're calling http://localhost:8080 directly from the browser. Use the proxy above and call relative URLs. If you do need CORS (say, a deployed frontend on a different domain), configure it explicitly:

@Configuration
public class CorsConfig implements WebMvcConfigurer {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**")
                .allowedOrigins("https://your-frontend.example.com")
                .allowedMethods("GET", "POST", "PATCH", "DELETE");
    }
}

Avoid allowedOrigins("*") outside of throwaway experiments.

2. The proxy seems ignored
proxy.conf.json only applies if you start the server with --proxy-config, or set it under serve in angular.json. Restart ng serve after editing it, because it isn't hot-reloaded.

3. NullInjectorError: No provider for HttpClient
Missing provideHttpClient() (standalone) or HttpClientModule (module-based apps).

4. 415 Unsupported Media Type
The request is missing Content-Type: application/json. Angular sets it for object bodies. curl doesn't.

5. 400 on POST with a valid-looking body
Check the JSON key against the record component. {"name": "x"} won't bind to title. Also make sure @Valid is on the parameter.

6. Spring Data warning about serializing PageImpl
Newer Spring Data versions warn that returning Page directly isn't a stable JSON contract. Fix it with @EnableSpringDataWebSupport(pageSerializationMode = PageSerializationMode.VIA_DTO) on a config class, or return your own response record. If your JSON shape changes after a Boot upgrade, this is a likely cause.

7. Port 8080 was already in use
An old process is still running. On macOS/Linux: lsof -i :8080. On Windows: netstat -ano | findstr 8080. Or set server.port=8081 and update the proxy target.

8. Data disappears on restart
That's H2 in-memory doing its job. Use a file or a real database.

9. Angular change doesn't show up
Hard-refresh, and check whether the tab is running a stale service worker or a cached build.

Best practices

Keep the API contract explicit. Version your paths (/api/v1/...) once a second consumer exists. Never return raw entities long-term; map to response DTOs so your schema can change without breaking the UI.

Validate on both sides, trust only one. Angular validation is for user experience. Bean Validation on the server is the actual rule.

Use profiles for config. Keep secrets out of Git:

# application-prod.properties
spring.datasource.url=jdbc:postgresql://localhost:5432/tasks
spring.datasource.username=${DB_USER}
spring.datasource.password=${DB_PASSWORD}
spring.jpa.hibernate.ddl-auto=validate

Add the org.postgresql:postgresql dependency, then run with --spring.profiles.active=prod. Use ddl-auto=validate (or nothing) in production and manage schema changes with Flyway or Liquibase. Auto-generating tables is fine on your laptop and risky anywhere else.

Handle errors in one place. In Angular, an HttpInterceptor can attach auth headers and turn failures into user-friendly messages. Spring already has your @RestControllerAdvice.

Environment-based API URLs. In production, Angular is usually served from a static host or behind Nginx, and the proxy config doesn't exist there. Route /api to the backend at the reverse proxy level and keep the relative URLs.

Don't put business logic in controllers. Once rules grow beyond "save this," move them into a @Service. It makes testing far easier.

Performance tips

These are the cheap wins I'd apply before reaching for anything clever.

Always paginate lists. findAll() on a table that grows will eventually hurt. We used Pageable from the start.
Watch for N+1 queries. Turn on spring.jpa.show-sql=true in dev and look at what a single request triggers. If you add relationships, use JOIN FETCH or @EntityGraph.
Index what you filter on. If you add findByDone, index that column when the table gets large.
Return only what the UI needs. Projections or DTOs beat dragging whole entities across the wire.
Angular: track in @for (or trackBy in older syntax) so the DOM isn't rebuilt on each refresh.
Avoid reloading the list after every action. I did that above for simplicity. For a real app, update the local state from the response and only refetch when needed.
Production build: ng build applies AOT, tree-shaking, and minification. Never benchmark with ng serve.
Enable compression (server.compression.enabled=true) or let your reverse proxy handle gzip/brotli.

GitHub examples worth reading

I'd rather point you at real code than have you trust my snippets alone:

spring-projects/spring-petclinic: the reference Spring Boot app, worth skimming for structure and testing style.
spring-petclinic/spring-petclinic-angular: an Angular frontend built against a Petclinic REST backend, a good look at a larger Angular + Spring pairing.
angular/angular and spring-projects/spring-boot: the official repos. The docs folders and issue trackers are good for figuring out why something changed.

When you push your own version, add a README with run instructions, a screenshot, and the curl commands from this article. A repo someone can run in two minutes tells a reader more than a long feature list.

Learning resources

The official Angular docs and the interactive tutorials at angular.dev
Spring Boot reference documentation and the "Building a RESTful Web Service" guide at spring.io/guides
Baeldung for focused Spring articles when you hit a specific problem
Hibernate/JPA docs once you start modeling relationships
The RxJS docs on switchMap, debounceTime, and catchError. Search-as-you-type is a good next exercise.

Where to go from here

Once this works, the next steps are auth (Spring Security with JWT or sessions), Docker Compose to run frontend, backend, and Postgres together, and a CI pipeline that runs both test suites.

If you're learning this stack and comparing options, whether that's self-study or looking at a java full stack training in bangalore, the useful question is what you'll have built by the end. Some people also look for a java full stack course in bangalore with placement support, and it's worth checking what that means in practice: real projects, code review, and interview practice count for more than a certificate. Whichever route you take, a repo like this one, with tests, a README, and a deployment, is what you can show an interviewer.

Wrapping up

Recap of what we covered:

A Spring Boot REST API with validation, pagination, and clean error responses
An Angular client with a typed service, signals, and a dev proxy
The errors you'll almost certainly hit, and what causes them
A handful of practical improvements to try next

If you get stuck on one of the exercises or hit an error I didn't list, drop it in the comments with your Angular and Spring Boot versions and the exact error message. Those two details solve most of it.

Happy building.

That comes out around 2,400 words, inside your range. I kept the keywords to one natural mention in the closing section so the tutorial doesn't read as promotional, and I didn't invent any GitHub repo links. If you'd like, I can put this into a file, or add a repo link once you've pushed your own version.

Python Data Structures Explained: A Practical Tutorial with Code Examples"

Ascent Software Training Institute — Mon, 28 Sep 2026 07:33:51 +0000

Python Data Structures Explained: A Hands-On Guide

A few years ago I reviewed a pull request where someone had written a nested loop to check whether items from one list existed in another. It worked fine on their 50-row test file and fell over on production data with 400,000 rows. The fix was a one-line change: wrap one list in set().

That's really what data structures are about. You're picking the right container so your code stays fast, readable, and boring in production.

This guide walks through Python's built-in data structures and the handful of standard library ones you'll use constantly. Everything is runnable. Open a REPL or a scratch file and follow along.

What you need: Python 3.9+ and a text editor. No third-party packages.

Step 1: Lists

A list is an ordered, mutable sequence. It's the first thing everyone reaches for, and for good reason.

tasks = ["write tests", "fix bug #42", "deploy"]

tasks.append("update docs")      # add to end
tasks.insert(1, "code review")   # add at index 1
last = tasks.pop()               # remove and return last
tasks.remove("deploy")           # remove first match by value

print(tasks[0])       # first item
print(tasks[-1])      # last item
print(tasks[1:3])     # slice: items at index 1 and 2

Under the hood a Python list is a dynamic array. That gives you:

Operation	Cost
`lst[i]`	O(1)
`lst.append(x)`	O(1) amortized
`lst.pop()`	O(1)
`lst.pop(0)` / `lst.insert(0, x)`	O(n)
`x in lst`	O(n)

The two rows that bite people are pop(0) and x in lst. We'll fix both later.

List comprehensions

squares = [n * n for n in range(10)]
evens = [n for n in range(20) if n % 2 == 0]

Comprehensions are usually faster than an equivalent for loop with .append(), and most Python developers find them easier to read. The exception is when the logic gets complicated. If you need a comment to explain a comprehension, use a loop.

The aliasing trap

a = [1, 2, 3]
b = a
b.append(4)
print(a)  # [1, 2, 3, 4]  <- surprise

b = a doesn't copy anything. Both names point to the same list. If you want a copy:

b = a.copy()      # or list(a), or a[:]

For nested structures, copy() is shallow, so use copy.deepcopy() when you have lists inside lists.

Step 2: Tuples

A tuple is an ordered, immutable sequence.

point = (3, 7)
x, y = point            # unpacking

rgb = (255, 128, 0)
r, g, b = rgb

# Swapping without a temp variable
a, b = 1, 2
a, b = b, a

Use tuples when the data is a fixed record: coordinates, a database row, a function returning several values. Because they're immutable and hashable (if their contents are), tuples can be dictionary keys, while lists can't.

grid = {(0, 0): "start", (3, 4): "goal"}
print(grid[(3, 4)])  # goal

One gotcha: a single-element tuple needs a trailing comma.

not_a_tuple = (5)     # just the int 5
a_tuple = (5,)        # tuple

For records with named fields, typing.NamedTuple or dataclasses.dataclass will save you from remembering that "index 2 is the email".

Step 3: Dictionaries

Dicts map keys to values, with average O(1) lookup, insert, and delete. They also preserve insertion order (guaranteed since Python 3.7). You'll use them constantly.

user = {"name": "Asha", "role": "backend", "active": True}

user["team"] = "payments"        # add
print(user.get("email"))         # None, no KeyError
print(user.get("email", "n/a"))  # n/a

for key, value in user.items():
    print(key, value)

Counting things

This comes up all the time, and there are three ways to do it. Here's the progression:

words = "the quick brown fox jumps over the lazy dog the end".split()

# 1. Manual
counts = {}
for w in words:
    if w in counts:
        counts[w] += 1
    else:
        counts[w] = 1

# 2. .get()
counts = {}
for w in words:
    counts[w] = counts.get(w, 0) + 1

# 3. Counter (the one you should actually use)
from collections import Counter
counts = Counter(words)
print(counts.most_common(2))  # [('the', 3), ('quick', 1)]

Grouping with defaultdict

from collections import defaultdict

by_length = defaultdict(list)
for w in words:
    by_length[len(w)].append(w)

No if key not in d boilerplate. A missing key automatically gets an empty list.

Dict comprehensions and merging

squares = {n: n * n for n in range(5)}

defaults = {"theme": "dark", "lang": "en"}
overrides = {"lang": "fr"}
merged = defaults | overrides    # Python 3.9+

Keys must be hashable. Strings, numbers, and tuples of those are fine. Lists and dicts aren't.

Step 4: Sets

A set is an unordered collection of unique, hashable items with O(1) average membership tests.

seen = {1, 2, 3}
seen.add(3)          # no effect, already there
seen.add(4)
print(2 in seen)     # True, and fast

a = {1, 2, 3, 4}
b = {3, 4, 5}
print(a & b)   # intersection: {3, 4}
print(a | b)   # union: {1, 2, 3, 4, 5}
print(a - b)   # difference: {1, 2}
print(a ^ b)   # symmetric difference: {1, 2, 5}

The classic use is deduplication:

emails = ["a@x.com", "b@x.com", "a@x.com"]
unique = list(set(emails))    # order is NOT preserved

If you need to keep the original order:

unique = list(dict.fromkeys(emails))

That works because dicts keep insertion order and keys are unique.

Also, {} creates an empty dict, not an empty set. For an empty set you write set().

Step 5: Stacks and Queues

Python has no dedicated Stack or Queue class in the builtins, but you don't need one.

Stack (LIFO): use a list

stack = []
stack.append("page1")
stack.append("page2")
stack.append("page3")
print(stack.pop())   # page3

A good real-world use is bracket matching:

def is_balanced(s: str) -> bool:
    pairs = {")": "(", "]": "[", "}": "{"}
    stack = []
    for ch in s:
        if ch in "([{":
            stack.append(ch)
        elif ch in pairs:
            if not stack or stack.pop() != pairs[ch]:
                return False
    return not stack

print(is_balanced("{[()]}"))  # True
print(is_balanced("{[(])}"))  # False

Queue (FIFO): use `collections.deque`

Remember how list.pop(0) is O(n)? For queues, use a deque instead:

from collections import deque

queue = deque()
queue.append("job1")
queue.append("job2")
queue.append("job3")
print(queue.popleft())   # job1, O(1)

A deque is a double-ended queue, so appending and popping from either end are both O(1). It also takes maxlen, which is handy for "keep only the last N items":

recent = deque(maxlen=3)
for i in range(6):
    recent.append(i)
print(recent)  # deque([3, 4, 5], maxlen=3)

Breadth-first search is the textbook deque use case:

def bfs(graph, start):
    visited = {start}
    queue = deque([start])
    order = []
    while queue:
        node = queue.popleft()
        order.append(node)
        for neighbor in graph[node]:
            if neighbor not in visited:
                visited.add(neighbor)
                queue.append(neighbor)
    return order

graph = {"A": ["B", "C"], "B": ["D"], "C": ["D"], "D": []}
print(bfs(graph, "A"))  # ['A', 'B', 'C', 'D']

Note that visited is a set. That's the same membership-test trick from earlier.

Step 6: Heaps and Sorted Lookups

Two standard library modules are worth knowing early.

heapq: priority queues

heapq gives you a min-heap on top of a plain list. The smallest item is always at index 0.

import heapq

tasks = []
heapq.heappush(tasks, (2, "write report"))
heapq.heappush(tasks, (1, "fix prod outage"))
heapq.heappush(tasks, (3, "refactor"))

while tasks:
    priority, name = heapq.heappop(tasks)
    print(priority, name)
# 1 fix prod outage
# 2 write report
# 3 refactor

Need the top-k items from a big collection? Don't sort everything:

scores = [88, 92, 79, 95, 60, 99, 71]
print(heapq.nlargest(3, scores))   # [99, 95, 92]

bisect: binary search on sorted lists

import bisect

sorted_ids = [10, 20, 30, 40, 50]
pos = bisect.bisect_left(sorted_ids, 35)
print(pos)                      # 3
bisect.insort(sorted_ids, 35)   # insert and keep sorted

Lookups are O(log n), though insort is still O(n) because of the shifting.

Step 7: Choosing the Right One

When I'm unsure, I ask these questions in order:

I need...	Use
An ordered collection I'll modify	`list`
A fixed record, or a dict key	`tuple`
Lookup by key	`dict`
Uniqueness or fast "is it in here?"	`set`
Counting	`Counter`
Grouping	`defaultdict`
FIFO queue, or "last N items"	`deque`
"Give me the smallest/largest next"	`heapq`
Searching a sorted list	`bisect`

If you're doing x in some_list inside a loop, stop and ask whether that list should be a set.

Performance Tips

Don't trust me on any of this. Measure it:

import timeit

data_list = list(range(100_000))
data_set = set(data_list)

print("list:", timeit.timeit("99_999 in data_list", globals=globals(), number=1000))
print("set: ", timeit.timeit("99_999 in data_set", globals=globals(), number=1000))

You'll typically see the set win by several orders of magnitude. The exact numbers depend on your machine, but the gap is always dramatic.

Other things worth knowing:

Build strings with "".join(parts), not repeated += in a loop.
Use generators for large data. sum(x * x for x in data) doesn't build a giant intermediate list.
Prefer dict.get() or in over try/except when a miss is common. Exceptions are cheap when rare and slow when frequent.
Preallocate when the size is known. [0] * n is much faster than appending n zeros.
Profile before optimizing. cProfile and timeit will point at the real bottleneck, and it's often not where you'd guess.

The TimeComplexity page on the official Python wiki lists the Big-O cost of every built-in operation. Bookmark it.

Common Errors and Troubleshooting

TypeError: unhashable type: 'list'
You tried to use a list (or dict, or set) as a dict key or set member. Convert it to a tuple: d[tuple(my_list)] = ....

KeyError: 'email'
The key isn't in the dict. Use d.get("email"), check with if "email" in d, or use defaultdict.

RuntimeError: dictionary changed size during iteration
You added or deleted keys while looping over the dict. Iterate over a copy of the keys instead:

for key in list(d.keys()):
    if d[key] is None:
        del d[key]

Modifying a list while looping over it
This skips elements in confusing ways.

nums = [2, 4, 6, 8]
for n in nums:
    if n % 2 == 0:
        nums.remove(n)
print(nums)  # [4, 8], not [] as you'd expect

Removing an item shifts everything left, and the loop's internal index then skips the next element. Build a new list instead: nums = [n for n in nums if n % 2 != 0].

The [[]] * 3 bug

grid = [[0] * 3] * 3
grid[0][0] = 1
print(grid)  # [[1, 0, 0], [1, 0, 0], [1, 0, 0]]

All three rows are the same list object. Do this instead:

grid = [[0] * 3 for _ in range(3)]

Mutable default arguments

def add_item(item, bucket=[]):     # bug: one shared list for every call
    bucket.append(item)
    return bucket

def add_item(item, bucket=None):   # fix
    if bucket is None:
        bucket = []
    bucket.append(item)
    return bucket

IndexError: pop from empty list / pop from an empty deque
Check if stack: before popping.

Best Practices

Use the most specific structure. If you only need uniqueness, a set says so to the next reader.
Keep structures homogeneous. A list of ints or a list of user dicts is easy to reason about. Mixed types get messy quickly.
Don't mutate arguments unless the function name makes it obvious (sort_in_place, append_row).
Prefer dataclass or NamedTuple over "dicts of everything" once you pass three or four fields.
Add type hints. dict[str, list[int]] documents intent better than a comment.
Write tiny tests. A structure-heavy function is easy to test with pytest.

Practical Exercises

Try each one before looking anything up. It's fine if you get stuck. That's when it sticks.

Exercise 1: Deduplicate, keep order.
Given ["b", "a", "b", "c", "a"], return ["b", "a", "c"].

Exercise 2: Two-sum.
Given a list of ints and a target, return the indices of two numbers that add up to the target, in O(n) time. (Hint: a dict of value to index.)

Exercise 3: Anagram groups.
Group ["eat", "tea", "tan", "ate", "nat", "bat"] into lists of anagrams. (Hint: what's a good dict key for "same letters"?)

Exercise 4: Sliding window.
Use a deque(maxlen=k) to compute a moving average over a stream of numbers.

Exercise 5: LRU cache.
Build a small cache with get and put that evicts the least recently used item when full. Start with collections.OrderedDict and its move_to_end method. Then try building it yourself with a dict plus a doubly linked list.

Mini project: a log summarizer

Here's a starter. Extend it however you like.

from collections import Counter, defaultdict

LOG_LINES = [
    "10.0.0.1 GET /home 200",
    "10.0.0.2 GET /about 200",
    "10.0.0.1 POST /login 401",
    "10.0.0.3 GET /home 500",
    "10.0.0.1 GET /home 200",
]

def summarize(lines):
    status_counts = Counter()
    paths_by_status = defaultdict(set)
    hits_per_ip = Counter()

    for line in lines:
        ip, method, path, status = line.split()
        status_counts[status] += 1
        paths_by_status[status].add(path)
        hits_per_ip[ip] += 1

    return status_counts, paths_by_status, hits_per_ip

statuses, paths, ips = summarize(LOG_LINES)
print(statuses.most_common())
print(dict(paths))
print(ips.most_common(1))

Stretch goals: read from a real file, find the top 3 slowest endpoints using heapq, and flag any IP with more than N failed logins in a sliding window.

GitHub Examples to Read (and Build)

Repos worth reading (search for them by name on GitHub):

TheAlgorithms/Python has clean, readable implementations of stacks, queues, linked lists, trees, and graphs.
keon/algorithms is another well-organized collection with short examples.
python/cpython, specifically Lib/collections/__init__.py, shows how OrderedDict, Counter, and namedtuple are built.

Set up your own practice repo. A structure like this works well:

ds-practice/
├── README.md
├── src/
│   ├── lists_and_tuples.py
│   ├── dict_patterns.py
│   ├── stacks_queues.py
│   └── lru_cache.py
└── tests/
    ├── test_dict_patterns.py
    └── test_lru_cache.py

Commit after each exercise with a message that says what you learned, like "add two-sum with dict, O(n)". A repo full of small commits and passing tests says more about you than a certificate does. It also shows up nicely when you're applying for jobs.

A simple test to get you started:

# tests/test_stacks_queues.py
from src.stacks_queues import is_balanced

def test_balanced():
    assert is_balanced("{[()]}")

def test_unbalanced():
    assert not is_balanced("{[(])}")

Run with pytest.

Where This Fits in a Bigger Learning Path

Data structures are the foundation, but they're not the whole picture. If you're aiming for full stack work, the usual sequence is: core Python and data structures, then a web framework (Flask, Django, or FastAPI), then SQL and an ORM, then a frontend basics layer (HTML, CSS, JavaScript, maybe React), and finally Git, Docker, and deployment.

If you're in a city like Bengaluru and searching for something like "python full stack training in bangalore" or the "best python full stack training in bangalore", it's worth looking past the ads. Here's what I'd check for any program:

Do you build and deploy real projects, or only watch demos?
Are data structures and SQL taught properly, or skipped?
Do instructors review your code, or just your attendance?
Can you see recent student projects on GitHub?
Are the tools current (Python 3.11+, a modern framework, Git-based workflow)?

The structure of a course matters much less than how many hours you spend writing code and debugging your own mistakes. Plenty of people get there with free resources and a strict routine, and others do better with the accountability of a classroom. Either path works if you build things.

Learning Resources

Python docs: Data Structures tutorial is short and authoritative.
Python wiki: TimeComplexity is the Big-O cheat sheet.
Real Python has practical articles on dicts, sets, deques, and heaps.
Python Tutor lets you visualize step by step what your code does in memory, which is great for understanding aliasing bugs.
Fluent Python by Luciano Ramalho goes deep into how these structures actually work.
Problem Solving with Algorithms and Data Structures using Python (the Runestone Academy book) is free online and covers the classic structures you'd implement by hand.
Coding Interview University (a GitHub repo by John Washam) is a long study plan if you're targeting interviews.

Wrapping Up

If you remember only four things from this post:

Use a set or dict when you're checking membership.
Use a deque when you're popping from the front.
Use Counter and defaultdict instead of hand-rolled counting logic.
Measure before you optimize.

Everything else is practice. Do the exercises, break things on purpose, and read other people's code.

What's the data structure bug that cost you the most time? Mine was the [[0] * 3] * 3 grid, and I'd like to hear yours in the comments.

CI/CD Pipelines Explained: A Hands-On Guide for Developers

Ascent Software Training Institute — Thu, 24 Sep 2026 07:35:17 +0000

CI/CD Pipelines Explained: A Hands-On Guide for Developers

If you've ever pushed code, waited for a teammate to manually deploy it, and then found out three days later that it broke staging — this post is for you. We're going to build a real CI/CD pipeline from scratch, understand why each piece exists, and leave you with something you can actually use on your next project.

No fluff, no "CI/CD will transform your business" energy. Just the mechanics.

What CI/CD Actually Means (Without the Buzzwords)
Setting Up Your First Pipeline
A Real Example: Node.js App with GitHub Actions
Adding Tests, Linting, and Build Steps
Deploying Automatically
Practical Exercises
Troubleshooting Common Failures
Best Practices That Actually Matter
Performance Tips
Learning Resources

1. What CI/CD Actually Means

Continuous Integration (CI) is the practice of merging code changes frequently — multiple times a day, ideally — and automatically verifying each change with builds and tests. The point isn't "integration" as a buzzword; it's catching the moment code breaks, not three weeks later when nobody remembers what changed.

Continuous Delivery (CD) means your code is always in a deployable state. Every merge to your main branch could go to production without extra manual work.

Continuous Deployment (the more aggressive cousin of Delivery) means it actually does go to production automatically, no human clicking "approve."

Here's the mental model that helped me most: think of CI/CD as a series of gates. Code has to pass through each gate (lint → test → build → deploy) and if it fails any gate, it stops there. No gate, no main.

Push Code → Lint → Test → Build → Deploy to Staging → (Manual Approval) → Deploy to Prod

2. Setting Up Your First Pipeline

We'll use GitHub Actions because it's free for public repos, built into GitHub, and you don't need to provision any separate infrastructure to start.

Every GitHub Actions pipeline lives in .github/workflows/ as a YAML file. Let's create the skeleton:

mkdir -p .github/workflows
touch .github/workflows/ci.yml

Here's the minimal pipeline that does nothing useful yet, but proves the plumbing works:

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Say hello
        run: echo "Pipeline is alive"

Push this, open the "Actions" tab on your GitHub repo, and you should see a green checkmark. That's your pipeline running on GitHub's servers, not yours.

3. A Real Example: Node.js App with GitHub Actions

Let's make this concrete with an actual Express app.

mkdir cicd-demo && cd cicd-demo
npm init -y
npm install express
npm install --save-dev jest supertest

index.js:

const express = require('express');
const app = express();

app.get('/', (req, res) => {
  res.status(200).json({ message: 'Hello CI/CD' });
});

app.get('/health', (req, res) => {
  res.status(200).json({ status: 'ok' });
});

module.exports = app;

if (require.main === module) {
  const PORT = process.env.PORT || 3000;
  app.listen(PORT, () => console.log(`Running on port ${PORT}`));
}

index.test.js:

const request = require('supertest');
const app = require('./index');

describe('GET /', () => {
  it('returns hello message', async () => {
    const res = await request(app).get('/');
    expect(res.statusCode).toBe(200);
    expect(res.body.message).toBe('Hello CI/CD');
  });
});

describe('GET /health', () => {
  it('returns ok status', async () => {
    const res = await request(app).get('/health');
    expect(res.statusCode).toBe(200);
  });
});

Add a test script to package.json:

"scripts": {
  "start": "node index.js",
  "test": "jest"
}

Run it locally first:

npm test

You should see both tests pass. Now let's wire this into the pipeline.

4. Adding Tests, Linting, and Build Steps

Update .github/workflows/ci.yml:

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build-and-test:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [18.x, 20.x]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run linter
        run: npx eslint . --max-warnings=0
        continue-on-error: true

      - name: Run tests
        run: npm test

      - name: Build
        run: echo "No build step for this simple app, but this is where you'd run npm run build"

A few things worth calling out here:

npm ci not npm install — ci does a clean install from package-lock.json and is faster and more deterministic in pipelines. npm install can silently update your lockfile, which you don't want in CI.
The matrix strategy runs your tests against multiple Node versions in parallel. This catches "works on my machine" bugs caused by version drift.
cache: 'npm' speeds up subsequent runs by caching node_modules based on your lockfile hash.

Commit and push. Watch it run across two Node versions in the Actions tab.

5. Deploying Automatically

Now the part everyone actually wants: shipping code without SSH-ing into a server.

We'll deploy to Render here because it has a generous free tier and a simple API, but the same pattern applies to Vercel, Railway, AWS, or anywhere else. This example uses a deploy hook, which is the simplest possible integration.

Add a deploy job that only runs after tests pass, and only on main:

  deploy:
    needs: build-and-test
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'

    steps:
      - name: Trigger deploy
        run: |
          curl -X POST "${{ secrets.DEPLOY_HOOK_URL }}"

Set DEPLOY_HOOK_URL in your repo under Settings → Secrets and variables → Actions → New repository secret. Never hardcode secrets in your YAML — that's an instant security incident waiting to happen.

If you're deploying to AWS instead, a more realistic snippet using the AWS CLI looks like this:

  deploy-aws:
    needs: build-and-test
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ap-south-1

      - name: Deploy to S3
        run: aws s3 sync ./build s3://your-bucket-name --delete

      - name: Invalidate CloudFront cache
        run: |
          aws cloudfront create-invalidation \
            --distribution-id ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }} \
            --paths "/*"

This pattern — sync to S3, invalidate CloudFront — is one of the most common static-site/SPA deployment flows on AWS. If you're newer to this side of things, this is roughly the kind of workflow covered in a hands-on AWS course in Bangalore, where deploy pipelines like this get built end-to-end rather than just read about.

6. Practical Exercises

Don't just read this — do these:

Exercise 1: Break it on purpose
Change expect(res.body.message).toBe('Hello CI/CD') to expect the wrong string. Push it. Watch the pipeline fail. This is the most underrated learning exercise — see what a real failure looks like in the Actions logs before you're debugging one under pressure.

Exercise 2: Add a status badge
Add this to your README.md, replacing the placeholders:

![CI](https://github.com/USERNAME/REPO/actions/workflows/ci.yml/badge.svg)

Exercise 3: Branch protection
Go to Settings → Branches → Add rule for main. Require the CI check to pass before merging. Try opening a PR with a failing test and see GitHub block the merge button.

Exercise 4: Add a manual approval gate
Use environment: production with required reviewers in GitHub's environment settings, so deploys pause for a human click before going live. This is genuinely how a lot of teams do Continuous Delivery rather than full Continuous Deployment.

7. Troubleshooting Common Failures

"Process completed with exit code 1" and nothing else useful
This usually means a step failed silently. Add --verbose flags to your test runner or check "Re-run jobs with debug logging" (available from the failed run's page).

Tests pass locally but fail in CI
Almost always one of: timezone differences, environment variables not set in CI, or a node_modules mismatch. Run npm ci locally (not npm install) to reproduce the exact CI environment.

"npm ci" fails with lockfile errors
Your package.json and package-lock.json are out of sync. Run npm install locally, commit the updated lockfile, and push again.

Secrets not being read (undefined in logs)
Secrets aren't available on workflows triggered by PRs from forks, by design, for security reasons. If you need this, look into pull_request_target — but be very careful, since it runs with access to your repo's secrets against untrusted code.

Cache not speeding anything up
Check that your cache key actually depends on package-lock.json. A stale or overly broad cache key means you're caching nothing useful.

Deploy step succeeds but the site didn't change
Check your CDN/cache invalidation step. This is the single most common "why didn't my deploy work" issue — the deploy succeeded, but a cached version is still being served.

8. Best Practices That Actually Matter

Fail fast. Put your cheapest, fastest checks (lint, type-check) before expensive ones (full test suite, build). No point waiting 10 minutes for tests if a lint error would've told you in 10 seconds.
Never deploy from your laptop once CI/CD exists. If deploys can happen outside the pipeline, your pipeline isn't the source of truth anymore, and you'll eventually deploy something untested.
Pin your action versions. Use actions/checkout@v4, not actions/checkout@main. Untagged/floating versions can change behavior under you without warning.
Keep secrets out of logs. GitHub masks secret values automatically, but be careful not to echo them directly or pass them through commands that might print them on error.
One pipeline, multiple environments. Don't maintain separate YAML files for staging and production if you can parameterize one with environment variables/conditionals instead — it's less to keep in sync.
Make failures loud, not silent. Hook up Slack or email notifications for failed deploys. A red X nobody sees is as good as no pipeline at all.

9. Performance Tips

Cache dependencies. We already saw cache: 'npm' — this alone can cut build time by 30-60% on larger projects.
Run jobs in parallel where they don't depend on each other. Lint and unit tests usually don't need to run sequentially — split them into separate jobs.
Use needs: carefully. Only add dependencies between jobs when one genuinely requires the other's output. Unnecessary needs: chains serialize work that could run concurrently.
Shallow clone when you don't need history. actions/checkout@v4 does this by default (fetch-depth: 1), but if you've customized it, don't fetch full git history unless something actually needs it (like changelog generation).
Self-hosted runners for heavy workloads. If you're regularly waiting on GitHub-hosted runners' limited resources (2 CPU cores, 7GB RAM on the free tier), a self-hosted runner on your own VM removes that ceiling — at the cost of managing the machine yourself.

10. Learning Resources

GitHub Actions official docs — genuinely well-written, start here
GitHub Actions Marketplace — reusable actions instead of writing everything from scratch
"Continuous Delivery" by Jez Humble and David Farley — the book that defined a lot of this practice; dense but foundational
12factor.net — not CI/CD specific, but shapes how you should structure apps to be deployable this way
The awesome-actions GitHub repo — a curated list of community actions worth knowing about
If you want this taught hands-on rather than self-paced, devops training in BTM Layout, Bangalore covers pipeline tooling like this as part of a broader DevOps curriculum
For the AWS deploy side specifically (S3, CloudFront, IAM roles for CI), an AWS course in Bangalore is a reasonable next step once you're comfortable with the basics above

Wrapping Up

The core idea of CI/CD isn't complicated: automate the boring, error-prone parts of shipping code so humans only step in for decisions that actually need judgment. Everything above — the matrix builds, the deploy gates, the caching — is just refinement on that one idea.

Start with the skeleton pipeline from Section 2. Get it green. Then add one gate at a time. Don't try to build the "perfect" pipeline on day one; you'll learn more from watching a real deploy fail and fixing it than from any tutorial, including this one.

If you build something off this, I'd genuinely like to hear what broke first — that's usually the most interesting part.

Nmap Tutorial for Network Scanning: A Practical Guide for Developers and Security Engineers

Ascent Software Training Institute — Wed, 23 Sep 2026 07:22:28 +0000

Nmap Tutorial for Network Scanning: A Practical Guide for Developers and Security Engineers

Network scanning is one of the foundational skills in cybersecurity and systems engineering. Whether you're auditing your own infrastructure, debugging a misbehaving service, or performing authorized penetration testing, Nmap (Network Mapper) remains the industry-standard tool for discovering hosts, services, and vulnerabilities on a network.

This guide walks through Nmap from first principles to advanced scripting, with real command examples, architecture explanations, and workflows you can apply in production and lab environments. It's written for developers, DevOps engineers, and anyone building practical, job-ready skills in network security — the kind of hands-on foundation covered in a good cyber security course in Bangalore BTM Layout or similar cyber security training in Bangalore BTM Layout programs.

Legal note: Only scan systems you own or have explicit written authorization to test. Unauthorized scanning can violate computer misuse laws in most jurisdictions.

What Is Nmap and Why It Matters
Nmap Architecture
Installation
Core Scanning Concepts
Common Scan Types (with Code)
Nmap Scripting Engine (NSE)
Output Formats and Folder Structure
Real-World Workflows
Best Practices
Common Mistakes
Performance Optimization
Security Considerations
Summary

1. What Is Nmap and Why It Matters

Nmap is an open-source command-line tool used to discover hosts and services on a computer network by sending crafted packets and analyzing the responses. It answers questions like:

What hosts are alive on this network?
What ports are open on a given host?
What services (and versions) are running on those ports?
What operating system is the host likely running?
Are there known vulnerabilities associated with the detected services?

Nmap is used across multiple disciplines:

Security auditing — identifying exposed services before attackers do
Network inventory — mapping what's actually running on a network vs. what's documented
Compliance — verifying firewall rules and segmentation
DevOps troubleshooting — confirming a service is actually listening and reachable
Penetration testing — reconnaissance phase of an authorized engagement

Its longevity (it's been actively maintained since 1997) comes from a combination of a flexible probe engine, a scripting framework, and reliable OS/service fingerprinting.

2. Nmap Architecture

Understanding how Nmap works internally helps you choose the right scan type and interpret results correctly.

┌─────────────────────────────────────────────────────────┐
│                        Nmap Core                         │
│                                                           │
│  ┌───────────────┐   ┌───────────────┐   ┌────────────┐  │
│  │ Target Parser  │──▶│ Host Discovery │──▶│ Port Scan  │  │
│  │ (IP/CIDR/DNS)  │   │   (Ping/ARP)   │   │  Engine    │  │
│  └───────────────┘   └───────────────┘   └─────┬──────┘  │
│                                                  │         │
│                                                  ▼         │
│  ┌───────────────┐   ┌───────────────┐   ┌────────────┐  │
│  │  NSE (Lua      │◀──│ Version/OS     │◀──│  Response  │  │
│  │  Scripting)    │   │  Detection     │   │  Analysis  │  │
│  └───────┬───────┘   └───────────────┘   └────────────┘  │
│          │                                                │
│          ▼                                                │
│  ┌───────────────────────────────────────────────────┐   │
│  │              Output Formatters                     │   │
│  │   (Normal / XML / Grepable / JSON via scripts)     │   │
│  └───────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────┘

Key components:

Target parser — resolves hostnames, expands CIDR ranges, reads target lists from files.
Host discovery — determines which hosts are "up" using ICMP, ARP (on local networks), or TCP/UDP probes.
Port scanning engine — the core packet-crafting logic; supports TCP, UDP, and various stealth techniques.
Version/OS detection — sends additional probes and compares responses against a fingerprint database (nmap-service-probes, nmap-os-db).
NSE (Nmap Scripting Engine) — a Lua-based framework for extending scans with custom logic (vulnerability checks, brute-forcing, enumeration).
Output formatters — render results in human-readable, XML, or grepable formats for downstream tooling.

3. Installation

Nmap runs on Linux, macOS, and Windows.

Debian/Ubuntu:

sudo apt update
sudo apt install nmap -y

RHEL/CentOS/Fedora:

sudo dnf install nmap -y

macOS (Homebrew):

brew install nmap

Verify installation:

nmap --version

Expected output includes the Nmap version, compiled-in libraries (like OpenSSL and libpcap), and supported features.

4. Core Scanning Concepts

Before running scans, it helps to understand a few underlying mechanics.

4.1 Port States

Nmap classifies ports into six states:

State	Meaning
`open`	An application is actively accepting connections
`closed`	Port is reachable but no application is listening
`filtered`	A firewall/filter is blocking Nmap from determining state
`unfiltered`	Port is accessible but state can't be determined
`open\	filtered`
`closed\	filtered`

4.2 TCP Handshake and the SYN Scan

The default and most popular scan type, -sS, exploits the TCP three-way handshake:

Client (Nmap)          Server
     │   SYN   ──────────▶│
     │◀──── SYN/ACK ───────│   → port is OPEN
     │   RST   ──────────▶│   (connection never completed)

Because Nmap sends a RST instead of completing the handshake with ACK, this is often called a "half-open" scan — it's faster and stealthier than a full TCP connect scan, though it typically requires root/administrator privileges to craft raw packets.

5. Common Scan Types (with Code)

5.1 Basic Host Discovery (Ping Sweep)

nmap -sn 192.168.1.0/24

-sn disables port scanning and only checks which hosts respond.

5.2 TCP SYN Scan (Stealth Scan)

sudo nmap -sS 192.168.1.10

5.3 TCP Connect Scan (No Root Required)

nmap -sT 192.168.1.10

Completes the full handshake — slower and more visible in logs, but doesn't require elevated privileges.

5.4 UDP Scan

sudo nmap -sU -p 53,67,123,161 192.168.1.10

UDP scanning is inherently slower and less reliable than TCP because UDP has no handshake — Nmap infers state from ICMP responses (or lack thereof).

5.5 Service and Version Detection

nmap -sV 192.168.1.10

Sends follow-up probes to identify software and version (e.g., Apache httpd 2.4.52).

5.6 OS Fingerprinting

sudo nmap -O 192.168.1.10

Compares TCP/IP stack behavior against a fingerprint database to guess the OS.

5.7 Aggressive Scan

sudo nmap -A 192.168.1.10

Combines -sV, -O, NSE default scripts (-sC), and traceroute in one command. Useful for quick reconnaissance but noisy on the wire.

5.8 Scanning Specific Ports

nmap -p 22,80,443 192.168.1.10
nmap -p 1-1000 192.168.1.10
nmap -p- 192.168.1.10   # all 65535 ports

5.9 Scanning Multiple Targets

nmap 192.168.1.1 192.168.1.5 192.168.1.10
nmap 192.168.1.1-50
nmap -iL targets.txt

targets.txt:

192.168.1.10
192.168.1.20
10.0.0.0/24
scanme.example.com

6. Nmap Scripting Engine (NSE)

NSE extends Nmap with Lua scripts organized into categories: auth, default, discovery, intrusive, malware, safe, vuln, and more.

6.1 Running Default Scripts

nmap -sC -sV 192.168.1.10

6.2 Running a Specific Script

nmap --script=http-title 192.168.1.10

6.3 Vulnerability Scanning Category

nmap --script vuln 192.168.1.10

This runs every script tagged vuln — useful for identifying known CVEs in detected services, but can be slow and intrusive; use only on systems you're authorized to test.

6.4 Script Arguments

nmap --script http-title --script-args http.useragent="CustomAgent" 192.168.1.10

6.5 Listing Available Scripts

ls /usr/share/nmap/scripts/ | grep http
nmap --script-help=http-title

7. Output Formats and Folder Structure

For any recurring scanning workflow, structure your output so results are versioned, comparable, and machine-parseable.

7.1 Output Flags

nmap -oN scan_normal.txt 192.168.1.10      # normal (human-readable)
nmap -oX scan_output.xml 192.168.1.10      # XML (for tooling)
nmap -oG scan_grepable.txt 192.168.1.10    # grepable (legacy but scriptable)
nmap -oA scan_results 192.168.1.10         # all three formats at once

7.2 Recommended Folder Structure

For a project involving repeated or scheduled scans (e.g., a weekly internal audit), a clean structure keeps results traceable:

network-audit/
├── scripts/
│   ├── run_scan.sh
│   └── parse_results.py
├── targets/
│   └── targets.txt
├── results/
│   ├── 2026-09-01/
│   │   ├── scan_results.xml
│   │   ├── scan_results.nmap
│   │   └── scan_results.gnmap
│   └── 2026-09-08/
│       ├── scan_results.xml
│       ├── scan_results.nmap
│       └── scan_results.gnmap
├── reports/
│   └── weekly_summary.md
└── README.md

A simple wrapper script (run_scan.sh) that timestamps output directories:

#!/usr/bin/env bash
set -euo pipefail

DATE=$(date +%Y-%m-%d)
OUTDIR="results/${DATE}"
mkdir -p "$OUTDIR"

sudo nmap -sS -sV -O -oA "${OUTDIR}/scan_results" -iL targets/targets.txt

echo "Scan complete. Results in ${OUTDIR}"

7.3 Parsing XML Output Programmatically

Python's XML libraries can parse Nmap's XML output for integration into dashboards or ticketing systems:

import xml.etree.ElementTree as ET

tree = ET.parse('results/2026-09-08/scan_results.xml')
root = tree.getroot()

for host in root.findall('host'):
    address = host.find('address').get('addr')
    ports = host.find('ports')
    if ports is None:
        continue
    for port in ports.findall('port'):
        state = port.find('state').get('state')
        if state == 'open':
            portid = port.get('portid')
            service = port.find('service')
            service_name = service.get('name') if service is not None else 'unknown'
            print(f"{address}:{portid} open ({service_name})")

8. Real-World Workflows

8.1 Initial Network Reconnaissance (Authorized Pentest)

# Step 1: Discover live hosts
nmap -sn 10.0.0.0/24 -oN live_hosts.txt

# Step 2: Fast scan of common ports across all live hosts
nmap -F -iL live_hosts_parsed.txt -oA fast_scan

# Step 3: Deep scan on interesting hosts
sudo nmap -sS -sV -sC -p- -oA deep_scan 10.0.0.15

# Step 4: Vulnerability-focused scripts on identified services
nmap --script vuln -p 80,443 10.0.0.15

8.2 Continuous Infrastructure Monitoring

Combine Nmap with cron for periodic drift detection — flagging when a new port opens unexpectedly:

# crontab entry: run every Monday at 6am
0 6 * * 1 /opt/network-audit/scripts/run_scan.sh

Diff consecutive grepable outputs to detect changes:

diff results/2026-09-01/scan_results.gnmap results/2026-09-08/scan_results.gnmap

8.3 Web Service Enumeration

nmap -p 80,443,8080,8443 -sV --script http-enum,http-title,http-headers 192.168.1.10

8.4 Firewall Rule Validation

Test from both inside and outside a segment to confirm ACLs behave as documented:

# From outside the DMZ
nmap -p 443 -sS dmz-host.internal

# From inside the DMZ
nmap -p 3306,5432 -sS dmz-host.internal

9. Best Practices

Get written authorization before scanning any system you don't own — this is non-negotiable, not a formality.
Start narrow, then widen. Use -sn or a fast top-ports scan before running full -p- scans across large ranges.
Use -oA by default so you always retain normal, XML, and grepable output for later analysis.
Rate-limit scans on production networks with --scan-delay or -T2/-T3 to avoid triggering IDS/IPS or degrading service performance.
Version and timestamp your results so you can diff scans over time and detect configuration drift.
Combine host discovery with targeted scanning rather than blindly scanning entire /16 ranges at full port depth.
Validate findings manually — Nmap's version/vuln detection is probabilistic, not authoritative; confirm before reporting a finding as fact.
Keep the NSE script database updated: sudo nmap --script-updatedb.

10. Common Mistakes

Scanning without authorization. Even "just checking" a system you don't control can constitute unauthorized access under law.
Assuming closed/filtered means secure. A filtered result just means Nmap couldn't determine state — it doesn't guarantee the port is unreachable via other paths.
Ignoring UDP. Many critical services (DNS, SNMP, NTP) run on UDP; TCP-only scans miss them entirely.
Running -A or --script vuln against production without a maintenance window. These are noisy and can cause service instability on fragile devices (old printers, embedded systems, IoT).
Not accounting for load balancers/NAT. Scanning a single "target" that's actually behind a load balancer can produce inconsistent results across scans.
Trusting OS detection blindly. -O fingerprinting can misidentify OS versions, especially behind firewalls that normalize TCP/IP stack behavior.
Forgetting sudo/root for raw-socket scans. -sS, -O, and other techniques silently fall back to less accurate methods (or fail) without sufficient privileges.

11. Performance Optimization

Timing templates: -T0 (paranoid) through -T5 (insane) control scan speed. -T4 is a common balance of speed and reliability for most networks.

  nmap -T4 -p- 192.168.1.10

Limit port range when you don't need all 65535 ports:

  nmap -F 192.168.1.0/24   # scans top 100 common ports only

Parallelism controls: --min-parallelism and --max-parallelism tune how many probes run concurrently.
Host timeout: Prevent slow/unresponsive hosts from stalling an entire scan:

  nmap --host-timeout 5m 192.168.1.0/24

Split large ranges across multiple invocations and run them in parallel via a job scheduler for very large networks, rather than one monolithic scan.
Use -n to skip DNS resolution when you don't need hostnames — this alone can significantly cut scan time on large ranges.

12. Security Considerations

Detection risk: Aggressive scans (-A, -T5, full port ranges) are far more likely to trigger IDS/IPS alerts. If your goal is stealth (e.g., authorized red-team engagement), use slower timing and fewer simultaneous probes.
Logging impact: TCP connect scans (-sT) complete full connections and will appear clearly in target-side logs; SYN scans are less visible but not invisible to modern monitoring.
Spoofing and decoys: Nmap supports decoy scanning (-D) to obscure the true source IP among fake ones — useful for authorized red-team exercises, but be aware many networks can still fingerprint the real source via timing analysis.
Data handling: Scan output can reveal sensitive infrastructure details. Store results securely, restrict access, and avoid committing raw scan output to public repositories.
Legal boundaries: Laws governing unauthorized computer access treat unauthorized scanning as a potential offense in most jurisdictions. Always operate under a signed scope-of-work or your own infrastructure.

13. Summary

Nmap remains one of the most versatile tools in a security engineer's or developer's toolkit because it operates at a layer most tooling ignores: raw network behavior. From a simple ping sweep to a full NSE-driven vulnerability assessment, the workflows in this guide — host discovery, targeted scanning, structured output, and scripted automation — form a repeatable foundation for network visibility work.

The core takeaways:

Understand port states and the TCP handshake before interpreting scan results.
Match scan type to intent: fast reconnaissance vs. deep service enumeration vs. vulnerability scanning each call for different flags.
Structure your output and folder layout so scans are comparable over time.
Respect scope, authorization, and rate limits — technical capability isn't the same as permission.

Nmap is a tool you get comfortable with through repetition, not by reading command references once. If you're based in Bangalore and want structured, hands-on practice alongside topics like this, a cyber security course in Bangalore BTM Layout or a dedicated cyber security training in Bangalore BTM Layout can be a useful next step for building these skills in a lab environment with guided feedback.

About the Author

A backend and security-focused engineer with hands-on experience in network auditing, infrastructure hardening, and building internal tooling for continuous security monitoring. Writes about practical, developer-oriented security topics — favoring reproducible workflows over theory.

Supervised vs Unsupervised Learning: A Hands-On Guide for Developers

Ascent Software Training Institute — Tue, 22 Sep 2026 07:30:41 +0000

Got it — I'll add them naturally in a short footer note (the least spammy placement) and give you the complete article.

Supervised vs Unsupervised Learning: A Hands-On Guide for Developers

If you've spent any time around machine learning content, you've seen this distinction thrown around a hundred times: supervised learning uses labeled data, unsupervised learning doesn't. That sentence is true, and also almost useless on its own. It doesn't tell you when to reach for which one, what the code actually looks like, or where things go wrong in practice.

This tutorial fixes that. We're going to build a real classifier, build a real clustering model, break them on purpose, and fix them. By the end you'll have working code, a mental model you can actually use, and a list of mistakes to avoid because you'll have made a few of them yourself.

What You'll Need

Python 3.9+
A virtual environment (recommended, not optional)
Basic comfort with Python and reading pandas DataFrames
No prior ML experience required

Let's set up the environment first.

python -m venv ml-tutorial
source ml-tutorial/bin/activate  # Windows: ml-tutorial\Scripts\activate

pip install scikit-learn pandas numpy matplotlib seaborn jupyter

If you want to follow along without setting anything up locally, consider putting the full code for this tutorial in your own GitHub repo as you work through it — or fork one of scikit-learn's official example notebooks, which cover both paradigms and are worth exploring on their own.

The Core Distinction, Concretely

Forget "labeled vs unlabeled" for a second. Think about it in terms of the question you're asking:

Supervised learning: "Given these examples where I already know the answer, predict the answer for a new example." You have inputs X and known outputs y. The model learns the mapping between them.
Unsupervised learning: "Given this data, find structure I didn't already know about." You have X, but no y. The model finds patterns, groupings, or reduced representations on its own.

A rough analogy that actually holds up: supervised learning is like studying for an exam with an answer key — you check your work against ground truth. Unsupervised learning is like being handed a box of mixed Lego bricks and sorting them into piles based on color and size, with no instruction sheet telling you the "correct" piles.

Let's write code for both.

Part 1: Supervised Learning — Building a Classifier

We'll use the classic Iris dataset (flower measurements → species) because it's small, clean, and lets you focus on the workflow instead of data wrangling.

Step 1: Load and Explore the Data

import pandas as pd
from sklearn.datasets import load_iris

iris = load_iris(as_frame=True)
df = iris.frame
df['species'] = df['target'].map(dict(enumerate(iris.target_names)))

print(df.head())
print(df['species'].value_counts())

Notice we have a target column — that's our label, y. This is what makes it supervised. Without it, this would just be a bag of numbers with no ground truth to learn from.

Step 2: Split Your Data

This is the step people skip when they're excited, and it's the single most important habit to build.

from sklearn.model_selection import train_test_split

X = df.drop(columns=['target', 'species'])
y = df['target']

X_train, X_test, y_train, y_test = train_test_split(
    X, y, test_size=0.2, random_state=42, stratify=y
)

print(f"Train size: {len(X_train)}, Test size: {len(X_test)}")

stratify=y keeps the class proportions consistent across the split — important when classes aren't perfectly balanced. random_state=42 just makes the split reproducible; the number itself is arbitrary.

Step 3: Train a Model

from sklearn.linear_model import LogisticRegression

clf = LogisticRegression(max_iter=200)
clf.fit(X_train, y_train)

That's it. fit() is where the actual learning happens — the model adjusts internal weights to map X_train to y_train as accurately as it can.

Step 4: Evaluate

from sklearn.metrics import classification_report, confusion_matrix

y_pred = clf.predict(X_test)

print(classification_report(y_test, y_pred, target_names=iris.target_names))
print(confusion_matrix(y_test, y_pred))

You should see precision, recall, and F1 scores in the high 0.9s for this dataset — it's an easy one. Real-world data won't be this forgiving, which is exactly why you evaluate on held-out data instead of trusting your gut.

A Quick Exercise

Before moving on, try this yourself:

Swap LogisticRegression for RandomForestClassifier (from sklearn.ensemble) and compare the classification report.
Change test_size to 0.5 and see how much the metrics shift. What does that tell you about how much data this model actually needs?

Part 2: Unsupervised Learning — Finding Structure

Now let's throw away the labels and pretend we don't know the species. This is a common real scenario — you get a dataset and genuinely don't have ground-truth categories yet.

Step 1: Prep the Data (No Labels This Time)

X_unsupervised = df.drop(columns=['target', 'species'])

That's the whole "label" story — there isn't one. X_unsupervised is just four measurement columns.

Step 2: Cluster with K-Means

from sklearn.cluster import KMeans
from sklearn.preprocessing import StandardScaler

scaler = StandardScaler()
X_scaled = scaler.fit_transform(X_unsupervised)

kmeans = KMeans(n_clusters=3, random_state=42, n_init=10)
clusters = kmeans.fit_predict(X_scaled)

df['cluster'] = clusters
print(df.groupby('cluster')['species'].value_counts())

Run this and you'll usually see the clusters line up fairly well with the actual species — which is a nice sanity check, but remember: the algorithm never saw the species labels. It found groupings purely from the structure of the measurements.

Step 3: Figure Out How Many Clusters You Actually Need

In the real world you don't know n_clusters in advance. The "elbow method" is the standard starting point:

import matplotlib.pyplot as plt

inertias = []
k_range = range(1, 10)

for k in k_range:
    km = KMeans(n_clusters=k, random_state=42, n_init=10)
    km.fit(X_scaled)
    inertias.append(km.inertia_)

plt.plot(k_range, inertias, marker='o')
plt.xlabel('Number of clusters (k)')
plt.ylabel('Inertia')
plt.title('Elbow Method for Optimal k')
plt.savefig('elbow_plot.png')
plt.show()

You're looking for the point where adding more clusters stops meaningfully reducing inertia — the "elbow" in the curve. It's a heuristic, not a precise answer, so pair it with domain knowledge whenever you can.

Step 4: Dimensionality Reduction (Another Flavor of Unsupervised Learning)

Clustering isn't the only unsupervised technique. PCA (Principal Component Analysis) compresses your features into fewer dimensions while preserving as much variance as possible — useful for visualization and for speeding up downstream models.

from sklearn.decomposition import PCA

pca = PCA(n_components=2)
X_pca = pca.fit_transform(X_scaled)

plt.scatter(X_pca[:, 0], X_pca[:, 1], c=clusters, cmap='viridis')
plt.xlabel('PC1')
plt.ylabel('PC2')
plt.title('PCA Projection Colored by Cluster')
plt.savefig('pca_plot.png')
plt.show()

print(f"Explained variance ratio: {pca.explained_variance_ratio_}")

If explained_variance_ratio_ sums to something like 0.95+, your 2D plot is a pretty faithful representation of the original 4D data.

A Quick Exercise

Try n_clusters=2 and n_clusters=5 on the same data. Does either produce a more "sensible" grouping than 3?
Swap KMeans for DBSCAN (from sklearn.cluster import DBSCAN) — no need to specify cluster count up front. Compare the results.

Side-by-Side Comparison

	Supervised	Unsupervised
Needs labeled data	Yes	No
Typical goal	Predict a known output	Discover structure
Example algorithms	Logistic Regression, Random Forest, SVM	K-Means, DBSCAN, PCA
Evaluation	Accuracy, F1, RMSE against ground truth	Inertia, silhouette score, domain judgment
Common use cases	Spam detection, price prediction, image classification	Customer segmentation, anomaly detection, topic modeling
Data cost	Labeling is often expensive	Often cheaper — you already have raw data

Common Errors and Troubleshooting

"My classifier gets 100% accuracy on training data but performs terribly on new data."
Classic overfitting. Your model memorized the training set instead of learning generalizable patterns. Fixes: reduce model complexity, add regularization (LogisticRegression(C=0.1) for stronger regularization), get more training data, or use cross-validation to catch this earlier:

from sklearn.model_selection import cross_val_score
scores = cross_val_score(clf, X, y, cv=5)
print(f"CV accuracy: {scores.mean():.3f} (+/- {scores.std():.3f})")

"KMeans gives different results every time I run it."
KMeans initializes cluster centers somewhat randomly. Set random_state for reproducibility and use n_init=10 (or higher) so it runs multiple initializations and keeps the best one.

"My clusters don't make any sense."
Almost always a scaling issue. K-Means uses distance, and if one feature is measured in the thousands (like income) while another is 0–1 (like a ratio), the large-scale feature dominates the distance calculation regardless of actual importance. Always StandardScaler or MinMaxScaler your features before clustering.

"ValueError: Input contains NaN."
Both paradigms choke on missing values. Check with df.isnull().sum() before doing anything else, and decide deliberately: drop rows, impute with SimpleImputer, or investigate why the data is missing in the first place — sometimes missingness itself is informative.

"My model is 'accurate' but useless in production."
Check for class imbalance. A classifier predicting "not fraud" 100% of the time can hit 99% accuracy on a dataset where fraud is 1% of cases, while being completely useless. Look at precision/recall per class, not just overall accuracy, and consider class_weight='balanced' in your model.

Performance Tips

Scale before you cluster, always. This is the single most common unsupervised bug.
Use n_jobs=-1 on estimators that support it (like RandomForestClassifier) to parallelize across CPU cores.
For large datasets, MiniBatchKMeans trades a little accuracy for a lot of speed compared to standard KMeans.
Don't fit your scaler on the full dataset before splitting. Fit on X_train only, then .transform() on X_test. Fitting on everything leaks test-set information into training — a subtle form of cheating that inflates your metrics.
Cache expensive preprocessing. If you're iterating on model choice but not on feature engineering, pickle your processed X_train/X_test so you're not recomputing it every run.

Best Practices Worth Internalizing

Always hold out a test set, even for quick experiments. It's tempting to skip this "just to check something," and that's exactly when bad habits form.
Start simple. Logistic Regression before Random Forest before a neural net. Get a baseline before reaching for complexity.
Visualize before you model. A quick seaborn.pairplot() or df.describe() catches more bugs than any algorithm will.
Don't trust a single metric. Accuracy alone hides class imbalance problems; inertia alone hides bad cluster counts. Look at multiple angles.
Version your data and your model, not just your code. pip freeze > requirements.txt and consider DVC or even just saving dataset hashes if reproducibility matters to your project.

Where to Go From Here

scikit-learn's official user guide — genuinely one of the best-written docs in the Python ecosystem, worth reading cover to cover once.
Google's Machine Learning Crash Course — free, hands-on, good for reinforcing the fundamentals covered here.
Hands-On Machine Learning with Scikit-Learn, Keras, and TensorFlow by Aurélien Géron — the book most working ML engineers point beginners toward.
Kaggle Learn — short, free, code-first courses, plus real datasets to practice both supervised and unsupervised techniques on once you're past the toy examples.
The scikit-learn GitHub examples directory is worth bookmarking — it's a good habit to skim a real implementation before reaching for a tutorial.

Wrapping Up

The labeled/unlabeled distinction is the right starting point, but the real difference shows up in the workflow: supervised learning is a loop of predict → compare to ground truth → adjust. Unsupervised learning is a loop of group or compress → inspect → decide if it's meaningful, because there's no ground truth to check against.

Both of the code examples above are short enough to run start to finish in under ten minutes. If you haven't already, open a notebook and actually run them — swapping in your own dataset once you've got the Iris example working is the fastest way to make this stick.

If you hit an error not covered here, drop it in the comments — troubleshooting real stack traces is usually more useful than any tutorial section.

Side note: this write-up started as prep material for a session on some of these concepts — if you're weighing data science courses in Bangalore's BTM Layout, or data science training in Bangalore more generally, feel free to ask in the comments and I'm happy to share notes.

Excel vs Power BI for Data Analytics: A Hands-On Guide for Developers

Ascent Software Training Institute — Mon, 21 Sep 2026 09:16:27 +0000

Excel vs Power BI for Data Analytics: A Hands-On Guide for Developers

If you work as a developer, Excel and Power BI can initially feel like two tools from a different ecosystem. You are probably more comfortable with SQL, Python, APIs, Git, and application code than with pivot tables and drag-and-drop dashboards.

The good news is that both tools become much easier when you treat them as parts of a data pipeline:

Raw data → Clean data → Data model → Calculations → Visualization → Decision

Excel is excellent for quick exploration, lightweight analysis, and business-friendly reporting. Power BI is usually the better choice for reusable data models, interactive dashboards, scheduled refreshes, and larger datasets.

In this tutorial, we will compare both tools by building the same sales-analysis workflow in Excel and Power BI.

What We Will Build

We will use a simple sales dataset containing:

Order date.
Region.
Product category.
Product.
Quantity.
Unit price.
Discount.
Customer segment.

The final analysis should answer questions such as:

What is total revenue?
Which region generates the most sales?
Which product categories are growing?
What is the average order value?
How much revenue came from discounted orders?
Which months performed best?

Excel vs Power BI at a Glance

Requirement	Excel	Power BI
Quick ad hoc analysis	Excellent	Good
Small datasets	Excellent	Good
Large reusable models	Limited	Excellent
Interactive dashboards	Good	Excellent
Complex calculations	Formulas, PivotTables, Power Query	DAX, Power Query
Automated refresh	Possible, but often manual	Strong support
Collaboration	Easy for file-based workflows	Better for governed reporting
Version control	Difficult with binary workbooks	Better with supporting files and documentation
Learning curve	Lower initially	Higher, especially for DAX and modeling
Best audience	Analysts, business users, small teams	Analysts, developers, BI teams, organizations

The most useful way to think about the difference is this:

Excel is primarily a spreadsheet and analysis environment.
Power BI is primarily a semantic modeling and reporting environment.

They overlap, but they optimize for different workflows.

Part 1: Analyze the Data in Excel

Step 1: Import the CSV

Open Excel and select:

Data → Get Data → From File → From Text/CSV

Select sales.csv.

Before loading the data, check:

OrderDate is recognized as a date.
Quantity is a whole number.
UnitPrice is a decimal number.
Discount is a percentage or decimal.
Text columns do not contain unexpected spaces.

Click Transform Data instead of loading immediately. This opens Power Query.

Step 2: Clean the Data with Power Query

Power Query is one of Excel’s most useful features because it lets you repeat transformations instead of manually cleaning the workbook every time.

In Power Query:

Select Region, Category, Product, and Segment.
Choose Transform → Format → Trim.
Set the correct data types.
Check for null values.
Remove duplicate OrderID values if each order should be unique.
Add a custom Revenue column.

The custom column expression is:

[Quantity] * [UnitPrice] * (1 - [Discount])

Power Query’s M language version looks like this:

= Table.AddColumn(
    PreviousStep,
    "Revenue",
    each [Quantity] * [UnitPrice] * (1 - [Discount]),
    type number
)

You can also add a month column:

= Table.AddColumn(
    PreviousStep,
    "Month",
    each Date.StartOfMonth([OrderDate]),
    type date
)

A complete simplified query may look like this:

let
    Source = Csv.Document(
        File.Contents("data/sales.csv"),
        [Delimiter=",", Columns=9, Encoding=65001, QuoteStyle=QuoteStyle.Csv]
    ),
    PromotedHeaders = Table.PromoteHeaders(Source, [PromoteAllScalars=true]),
    ChangedTypes = Table.TransformColumnTypes(
        PromotedHeaders,
        {
            {"OrderID", Int64.Type},
            {"OrderDate", type date},
            {"Region", type text},
            {"Category", type text},
            {"Product", type text},
            {"Quantity", Int64.Type},
            {"UnitPrice", type number},
            {"Discount", type number},
            {"Segment", type text}
        }
    ),
    AddedRevenue = Table.AddColumn(
        ChangedTypes,
        "Revenue",
        each [Quantity] * [UnitPrice] * (1 - [Discount]),
        type number
    ),
    AddedMonth = Table.AddColumn(
        AddedRevenue,
        "Month",
        each Date.StartOfMonth([OrderDate]),
        type date
    )
in
    AddedMonth

Click Close & Load To and load the result into Excel as a table.

Step 3: Create Excel Formulas

If the data is loaded into an Excel table named Sales, you can add calculated columns.

Revenue

=[@Quantity]*[@UnitPrice]*(1-[@Discount])

Gross sales before discount

=[@Quantity]*[@UnitPrice]

Discount amount

=[@Quantity]*[@UnitPrice]*[@Discount]

Order month

=DATE(YEAR([@OrderDate]),MONTH([@OrderDate]),1)

Structured references are preferable to cell references such as =F2*G2. They are easier to read and automatically expand when new rows are added.

Step 4: Create a PivotTable

Select the Sales table:

Insert → PivotTable

Configure it like this:

Rows: Region
Columns: Category
Values: Revenue
Filters: Segment
Optional filter: OrderDate

This gives you revenue by region and category.

Create another PivotTable:

Rows: Month
Values: Revenue
Values: Quantity
Values: OrderID

For OrderID, change the aggregation from Sum to Count.

You now have:

Monthly revenue.
Units sold.
Order count.

Step 5: Add Excel Measures

Excel’s Data Model and Power Pivot allow you to define reusable measures rather than repeating formulas in every worksheet.

Example measure:

Total Revenue :=
SUM(Sales[Revenue])

Average order value:

Average Order Value :=
DIVIDE(
    [Total Revenue],
    DISTINCTCOUNT(Sales[OrderID])
)

Revenue from discounted orders:

Discounted Revenue :=
CALCULATE(
    [Total Revenue],
    Sales[Discount] > 0
)

Discounted revenue percentage:

Discounted Revenue % :=
DIVIDE(
    [Discounted Revenue],
    [Total Revenue]
)

The same DAX concepts transfer directly to Power BI. This is one reason Excel with Power Pivot can be a useful transition point for developers moving toward BI work.

Part 2: Build the Same Analysis in Power BI

Step 1: Load the Data

Open Power BI Desktop:

Home → Get Data → Text/CSV

Select sales.csv, then choose Transform Data.

The Power Query editor in Power BI uses the same general transformation language as Excel. The interface differs slightly, but concepts such as filtering, changing types, merging queries, and adding columns are similar.

Apply the following transformations:

Set column types.
Trim text columns.
Remove invalid rows.
Add Revenue.
Add Month.
Rename the query to Sales.

Click Close & Apply.

Step 2: Create a Date Table

Do not rely only on an automatically generated date hierarchy for serious reporting. Create an explicit date table.

In Power BI, choose:

Modeling → New table

Use this DAX:

Date =
ADDCOLUMNS(
    CALENDAR(
        MIN(Sales[OrderDate]),
        MAX(Sales[OrderDate])
    ),
    "Year", YEAR([Date]),
    "Month Number", MONTH([Date]),
    "Month", FORMAT([Date], "MMM"),
    "Year Month", FORMAT([Date], "YYYY-MM")
)

Sort the month name correctly:

Select the Month column.
Choose Column tools.
Select Sort by column.
Choose Month Number.

Then mark the table as a date table:

Table tools → Mark as date table → Date

Create a relationship:

Date[Date] → Sales[OrderDate]

Use a one-to-many relationship:

Date (1) → Sales (*)

This is an important modeling habit. Without a proper date table, time-based calculations can produce confusing results.

Step 3: Create Core DAX Measures

Create the following measures.

Total revenue

Total Revenue =
SUM(Sales[Revenue])

Total quantity

Total Quantity =
SUM(Sales[Quantity])

Order count

Order Count =
DISTINCTCOUNT(Sales[OrderID])

Average order value

Average Order Value =
DIVIDE(
    [Total Revenue],
    [Order Count]
)

Revenue last year

Revenue Last Year =
CALCULATE(
    [Total Revenue],
    DATEADD('Date'[Date], -1, YEAR)
)

Year-over-year growth

Revenue YoY % =
DIVIDE(
    [Total Revenue] - [Revenue Last Year],
    [Revenue Last Year]
)

Revenue rank by product

Product Revenue Rank =
RANKX(
    ALL(Sales[Product]),
    [Total Revenue],
    ,
    DESC,
    Dense
)

Discounted revenue

Discounted Revenue =
CALCULATE(
    [Total Revenue],
    Sales[Discount] > 0
)

Discount rate

Discount Rate =
DIVIDE(
    [Discounted Revenue],
    [Total Revenue]
)

Use measures for business logic that must respond to filters. Use calculated columns for row-level values such as revenue per row or order month.

Step 4: Build the Dashboard

Create a report page with these visuals.

KPI cards

Add cards for:

Total Revenue.
Total Quantity.
Order Count.
Average Order Value.
Revenue YoY %.

Revenue trend

Add a line chart:

X-axis: Date[Year Month]
Y-axis: [Total Revenue]

Revenue by region

Add a clustered bar chart:

Y-axis: Sales[Region]
X-axis: [Total Revenue]

Category performance

Add a column chart:

X-axis: Sales[Category]
Y-axis: [Total Revenue]

Detail table

Add a table with:

Product.
Category.
Quantity.
Total Revenue.
Product Revenue Rank.

Slicers

Add slicers for:

Year.
Region.
Category.
Segment.

The important difference from a static Excel report is that Power BI visuals use a shared model. Selecting one region can filter the cards, chart, and table at the same time.

Part 3: When Should Developers Use Each Tool?

Choose Excel When

Excel is usually the better choice when:

You need a quick one-off analysis.
The dataset is relatively small.
A business user needs to edit assumptions manually.
The output must be sent as a workbook.
You need flexible cell-level calculations.
You are still exploring the business question.
The report does not require frequent automated refreshes.

For example, a developer investigating API latency for one release might export a few thousand rows and use Excel to examine distributions, create pivots, and annotate findings.

Choose Power BI When

Power BI is usually the better choice when:

Multiple people consume the report.
Data refreshes regularly.
You need row-level security.
The report combines multiple sources.
You need a reusable semantic model.
Users need interactive filtering.
The dataset is too large or complex for a comfortable workbook.
You want centralized measures and definitions.

For example, an engineering organization might use Power BI to monitor deployment frequency, incident trends, cloud costs, and service-level objectives across teams.

Use Both

In real projects, the decision is not always Excel versus Power BI.

A practical workflow is:

SQL/Python → Power Query → Power BI model → Excel-connected analysis

Power BI can provide the governed model while Excel remains useful for ad hoc analysis and finance-style reporting.

Part 4: GitHub Workflow for Analytics Projects

Binary files such as .xlsx and .pbix do not diff cleanly in Git. You should still version the project, but commit supporting assets around them.

A useful .gitignore might contain:

# Temporary Excel files
~$*.xlsx
*.tmp

# Power BI local cache and backup files
*.pbi
*.pbir-backup

# Operating system files
.DS_Store
Thumbs.db

# Local secrets
.env
secrets.json

# Large local extracts
data/raw/

Commit the following:

README.md
data/sample/sales.csv
sql/load_sales.sql
docs/data-dictionary.md
docs/metric-definitions.md
powerbi/sales_dashboard.pbix
excel/sales_analysis.xlsx

Do not commit:

Passwords.
Database connection strings containing secrets.
Customer-level production data.
Large generated extracts.
Personal access tokens.

A good README should include:

# Sales Analytics Project

## Questions answered

- What is total revenue by month?
- Which region performs best?
- What is the average order value?
- How much revenue comes from discounted orders?

## Data source

The sample dataset is synthetic and contains no production customer data.

## Tools

- Excel Power Query
- Power Pivot
- Power BI Desktop
- DAX

## Refresh instructions

1. Replace `data/sample/sales.csv`.
2. Open the workbook or PBIX file.
3. Refresh the queries.
4. Verify row counts and KPI values.

## Validation checks

- OrderID must not be null.
- Quantity must be greater than zero.
- Discount must be between 0 and 1.
- Revenue must not be negative.

Part 5: Practical Exercises

Exercise 1: Add Profit

Add two columns:

CostPerUnit
ShippingCost

Then calculate:

Profit = Revenue - (Quantity × CostPerUnit) - ShippingCost

In Excel:

=[@Revenue]-([@Quantity]*[@CostPerUnit])-[@ShippingCost]

In Power BI:

Total Profit =
SUM(Sales[Profit])

Then create:

Profit Margin % =
DIVIDE(
    [Total Profit],
    [Total Revenue]
)

Compare profit margin by region.

Exercise 2: Compare Current and Previous Month

Create a measure:

Revenue Previous Month =
CALCULATE(
    [Total Revenue],
    DATEADD('Date'[Date], -1, MONTH)
)

Then:

MoM Growth % =
DIVIDE(
    [Total Revenue] - [Revenue Previous Month],
    [Revenue Previous Month]
)

Test the measure against a manually calculated month in Excel.

Exercise 3: Find the Top 10 Products

Create a table visual with:

Product.
Total Revenue.
Product Revenue Rank.

Apply a visual-level filter:

Product Revenue Rank is less than or equal to 10

Repeat the same analysis in Excel using a PivotTable and a value filter.

Exercise 4: Add a Target Table

Create targets.csv:

Month,Region,TargetRevenue
2025-01-01,South,50000
2025-01-01,West,45000
2025-02-01,South,55000
2025-02-01,West,48000

Load it into Power BI and create a relationship using month and region. Depending on the model, you may need a combined key:

Month Region Key =
FORMAT(Sales[Month], "YYYY-MM") & "-" & Sales[Region]

A cleaner production design would use dimension tables and bridge keys instead of relying on concatenated columns everywhere. Use the concatenated approach only as a learning exercise.

Performance Tips

In Excel

Convert source ranges into Excel Tables.
Use Power Query instead of hundreds of manual formulas.
Avoid volatile functions such as INDIRECT, OFFSET, and excessive TODAY() usage.
Avoid full-column array formulas over very large ranges.
Use PivotTables for grouped analysis.
Keep raw data, transformations, calculations, and presentation on separate sheets.
Reduce unnecessary conditional formatting.
Load large transformation results to the Data Model instead of displaying every row.

In Power BI

Remove unused columns before loading data.
Filter unnecessary rows in Power Query.
Prefer a star schema with fact and dimension tables.
Use integer keys where practical.
Avoid excessive calculated columns.
Prefer measures for filter-sensitive calculations.
Avoid many-to-many relationships unless the business model truly requires them.
Keep date logic in a dedicated date table.
Use Performance Analyzer to identify slow visuals.
Avoid putting too many high-cardinality fields into one visual.
Aggregate data before loading it when row-level detail is not needed.
Use incremental refresh for large, regularly updated datasets where supported.

A common mistake is optimizing DAX before fixing the data model. A clean model often improves performance more than rewriting a single measure.

Troubleshooting Common Errors

“My months are out of order”

If you display month names alphabetically, Power BI may show:

Apr, Aug, Dec, Feb, Jan, Jul...

Fix it by sorting Month by Month Number.

In Excel, sort by an actual date column or use a YYYY-MM field.

“My revenue is duplicated”

This usually happens because of:

Duplicate source rows.
An incorrect relationship.
A many-to-many relationship.
Joining tables at incompatible granularities.

Check the grain of each table. Ask:

What does one row represent?

For example:

One row per order.
One row per order line.
One row per customer.
One row per monthly target.

Do not join a customer-level table directly to an order-line table without understanding the relationship.

“The YoY measure returns blank”

Check:

Whether the date table contains continuous dates.
Whether the date table is marked as a date table.
Whether the relationship to Sales[OrderDate] is active.
Whether the current filter context contains a valid date range.
Whether the previous year actually exists in the dataset.

“Power Query changed my dates incorrectly”

CSV files do not always carry reliable type metadata. Check locale settings when importing dates.

For example, a value such as:

04/05/2025

could mean April 5 or May 4 depending on locale.

Use an explicit locale when changing the column type rather than relying on automatic detection.

“The Excel formula returns zero”

Check whether:

UnitPrice was imported as text.
Discount contains % characters stored as text.
Numbers use a different decimal separator.
Blank values are being interpreted unexpectedly.

Use VALUE() only when necessary. It is usually better to fix the data type during import.

“Power BI visual is slow”

Use this order:

Remove unnecessary fields from the visual.
Check whether the measure scans a very large table.
Review relationships.
Inspect Performance Analyzer.
Reduce high-cardinality columns.
Aggregate the source data if row-level detail is unnecessary.

“The Power BI file works only on my computer”

The report may depend on:

A local file path.
A local database.
A mapped network drive.
Credentials stored in Desktop.
A missing gateway.

Use stable data sources and document connection requirements in the README. Never hard-code a personal path such as:

C:\Users\YourName\Desktop\sales.csv

Prefer a configurable parameter or a repository-relative workflow for local learning projects.

Best Practices for Developers

Define the Grain First

Before writing a formula, define what a row means.

If Sales contains one row per order line, then Quantity can be summed. If it contains one row per order, the same logic may still work, but product-level analysis may not.

Separate Transformation from Presentation

Avoid mixing raw data, cleanup, calculations, and charts in the same worksheet.

A better design is:

Raw → Staging → Model → Measures → Report

This structure is useful in Excel, Power BI, SQL, and code-based analytics.

Validate Results Independently

Calculate total revenue in two ways:

In SQL or Python.
In Excel or Power BI.

For example, in SQL:

SELECT
    SUM(quantity * unit_price * (1 - discount)) AS total_revenue
FROM sales;

If Power BI produces a different result, investigate before publishing the report.

Create a Metric Dictionary

Document definitions such as:

Total Revenue:
Quantity × Unit Price × (1 - Discount)

Order Count:
Distinct count of OrderID

Average Order Value:
Total Revenue ÷ Distinct Order Count

Revenue YoY %:
(Current Revenue - Previous Year Revenue) ÷ Previous Year Revenue

A metric dictionary prevents different teams from using different definitions for “revenue” or “active customer.”

Treat Dashboards Like Software

Use:

Clear naming.
Reusable measures.
Validation tests.
Change history.
Documentation.
Access controls.
Reproducible refresh steps.

A polished dashboard with an incorrect metric is worse than a plain table with a correct one.

Learning Resources

Start with official documentation before relying on random tutorials:

Study Power BI sample datasets and reports for hands-on practice.
Explore sample-data repositories and documentation projects on GitHub.
Read documentation on Power Query, DAX, data modeling, relationships, and Performance Analyzer.
Practise by rebuilding the same report in Excel and Power BI.
Use GitHub to store sample data, SQL scripts, documentation, and validation queries.

If you are comparing training options in Bangalore, avoid choosing an institute solely because its page uses phrases such as “best data analyst training institute in Bangalore”.Those are search phrases, not proof of quality. Compare the syllabus, instructor experience, hands-on projects, tool coverage, mentor access, refund policy, and independently verifiable student outcomes. Verify those claims directly before enrolling.

Final Recommendation

Start with Excel if you want to understand the data quickly and explore business questions interactively. Move to Power BI when the analysis needs reusable models, shared dashboards, regular refreshes, multiple data sources, or controlled access.

For developers, the most valuable path is not learning isolated buttons. Build the same project twice:

CSV → Power Query → Excel PivotTable
CSV → Power Query → Power BI model → DAX dashboard

Then validate both outputs with SQL or Python.

That workflow teaches the skills that matter in real analytics projects: data cleaning, modeling, metric design, validation, performance, and communication.

Build a Student Management System in Python (CLI + JSON)

Ascent Software Training Institute — Fri, 18 Sep 2026 06:54:35 +0000

Build a Student Management System in Python (CLI + JSON)

A practical, hands-on tutorial to build a terminal-based Student Management System in Python using clean functions, JSON persistence, and real-world patterns you can extend later.

This project is ideal if you’re learning Python fundamentals, prepping for interviews, or assembling portfolio pieces for roles that value scripting, data handling, and CLI tooling. If you’re exploring a Python full stack course in Bangalore with placement, this kind of project fits perfectly into a portfolio that shows practical skills.

What you’ll build

A command-line app that lets you:

Add student records (name, roll number, age, course, marks)
View all students
Search by roll number or name
Update marks or course
Delete a student
Persist data to students.json so records survive restarts

We’ll keep it simple first (one file), then refactor into a small multi-file structure so it feels like a real project.

Who this is for

Developers comfortable with basic Python (functions, loops, dicts, files)
Anyone who learns best by building small, useful tools
People exploring Python for automation, data scripts, or backend foundations

Note: This tutorial avoids heavy frameworks on purpose. You’ll focus on logic, data design, and file I/O—skills that transfer to APIs, ETL jobs, and CLI utilities. This is exactly the kind of work you’d expand on in a Python full stack course in Bangalore with placement, where projects and portfolios matter.

Prerequisites

Python 3.10+ installed and on your PATH
A code editor (VS Code, PyCharm, or even Sublime)
Terminal access (Command Prompt, PowerShell, or macOS/Linux terminal)

Optional but helpful:

Git installed (for version control and GitHub examples later)

Project setup

Create a project folder and a virtual environment:

mkdir student_mgmt_cli
cd student_mgmt_cli

# macOS / Linux
python3 -m venv .venv
source .venv/bin/activate

# Windows
python -m venv .venv
.venv\Scripts\activate

Create your main file:

touch student_management.py   # macOS/Linux
# or
echo. > student_management.py  # Windows

Open student_management.py in your editor.

Step 1 — Define the data model

We’ll store each student as a dictionary and keep all students in a list. This keeps things readable and easy to serialize to JSON.

Add this at the top of student_management.py:

import json
from pathlib import Path

DATA_FILE = Path("students.json")

We use pathlib.Path for clean file handling.

Step 2 — Load and save data

Create helper functions to read/write JSON. We’ll handle missing files and basic errors.

def load_students():
    if not DATA_FILE.exists():
        return []
    try:
        with DATA_FILE.open("r", encoding="utf-8") as f:
            return json.load(f)
    except (json.JSONDecodeError, IOError):
        print("⚠️  Data file corrupted. Starting with empty records.")
        return []

def save_students(students):
    try:
        with DATA_FILE.open("w", encoding="utf-8") as f:
            json.dump(students, f, indent=2, ensure_ascii=False)
    except IOError as e:
        print(f"❌ Failed to save data: {e}")

Step 3 — Input validation

Real apps validate input. We’ll write small validators for name, roll number, age, and marks.

def get_non_empty(prompt: str) -> str:
    while True:
        value = input(prompt).strip()
        if value:
            return value
        print("⚠️  This field cannot be empty.")

def get_int(prompt: str, min_val: int | None = None, max_val: int | None = None) -> int:
    while True:
        value = input(prompt).strip()
        try:
            num = int(value)
            if min_val is not None and num < min_val:
                print(f"⚠️  Value must be at least {min_val}.")
                continue
            if max_val is not None and num > max_val:
                print(f"⚠️  Value must be at most {max_val}.")
                continue
            return num
        except ValueError:
            print("⚠️  Please enter a valid integer.")

Step 4 — CRUD functions

We’ll implement Create, Read, Update, Delete operations as separate functions. This keeps the code testable and readable.

Add a student

def add_student(students: list[dict]) -> None:
    print("\n➕ Add Student")

    roll = get_non_empty("Roll number (unique ID): ")
    # Prevent duplicate roll numbers
    if any(s["roll"] == roll for s in students):
        print("❌ Roll number already exists.")
        return

    name = get_non_empty("Full name: ")
    age = get_int("Age: ", min_val=10, max_val=100)
    course = get_non_empty("Course: ")
    marks = get_int("Marks (0–100): ", min_val=0, max_val=100)

    student = {
        "roll": roll,
        "name": name,
        "age": age,
        "course": course,
        "marks": marks,
    }

    students.append(student)
    save_students(students)
    print("✅ Student added.")

View all students

def view_students(students: list[dict]) -> None:
    print("\n📋 All Students")
    if not students:
        print("No records found.")
        return

    for s in students:
        print(
            f"Roll: {s['roll']} | Name: {s['name']} | Age: {s['age']} "
            f"| Course: {s['course']} | Marks: {s['marks']}"
        )

Search by roll or name

def search_student(students: list[dict]) -> None:
    print("\n🔍 Search Student")
    query = input("Enter roll number or part of name: ").strip().lower()
    if not query:
        print("⚠️  Search query cannot be empty.")
        return

    results = [
        s for s in students
        if query in s["roll"].lower() or query in s["name"].lower()
    ]

    if not results:
        print("No matching records.")
        return

    print(f"Found {len(results)} record(s):")
    for s in results:
        print(
            f"Roll: {s['roll']} | Name: {s['name']} | Age: {s['age']} "
            f"| Course: {s['course']} | Marks: {s['marks']}"
        )

Update marks or course

We’ll allow partial updates: only fields the user chooses to change.

def update_student(students: list[dict]) -> None:
    print("\n✏️  Update Student")
    roll = input("Enter roll number to update: ").strip()
    student = next((s for s in students if s["roll"] == roll), None)

    if not student:
        print("❌ Student not found.")
        return

    print(f"Current → Name: {student['name']}, Age: {student['age']}, "
          f"Course: {student['course']}, Marks: {student['marks']}")

    action = input("Update (m)arks or (c)ourse? [m/c]: ").strip().lower()
    if action == "m":
        new_marks = get_int("New marks (0–100): ", min_val=0, max_val=100)
        student["marks"] = new_marks
    elif action == "c":
        new_course = get_non_empty("New course: ")
        student["course"] = new_course
    else:
        print("⚠️  Invalid choice.")
        return

    save_students(students)
    print("✅ Student updated.")

Delete a student

def delete_student(students: list[dict]) -> None:
    print("\n🗑️  Delete Student")
    roll = input("Enter roll number to delete: ").strip()
    student = next((s for s in students if s["roll"] == roll), None)

    if not student:
        print("❌ Student not found.")
        return

    confirm = input(f"Delete {student['name']} (Roll: {roll})? [y/N]: ").strip().lower()
    if confirm != "y":
        print("ℹ️  Deletion cancelled.")
        return

    students.remove(student)
    save_students(students)
    print("✅ Student deleted.")

Step 5 — The menu loop

Wire everything together with a simple text menu.

def menu():
    students = load_students()

    while True:
        print("\n=== Student Management System ===")
        print("1. Add student")
        print("2. View all students")
        print("3. Search student")
        print("4. Update student")
        print("5. Delete student")
        print("6. Exit")

        choice = input("Choose an option (1–6): ").strip()

        if choice == "1":
            add_student(students)
        elif choice == "2":
            view_students(students)
        elif choice == "3":
            search_student(students)
        elif choice == "4":
            update_student(students)
        elif choice == "5":
            delete_student(students)
        elif choice == "6":
            print("👋 Goodbye!")
            break
        else:
            print("⚠️  Invalid option. Try again.")

if __name__ == "__main__":
    menu()

Run it:

python student_management.py

Test the main flows:

Add a student with valid data
View all students and confirm it appears
Search by name and roll
Update marks, then view again
Delete and verify it’s gone
Close and rerun to ensure data persists

Step 6 — Refactor into a small project structure

Single-file scripts are fine for learning, but real projects split concerns. Let’s reorganize into modules similar to common CLI patterns.

Create this structure:

student_mgmt_cli/
├── .venv/
├── data/
│   └── students.json
├── src/
│   ├── __init__.py
│   ├── main.py
│   ├── storage.py
│   ├── validators.py
│   └── operations.py
└── README.md

Move logic:

storage.py → load_students, save_students (use data/students.json)
validators.py → get_non_empty, get_int
operations.py → add_student, view_students, search_student, update_student, delete_student
main.py → menu() and entry point

Example: src/storage.py

import json
from pathlib import Path

DATA_FILE = Path(__file__).resolve().parent.parent / "data" / "students.json"

def load_students():
    if not DATA_FILE.exists():
        DATA_FILE.parent.mkdir(parents=True, exist_ok=True)
        return []
    try:
        with DATA_FILE.open("r", encoding="utf-8") as f:
            return json.load(f)
    except (json.JSONDecodeError, IOError):
        print("⚠️  Data file corrupted. Starting with empty records.")
        return []

def save_students(students):
    try:
        with DATA_FILE.open("w", encoding="utf-8") as f:
            json.dump(students, f, indent=2, ensure_ascii=False)
    except IOError as e:
        print(f"❌ Failed to save data: {e}")

Example: src/main.py

from .storage import load_students
from .operations import (
    add_student,
    view_students,
    search_student,
    update_student,
    delete_student,
)

def menu():
    students = load_students()

    while True:
        print("\n=== Student Management System ===")
        print("1. Add student")
        print("2. View all students")
        print("3. Search student")
        print("4. Update student")
        print("5. Delete student")
        print("6. Exit")

        choice = input("Choose an option (1–6): ").strip()

        if choice == "1":
            add_student(students)
        elif choice == "2":
            view_students(students)
        elif choice == "3":
            search_student(students)
        elif choice == "4":
            update_student(students)
        elif choice == "5":
            delete_student(students)
        elif choice == "6":
            print("👋 Goodbye!")
            break
        else:
            print("⚠️  Invalid option. Try again.")

def run():
    menu()

if __name__ == "__main__":
    run()

Update operations.py to import validators and storage:

from .validators import get_non_empty, get_int
from .storage import save_students

Create a simple runner script at the root:

# run.py
from src.main import run

if __name__ == "__main__":
    run()

Run with:

python run.py

This structure mirrors how small Python CLIs are organized in practice and makes future growth (tests, APIs, packaging) easier. Building projects like this is exactly what you’d do in a Python full stack course in Bangalore with placement, where the focus is on employable, portfolio-ready work.

GitHub example: initialize and push

Version control your project so you can track changes and share it.

git init
git add .
git commit -m "Initial commit: CLI student management system"

# Create a repo on GitHub, then:
git remote add origin https://github.com/your-username/student_mgmt_cli.git
git branch -M main
git push -u origin main

In your README.md, include:

Project overview
Features list
Installation steps
Usage examples
Sample commands and screenshots (optional)

This becomes a solid portfolio piece for Python roles and full-stack learning paths. If you’re aiming for a Python full stack course in Bangalore with placement, treat this repo as one of your core projects and keep improving it.

Practical exercises

Try these to deepen understanding:

Grade calculation

Add a function that computes grade (A/B/C/D/F) from marks and displays it alongside each student.
Statistics

Implement:
- Average marks across all students
- Highest and lowest marks
- Count of students per course
Export to CSV

Add an option to export the current student list to students.csv using Python’s csv module.
Bulk import

Allow importing students from a JSON or CSV file (validate and skip duplicates).
Simple tests

Write a few pytest tests for validators and operations (e.g., duplicate roll detection, invalid marks).

These exercises are great talking points in interviews and fit well into the project work you’d do in a Python full stack course in Bangalore with placement.

Troubleshooting common errors

Error: ModuleNotFoundError: No module named 'src'

Ensure you run from the project root: python run.py
Confirm src/__init__.py exists (can be empty)

Error: PermissionError when saving JSON

Check file/folder permissions
On Windows, ensure the data folder isn’t read-only

Data seems lost after restart

Verify DATA_FILE path in storage.py
Confirm you’re running from the project root so relative paths resolve correctly

Duplicate roll numbers slipping through

Re-check the duplicate guard in add_student:

  if any(s["roll"] == roll for s in students):
      print("❌ Roll number already exists.")
      return

Best practices

Keep functions small and single-purpose

Each CRUD operation should do one thing well. This makes debugging and testing easier.
Validate early, fail clearly

Use helpers like get_int and get_non_empty to avoid half-baked records.
Separate concerns

Storage, validation, and operations in different modules keeps the codebase readable and scalable.
Handle file errors gracefully

Wrap file I/O in try/except and provide clear messages instead of raw tracebacks.
Use meaningful names

roll, course, marks are clearer than id1, field2, val3.

Following these practices will make your code look professional—exactly what mentors and recruiters expect when you’re coming from a Python full stack course in Bangalore with placement.

Performance tips (for larger datasets)

This CLI uses a list of dicts, which is fine for hundreds or even a few thousand records. If you scale up:

Search optimization Maintain a roll -> student dict for O(1) lookup instead of scanning the list every time.

  students_by_roll = {s["roll"]: s for s in students}

Batch saves

Avoid saving after every tiny change if you’re doing bulk updates; save once at the end.
Consider SQLite

For thousands of records or multi-user scenarios, switch from JSON to SQLite (still pure Python, no server needed).

Common errors and how to avoid them

JSONDecodeError on load

Happens if students.json is manually edited and becomes invalid JSON.

Fix: Restore from backup or delete the file to start fresh (your code already handles this).
Unicode issues with names

Always open files with encoding="utf-8" and use ensure_ascii=False in json.dump.
Accidental data loss on exception

Don’t overwrite the file if serialization fails. Write to a temp file first, then replace.

Learning resources

Python docs: json, pathlib, csv modules
Project-based practice: build small CLI tools (todo list, expense tracker, contact book)
Next steps:
- Add a REST API with FastAPI or Flask
- Build a simple Tkinter GUI for the same logic
- Integrate SQLite for more robust storage

If you’re in Bengaluru and exploring structured learning, look for a Python full stack course in Bangalore with placement that emphasizes projects, Git, and deployment. Many programs highlight placement support and real-world builds similar to this.

Where to go from here

You now have a working, modular CLI app with:

Clean data handling
Input validation
Persistent storage
A structure you can grow

From here, you could:

Add authentication (simple PIN or username/password)
Build a web frontend (FastAPI + React) that reuses your operations
Package it as a CLI tool with click or typer
Add logging and basic analytics

This is the kind of end-to-end project that stands out when you’re targeting roles after a Python full stack course in Bangalore with placement. If you want, I can help you extend this into a FastAPI backend or a Tkinter desktop app in a follow-up tutorial.

# Build a Java Full-Stack Task Manager with Spring Boot, React, and PostgreSQL

Ascent Software Training Institute — Tue, 15 Sep 2026 08:04:23 +0000

If you are exploring a java full stack course in Bangalore with placement, building a complete application is one of the best ways to apply what you learn. In this hands-on tutorial, we will create a task manager using Spring Boot, React, and PostgreSQL.

You will build a working application that can:

Create tasks.
Display tasks.
Mark tasks as completed.
Delete tasks.
Validate user input.
Store data in PostgreSQL.
Connect a React frontend to a Java backend.

The project is small enough to complete in a weekend but includes concepts used in real Java full-stack development.

Project Architecture

The application will follow this structure:

React frontend
      |
      | HTTP requests
      v
Spring Boot REST API
      |
      | Spring Data JPA
      v
PostgreSQL database

The backend will use a layered architecture:

Controller
    |
Service
    |
Repository
    |
Database

Each layer has a separate responsibility:

The controller handles HTTP requests.
The service contains business logic.
The repository communicates with the database.
The entity represents database data.

The final project structure will look like this:

task-manager/
├── backend/
│   └── src/main/java/com/example/taskmanager/
│       ├── controller/
│       ├── exception/
│       ├── model/
│       ├── repository/
│       └── service/
└── frontend/
    ├── src/
    │   ├── App.jsx
    │   └── App.css
    └── package.json

Prerequisites

You should have basic knowledge of:

Java classes and methods.
JavaScript functions.
HTML and CSS.
SQL.
HTTP requests.

Install these tools:

JDK 17 or later.
Maven.
PostgreSQL.
Node.js and npm.
Git.
An IDE such as IntelliJ IDEA or VS Code.
Postman or curl.

We will use:

Java 17.
Spring Boot 3.x.
Spring Data JPA.
PostgreSQL.
React with Vite.
Maven.

Check whether the tools are installed:

java -version
mvn -version
node --version
npm --version
psql --version

If each command returns version information, your environment is ready.

Step 1: Create the PostgreSQL Database

Start PostgreSQL and open the PostgreSQL command-line client:

psql -U postgres

Create a database named task_manager:

CREATE DATABASE task_manager;

Exit the PostgreSQL shell:

\q

PostgreSQL requires the server to be running before you create or access a database. The CREATE DATABASE command is the standard way to create a new database.

You do not need to create the tasks table manually. Hibernate will create it when the Spring Boot application starts.

Step 2: Create the Spring Boot Project

Create a Spring Boot project with these dependencies:

Spring Web.
Spring Data JPA.
PostgreSQL Driver.
Validation.
Spring Boot DevTools.

You can create the project using an IDE or Spring Initializr.

Place the backend inside a directory named:

backend

The main application class should look like this:

package com.example.taskmanager;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class TaskManagerApplication {

    public static void main(String[] args) {
        SpringApplication.run(TaskManagerApplication.class, args);
    }
}

The @SpringBootApplication annotation enables component scanning, auto-configuration, and Spring Boot configuration.

Step 3: Configure the Database Connection

Open this file:

backend/src/main/resources/application.properties

Add the following configuration:

spring.datasource.url=jdbc:postgresql://localhost:5432/task_manager
spring.datasource.username=postgres
spring.datasource.password=your_password

spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=true
spring.jpa.properties.hibernate.format_sql=true

server.port=8080

Replace your_password with your local PostgreSQL password.

The important properties are:

spring.datasource.url tells Spring where PostgreSQL is running.
spring.datasource.username specifies the database user.
spring.datasource.password specifies the database password.
spring.jpa.hibernate.ddl-auto=update allows Hibernate to create or update tables during local development.
server.port=8080 runs the backend on port 8080.

For a production project, do not store credentials directly in the properties file. Use environment variables instead:

spring.datasource.url=${DB_URL}
spring.datasource.username=${DB_USERNAME}
spring.datasource.password=${DB_PASSWORD}

On Linux or macOS:

export DB_URL=jdbc:postgresql://localhost:5432/task_manager
export DB_USERNAME=postgres
export DB_PASSWORD=your_password

On Windows PowerShell:

$env:DB_URL="jdbc:postgresql://localhost:5432/task_manager"
$env:DB_USERNAME="postgres"
$env:DB_PASSWORD="your_password"

Step 4: Create the Task Entity

Create this file:

backend/src/main/java/com/example/taskmanager/model/Task.java

Add the following code:

package com.example.taskmanager.model;

import jakarta.persistence.*;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.Size;

@Entity
@Table(name = "tasks")
public class Task {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @NotBlank(message = "Title is required")
    @Size(max = 120, message = "Title cannot exceed 120 characters")
    @Column(nullable = false, length = 120)
    private String title;

    @Size(max = 500, message = "Description cannot exceed 500 characters")
    private String description;

    @Column(nullable = false)
    private boolean completed = false;

    public Task() {
    }

    public Task(String title, String description) {
        this.title = title;
        this.description = description;
        this.completed = false;
    }

    public Long getId() {
        return id;
    }

    public String getTitle() {
        return title;
    }

    public void setTitle(String title) {
        this.title = title;
    }

    public String getDescription() {
        return description;
    }

    public void setDescription(String description) {
        this.description = description;
    }

    public boolean isCompleted() {
        return completed;
    }

    public void setCompleted(boolean completed) {
        this.completed = completed;
    }
}

Understanding the Entity

The @Entity annotation tells JPA that this class represents a database table.

The @Table(name = "tasks") annotation sets the table name.

The @Id annotation marks the primary key.

The @GeneratedValue annotation allows the database to generate the ID automatically.

The validation annotations protect your API from invalid input:

@NotBlank

prevents an empty title.

@Size(max = 120)

prevents titles longer than 120 characters.

The completed field defaults to false, so every new task starts as incomplete.

Step 5: Create the Repository

Create:

backend/src/main/java/com/example/taskmanager/repository/TaskRepository.java

package com.example.taskmanager.repository;

import com.example.taskmanager.model.Task;
import org.springframework.data.jpa.repository.JpaRepository;

public interface TaskRepository extends JpaRepository<Task, Long> {
}

By extending JpaRepository, your repository automatically receives common database methods:

findAll()
findById(id)
save(task)
deleteById(id)
existsById(id)

You do not need to write SQL for these basic operations.

You can also create custom query methods. For example:

import java.util.List;

List<Task> findByCompleted(boolean completed);

Spring Data JPA can create the query based on the method name.

Step 6: Create the Service Layer

Create:

backend/src/main/java/com/example/taskmanager/service/TaskService.java

package com.example.taskmanager.service;

import com.example.taskmanager.model.Task;
import com.example.taskmanager.repository.TaskRepository;
import org.springframework.stereotype.Service;

import java.util.List;

@Service
public class TaskService {

    private final TaskRepository taskRepository;

    public TaskService(TaskRepository taskRepository) {
        this.taskRepository = taskRepository;
    }

    public List<Task> getAllTasks() {
        return taskRepository.findAll();
    }

    public Task getTaskById(Long id) {
        return taskRepository.findById(id)
                .orElseThrow(() ->
                        new RuntimeException("Task not found with id: " + id));
    }

    public Task createTask(Task task) {
        return taskRepository.save(task);
    }

    public Task updateTask(Long id, Task updatedTask) {
        Task existingTask = getTaskById(id);

        existingTask.setTitle(updatedTask.getTitle());
        existingTask.setDescription(updatedTask.getDescription());
        existingTask.setCompleted(updatedTask.isCompleted());

        return taskRepository.save(existingTask);
    }

    public Task toggleTask(Long id) {
        Task task = getTaskById(id);
        task.setCompleted(!task.isCompleted());

        return taskRepository.save(task);
    }

    public void deleteTask(Long id) {
        if (!taskRepository.existsById(id)) {
            throw new RuntimeException("Task not found with id: " + id);
        }

        taskRepository.deleteById(id);
    }
}

Why Use a Service Layer?

You could call the repository directly from the controller, but that approach becomes difficult to maintain.

The service layer is useful for:

Business rules.
Data validation.
Transactions.
Logging.
Permission checks.
Reusable application logic.
Unit testing.

For example, if you later decide that completed tasks cannot be deleted, that rule belongs in the service layer.

Step 7: Create the REST Controller

Create:

backend/src/main/java/com/example/taskmanager/controller/TaskController.java

package com.example.taskmanager.controller;

import com.example.taskmanager.model.Task;
import com.example.taskmanager.service.TaskService;
import jakarta.validation.Valid;
import org.springframework.http.HttpStatus;
import org.springframework.web.bind.annotation.*;

import java.util.List;

@RestController
@RequestMapping("/api/tasks")
@CrossOrigin(origins = "http://localhost:5173")
public class TaskController {

    private final TaskService taskService;

    public TaskController(TaskService taskService) {
        this.taskService = taskService;
    }

    @GetMapping
    public List<Task> getAllTasks() {
        return taskService.getAllTasks();
    }

    @GetMapping("/{id}")
    public Task getTaskById(@PathVariable Long id) {
        return taskService.getTaskById(id);
    }

    @PostMapping
    @ResponseStatus(HttpStatus.CREATED)
    public Task createTask(@Valid @RequestBody Task task) {
        return taskService.createTask(task);
    }

    @PutMapping("/{id}")
    public Task updateTask(
            @PathVariable Long id,
            @Valid @RequestBody Task task
    ) {
        return taskService.updateTask(id, task);
    }

    @PatchMapping("/{id}/toggle")
    public Task toggleTask(@PathVariable Long id) {
        return taskService.toggleTask(id);
    }

    @DeleteMapping("/{id}")
    @ResponseStatus(HttpStatus.NO_CONTENT)
    public void deleteTask(@PathVariable Long id) {
        taskService.deleteTask(id);
    }
}

The controller exposes these endpoints:

Method	Endpoint	Description
GET	`/api/tasks`	Get all tasks
GET	`/api/tasks/{id}`	Get one task
POST	`/api/tasks`	Create a task
PUT	`/api/tasks/{id}`	Update a task
PATCH	`/api/tasks/{id}/toggle`	Change completion status
DELETE	`/api/tasks/{id}`	Delete a task

The @CrossOrigin annotation allows the React application running on port 5173 to call the backend running on port 8080.

Step 8: Start and Test the Backend

Start the Spring Boot application from the backend directory:

./mvnw spring-boot:run

On Windows:

mvnw.cmd spring-boot:run

You can also start it with Maven:

mvn spring-boot:run

If the application starts successfully, you should see a message indicating that the server is running on port 8080.

Create a Task

Use curl to create a task:

curl -X POST http://localhost:8080/api/tasks \
  -H "Content-Type: application/json" \
  -d '{"title":"Learn Spring Boot","description":"Build a REST API"}'

Expected response:

{
  "id": 1,
  "title": "Learn Spring Boot",
  "description": "Build a REST API",
  "completed": false
}

Get All Tasks

curl http://localhost:8080/api/tasks

Get One Task

curl http://localhost:8080/api/tasks/1

Toggle Completion

curl -X PATCH http://localhost:8080/api/tasks/1/toggle

Delete a Task

curl -X DELETE http://localhost:8080/api/tasks/1

Test Validation

Send an empty title:

curl -X POST http://localhost:8080/api/tasks \
  -H "Content-Type: application/json" \
  -d '{"title":"","description":"Invalid task"}'

Spring will reject the request because the title is required.

Step 9: Improve Error Handling

Returning a generic RuntimeException is not ideal. A REST API should return meaningful status codes and messages.

Create this exception class:

backend/src/main/java/com/example/taskmanager/exception/TaskNotFoundException.java

package com.example.taskmanager.exception;

public class TaskNotFoundException extends RuntimeException {

    public TaskNotFoundException(Long id) {
        super("Task not found with id: " + id);
    }
}

Update the service imports:

import com.example.taskmanager.exception.TaskNotFoundException;

Change the getTaskById method:

public Task getTaskById(Long id) {
    return taskRepository.findById(id)
            .orElseThrow(() -> new TaskNotFoundException(id));
}

Update the deleteTask method:

public void deleteTask(Long id) {
    if (!taskRepository.existsById(id)) {
        throw new TaskNotFoundException(id);
    }

    taskRepository.deleteById(id);
}

Now create the global exception handler:

backend/src/main/java/com/example/taskmanager/exception/GlobalExceptionHandler.java

package com.example.taskmanager.exception;

import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.MethodArgumentNotValidException;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RestControllerAdvice;

import java.util.HashMap;
import java.util.Map;

@RestControllerAdvice
public class GlobalExceptionHandler {

    @ExceptionHandler(TaskNotFoundException.class)
    public ResponseEntity<Map<String, String>> handleTaskNotFound(
            TaskNotFoundException exception
    ) {
        Map<String, String> response = new HashMap<>();
        response.put("error", exception.getMessage());

        return ResponseEntity
                .status(HttpStatus.NOT_FOUND)
                .body(response);
    }

    @ExceptionHandler(MethodArgumentNotValidException.class)
    public ResponseEntity<Map<String, String>> handleValidation(
            MethodArgumentNotValidException exception
    ) {
        Map<String, String> errors = new HashMap<>();

        exception.getBindingResult()
                .getFieldErrors()
                .forEach(error ->
                        errors.put(
                                error.getField(),
                                error.getDefaultMessage()
                        )
                );

        return ResponseEntity
                .badRequest()
                .body(errors);
    }
}

Now, requesting a task that does not exist returns:

{
  "error": "Task not found with id: 99"
}

An invalid title returns:

{
  "title": "Title is required"
}

This makes the API easier for the frontend and other clients to understand.

Step 10: Create the React Frontend

From the project root, create a React application with Vite:

npm create vite@latest frontend -- --template react

Move into the frontend directory:

cd frontend

Install dependencies:

npm install

Start the development server:

npm run dev

The frontend normally runs at:

http://localhost:5173

Create the React Application

Replace the contents of src/App.jsx with:

import { useEffect, useState } from "react";
import "./App.css";

const API_URL = "http://localhost:8080/api/tasks";

function App() {
  const [tasks, setTasks] = useState([]);
  const [title, setTitle] = useState("");
  const [description, setDescription] = useState("");
  const [error, setError] = useState("");

  async function loadTasks() {
    try {
      const response = await fetch(API_URL);

      if (!response.ok) {
        throw new Error("Unable to load tasks");
      }

      const data = await response.json();
      setTasks(data);
    } catch (error) {
      setError(error.message);
    }
  }

  useEffect(() => {
    loadTasks();
  }, []);

  async function addTask(event) {
    event.preventDefault();
    setError("");

    if (!title.trim()) {
      setError("Title is required");
      return;
    }

    try {
      const response = await fetch(API_URL, {
        method: "POST",
        headers: {
          "Content-Type": "application/json",
        },
        body: JSON.stringify({
          title,
          description,
        }),
      });

      if (!response.ok) {
        throw new Error("Unable to create task");
      }

      const newTask = await response.json();

      setTasks((currentTasks) => [
        ...currentTasks,
        newTask,
      ]);

      setTitle("");
      setDescription("");
    } catch (error) {
      setError(error.message);
    }
  }

  async function toggleTask(id) {
    try {
      const response = await fetch(`${API_URL}/${id}/toggle`, {
        method: "PATCH",
      });

      if (!response.ok) {
        throw new Error("Unable to update task");
      }

      const updatedTask = await response.json();

      setTasks((currentTasks) =>
        currentTasks.map((task) =>
          task.id === updatedTask.id
            ? updatedTask
            : task
        )
      );
    } catch (error) {
      setError(error.message);
    }
  }

  async function deleteTask(id) {
    try {
      const response = await fetch(`${API_URL}/${id}`, {
        method: "DELETE",
      });

      if (!response.ok) {
        throw new Error("Unable to delete task");
      }

      setTasks((currentTasks) =>
        currentTasks.filter((task) => task.id !== id)
      );
    } catch (error) {
      setError(error.message);
    }
  }

  return (
    <main className="container">
      <h1>Task Manager</h1>

      <form onSubmit={addTask} className="task-form">
        <input
          value={title}
          onChange={(event) => setTitle(event.target.value)}
          placeholder="Task title"
          maxLength="120"
        />

        <textarea
          value={description}
          onChange={(event) => setDescription(event.target.value)}
          placeholder="Description"
          maxLength="500"
        />

        <button type="submit">Add task</button>
      </form>

      {error && <p className="error">{error}</p>}

      <section>
        {tasks.length === 0 ? (
          <p>No tasks yet.</p>
        ) : (
          tasks.map((task) => (
            <article key={task.id} className="task-card">
              <div>
                <h2 className={task.completed ? "completed" : ""}>
                  {task.title}
                </h2>

                <p>{task.description}</p>
              </div>

              <div className="actions">
                <button onClick={() => toggleTask(task.id)}>
                  {task.completed
                    ? "Mark pending"
                    : "Complete"}
                </button>

                <button onClick={() => deleteTask(task.id)}>
                  Delete
                </button>
              </div>
            </article>
          ))
        )}
      </section>
    </main>
  );
}

export default App;

The useState hook stores component data such as tasks and form values. The useEffect hook loads tasks when the component is rendered.

Add CSS

Replace src/App.css with:

body {
  margin: 0;
  font-family: Arial, sans-serif;
  background: #f4f6f8;
  color: #1f2937;
}

.container {
  width: min(760px, 92%);
  margin: 40px auto;
}

.task-form,
.task-card {
  background: white;
  padding: 20px;
  border-radius: 10px;
  margin-bottom: 16px;
  box-shadow: 0 2px 8px rgb(0 0 0 / 8%);
}

.task-form {
  display: grid;
  gap: 12px;
}

input,
textarea,
button {
  font: inherit;
  padding: 10px;
}

textarea {
  min-height: 90px;
  resize: vertical;
}

button {
  cursor: pointer;
  border: 0;
  border-radius: 6px;
  background: #2563eb;
  color: white;
}

.task-card {
  display: flex;
  justify-content: space-between;
  gap: 16px;
}

.completed {
  text-decoration: line-through;
  color: #6b7280;
}

.actions {
  display: flex;
  gap: 8px;
  align-items: center;
}

.error {
  color: #b91c1c;
}

Open the frontend in your browser:

http://localhost:5173

Try the following:

Add a task.
Refresh the page.
Mark the task as completed.
Refresh the page again.
Delete the task.

The data remains available after refreshing because it is stored in PostgreSQL rather than only in React state.

Step 11: Add the Project to Git

From the project root:

git init
git add .
git commit -m "Build task manager with Spring Boot and React"

Create a remote Git repository and connect it:

git branch -M main
git remote add origin your-repository-address
git push -u origin main

Before pushing, create a .gitignore file:

# Java
target/
*.class

# Node
node_modules/
dist/

# IDE
.idea/
.vscode/

# Environment files
.env
.env.*

Your README should contain:

Project description.
Features.
Technologies used.
Installation instructions.
Database setup.
API endpoints.
Screenshots.
Future improvements.

Useful startup commands:

# Start backend
cd backend
./mvnw spring-boot:run

# Start frontend
cd frontend
npm install
npm run dev

Never commit:

Database passwords.
API keys.
Private tokens.
Production environment files.
Personal credentials.

Practical Exercises

After completing the basic application, extend it with these exercises.

Exercise 1: Add Due Dates

Add a due date field to the entity:

private LocalDate dueDate;

Then add the required getter and setter.

Think about these questions:

Should the due date be optional?
Should past due dates be allowed?
How should the frontend display the date?
Should overdue tasks have a different color?

Exercise 2: Add Task Filtering

Add an endpoint that filters tasks by completion status:

GET /api/tasks?completed=true

Add this method to the repository:

List<Task> findByCompleted(boolean completed);

Then update the service and controller to use the query parameter.

Exercise 3: Add Pagination

Returning every task works for a small project, but it becomes inefficient as the number of tasks grows.

Update the repository:

Page<Task> findAll(Pageable pageable);

Then support requests such as:

GET /api/tasks?page=0&size=10

Pagination reduces response size and frontend rendering work.

Exercise 4: Add Task Categories

Add a category field such as:

Work
Personal
Learning
Shopping

Then allow users to filter by category.

Exercise 5: Add Authentication

Protect the task endpoints with Spring Security.

Start with basic authentication in a local environment. Later, learn how to use token-based authentication.

Never store passwords as plain text. Passwords should be securely hashed.

Exercise 6: Write Tests

Write tests for:

Creating a valid task.
Rejecting an empty title.
Fetching all tasks.
Fetching a task by ID.
Returning a not-found response.
Toggling completion.
Deleting a task.

Troubleshooting

PostgreSQL Connection Refused

Make sure PostgreSQL is running.

On Linux:

sudo systemctl status postgresql

Also check:

The database name is task_manager.
PostgreSQL is using port 5432.
The username is correct.
The password is correct.
The database server accepts local connections.

Password Authentication Failed

Test the database credentials directly:

psql -U postgres -h localhost -d task_manager

If this command fails, correct the PostgreSQL password or username before starting Spring Boot.

CORS Error

The React frontend runs on port 5173, while the backend runs on port 8080. The backend must allow requests from the frontend.

Check this annotation:

@CrossOrigin(origins = "http://localhost:5173")

If your frontend runs on a different port, update the origin.

For larger projects, configure CORS globally instead of adding the annotation to individual controllers.

404 Not Found

Check the request URL:

http://localhost:8080/api/tasks

Common mistakes include:

Sending the request to port 5173 instead of 8080.
Omitting /api.
Using /task instead of /tasks.
Forgetting to restart the application after changing a controller mapping.

React Shows an Empty List

Open the browser developer tools and inspect the Network tab.

Check that:

The backend is running.
The API returns JSON.
The frontend calls port 8080.
CORS allows port 5173.
The database contains task records.

You can test the backend independently:

curl http://localhost:8080/api/tasks

Hibernate Does Not Create the Table

Check the following:

The PostgreSQL driver dependency is present.
The database exists.
The entity has the @Entity annotation.
The database credentials are correct.
The application can connect to PostgreSQL.
spring.jpa.hibernate.ddl-auto=update is present for local development.

For production applications, use database migration tools instead of depending on automatic schema updates.

Port Already in Use

If port 8080 is already occupied, change the backend port:

server.port=8081

Then update the React API URL:

const API_URL = "http://localhost:8081/api/tasks";

If port 5173 is occupied, Vite may automatically select another port. Update the backend CORS configuration accordingly.

Best Practices

Keep Layers Separate

Do not place database logic inside the controller.

A clean structure looks like this:

Controller → Service → Repository

This makes the code easier to understand and test.

Validate Input on the Backend

Frontend validation improves the user experience, but it cannot be trusted as the only protection. Users can call your API directly using tools such as curl or Postman.

Always validate important input on the backend.

Use DTOs in Larger Applications

This tutorial uses the Task entity directly in the request body to keep the project simple.

In a larger application, create request and response DTOs:

public class CreateTaskRequest {
    private String title;
    private String description;
}

DTOs help prevent internal database fields from being exposed accidentally.

Use Pagination

Do not return thousands of records in a single response. Pagination improves:

Database performance.
Network performance.
Server memory usage.
Frontend rendering speed.

Use Database Indexes Carefully

If you frequently filter by completion status, an index may help:

CREATE INDEX idx_tasks_completed
ON tasks(completed);

Indexes can speed up reads but add storage and write overhead. Add them based on actual query patterns.

Avoid Sensitive Data in Git

Never commit this type of configuration:

spring.datasource.password=real-password

Use environment variables or a secrets manager for sensitive information.

Use Database Migrations

The following setting is convenient during development:

spring.jpa.hibernate.ddl-auto=update

For production, consider a migration tool such as Flyway or Liquibase. Migrations make database changes explicit, reviewable, and repeatable.

Test Before Optimizing

Do not optimize based only on assumptions. Measure:

API response time.
Database query time.
Frontend rendering time.
Network payload size.

Then improve the actual bottleneck.

Performance Improvements

The first version of this project is suitable for learning, but you can improve its performance in several ways.

Reduce Unnecessary API Calls

After creating a task, the frontend adds the returned task directly to state:

setTasks((currentTasks) => [
  ...currentTasks,
  newTask,
]);

This avoids fetching the entire task list again.

Use Database-Level Filtering

Do not fetch every task and filter them in Java if the database can perform the filtering:

List<Task> findByCompleted(boolean completed);

The database can process filtering more efficiently, especially as the table grows.

Add Pagination

Pagination prevents the server and browser from processing unnecessary records.

Disable SQL Logging in Production

This setting is useful while learning:

spring.jpa.show-sql=true

However, SQL logging can generate a large amount of output. Disable it in production unless you are actively debugging.

Use Connection Pooling

Spring Boot applications commonly use a database connection pool. For larger applications, tune pool settings based on traffic and database capacity rather than choosing large values blindly.

Learning Path

If you are building skills through a Java full-stack course in Bangalore with placement, use this project as a practical assignment rather than only reading the theory.

A useful learning path is:

Learn Java classes, interfaces, collections, and exception handling.
Practice SQL queries and relational database design.
Understand HTTP methods, status codes, JSON, and REST.
Learn Spring Boot dependency injection and configuration.
Build REST APIs with Spring Web.
Connect applications to databases using Spring Data JPA.
Learn React components, state, forms, and effects.
Use Git for version control.
Write unit and integration tests.
Add authentication with Spring Security.
Containerize the application with Docker.
Deploy the frontend, backend, and database separately.

Final Thoughts

This task manager gives you a complete Java full-stack project with a Spring Boot backend, React frontend, and PostgreSQL database.

You practiced:

Designing REST endpoints.
Creating a JPA entity.
Connecting Spring Boot to PostgreSQL.
Separating controller, service, and repository logic.
Validating API input.
Handling errors.
Calling APIs from React.
Managing frontend state.
Testing endpoints with curl.
Using Git to manage source code.

Do not stop after making the application work once. Add due dates, filtering, pagination, authentication, tests, Docker support, and deployment. Each improvement will help you understand how real full-stack applications are designed and maintained.

OWASP Top 10 Explained: A Hands-On Guide for Developers

Ascent Software Training Institute — Tue, 08 Sep 2026 10:28:25 +0000

If you've ever shipped a feature only to get a security ticket two weeks later about IDOR or SQL injection, you're not alone. Most OWASP Top 10 issues aren't exotic zero-days—they're the same mistakes developers have been making for years, just in new frameworks.

This tutorial walks through each of the ten risks in the OWASP Top 10:2025 edition with code examples, GitHub references, and practical exercises you can try today. No fluff, no marketing—just the stuff you need to write safer code.

What Is the OWASP Top 10?

The OWASP Top 10 is a standard awareness document that ranks the ten most critical security risks to web applications. It's published by the Open Worldwide Application Security Project (OWASP), a nonprofit foundation, and is rebuilt roughly every three to four years from data on hundreds of thousands of real applications.

Each entry is a category, not a single bug. "Injection" covers SQL injection, XSS, command injection, and more—all grouped because they share a root cause: untrusted input reaching an interpreter. That grouping is what makes the list useful. You don't memorize ten thousand bugs; you understand ten patterns and recognize their variations.

The 2025 edition is the most current version. It adds two new categories (Software Supply Chain Failures and Mishandling of Exceptional Conditions), folds SSRF into Broken Access Control, and moves Security Misconfiguration up to number two.

A01: Broken Access Control

Broken access control is when an application fails to enforce what a user is allowed to do, letting them read or change data that should be off limits. It's been #1 since 2021 and stayed there in 2025.

The Classic IDOR

The textbook example is an Insecure Direct Object Reference (IDOR). You view your invoice at /invoice?id=1043, change the number to 1044, and the app hands you someone else's invoice because it checked you were logged in but never checked the record belonged to you.

Vulnerable code (Node.js/Express):

// ❌ Vulnerable — no ownership check
app.get('/api/orders/:id', authenticate, async (req, res) => {
  const order = await Order.findById(req.params.id);
  res.json(order);
});

Fixed code:

// ✅ Fixed — verify the order belongs to the requesting user
app.get('/api/orders/:id', authenticate, async (req, res) => {
  const order = await Order.findOne({
    _id: req.params.id,
    userId: req.user.id // ownership enforced at query level
  });
  if (!order) return res.status(404).json({ error: 'Not found' });
  res.json(order);
});

The gotcha junior devs miss: denying access in the UI doesn't count. If you hide a "delete" button but the DELETE /api/users/123 endpoint has no server-side role check, any authenticated user with curl can hit it.

SSRF Is Now Part of A01

In 2025, Server-Side Request Forgery (SSRF) moved into Broken Access Control as a sub-case. SSRF tricks your server into making requests to internal services (like AWS metadata at http://169.254.169.254/latest/meta-data/) that should never be reachable from the outside.

Vulnerable code:

// ❌ Vulnerable — fetches any user-supplied URL
app.post('/webhook', async (req, res) => {
  const response = await fetch(req.body.webhookUrl);
  res.json(await response.json());
});

Fixed code:

const { URL } = require('url');

function isSafeUrl(input) {
  try {
    const url = new URL(input);
    const blocked = ['169.254.169.254', 'localhost', '127.0.0.1', '0.0.0.0'];
    if (blocked.some(h => url.hostname.includes(h))) return false;
    if (!['http:', 'https:'].includes(url.protocol)) return false;
    return true;
  } catch {
    return false;
  }
}

// ✅ Validate before fetching any user-supplied URL
app.post('/webhook', async (req, res) => {
  if (!isSafeUrl(req.body.webhookUrl)) {
    return res.status(400).json({ error: 'Invalid URL' });
  }
  const response = await fetch(req.body.webhookUrl);
  res.json(await response.json());
});

The non-obvious gotcha: blocking 127.0.0.1 is not enough. Attackers use decimal IP notation (http://2130706433/ is 127.0.0.1), IPv6 loopback (::1), and DNS rebinding to bypass naive blocklists. Validate after DNS resolution, not before.

GitHub Examples

OWASP Top 10:2025 Checklist — 249 CWEs with descriptions, examples, and prevention guidance.
Agent Skills Security Checklist — Prevention tips for each Top 10 category.

Practical Exercise

Set up a local app with two roles (user/admin). Create an endpoint that returns data based on an ID parameter. Try accessing another user's data by changing the ID. Then add server-side ownership checks and verify the attack no longer works.

Troubleshooting

Problem: "I added auth middleware but still getting unauthorized access."
Fix: Auth middleware only checks if the user is logged in. You need explicit ownership or role checks in each route handler.

Best Practices

Enforce ownership at the query level, not just in application logic.
Deny by default; explicitly grant access based on roles.
Test every route handler with different user roles.

Performance Tips

Cache ownership checks where possible (e.g., user roles in JWT claims).
Use database-level constraints (e.g., WHERE owner_id = ?) to prevent accidental leaks.

Common Errors

Hiding UI elements without server-side checks.
Assuming authentication equals authorization.
Forgetting to check ownership on PUT, PATCH, and DELETE endpoints.

A02: Security Misconfiguration

Security misconfiguration is a system left in an insecure state through defaults, oversights, or unnecessary features rather than a coding bug. It climbed from fifth in 2021 to second in 2025.

Real-World Examples

Default credentials left on an admin console (e.g., admin/admin).
Cloud storage buckets set to public.
Directory listing enabled on web servers.
Verbose error pages that leak stack traces.
Exposed .git folders handing attackers your whole source tree.

The 2019 Capital One breach was misconfiguration—an SSRF vulnerability combined with an overly permissive IAM role. The root issue wasn't the SSRF; it was that the role had permissions it never needed.

Concrete Actions

Set NODE_ENV=production—many frameworks disable security features in development mode.
Never return raw stack traces to clients.
Use CSP headers (try the CSP Generator to build them).
Audit IAM roles with least-privilege in mind.

GitHub Examples

OWASP Security Misconfiguration Guide — Official examples and checklists.

Practical Exercise

Spin up a default installation of a web app (e.g., WordPress, Jenkins). Find the default admin credentials (often admin/admin). Change them and disable directory listing.

Troubleshooting

Problem: "My app is leaking stack traces in production."
Fix: Set your framework to production mode and configure custom error pages that don't expose internals.

Best Practices

Harden default configurations before deployment.
Remove unused features, endpoints, and documentation.
Regularly audit cloud IAM policies.

Performance Tips

Use automated configuration scanners (e.g., Nuclei) in CI/CD.
Document secure baselines for each environment.

Common Errors

Leaving debug endpoints enabled in production.
Using default passwords on admin panels.
Exposing .env files or .git directories.

A03: Software Supply Chain Failures

Software supply chain failures cover risks introduced by the components, dependencies, and build pipelines your application relies on rather than code your team wrote. In 2025, OWASP broadened the old "Vulnerable and Outdated Components" category into the full supply chain.

Real-World Examples

A dependency with a known CVE that you never patched. Log4Shell (CVE-2021-44228) took down organizations worldwide because a logging library had an unauthenticated RCE.
A maintainer account gets phished and a malicious version of a popular npm package ships to everyone who runs an update.

Your code can be perfect and you still get owned through a package you never read.

Prevention

Run these in your CI pipeline and fail the build on high-severity findings:

# Node.js
npm audit

# Python
pip-audit

# OWASP Dependency-Check (multi-language)
dependency-check -p my-app -s ./lib

GitHub Examples

OWASP Dependency-Check — Automated SCA tool.
OWASP Top 10:2025 Checklist — Includes supply chain testing guidance.

Practical Exercise

Add npm audit or pip-audit to your CI pipeline. Set it to fail on high-severity findings. Run it on an existing project and fix at least one vulnerable dependency.

Troubleshooting

Problem: "My CI pipeline is failing because of a transitive dependency."
Fix: Use npm ls <package> or pip show <package> to find the parent dependency. Update or replace the parent.

Best Practices

Pin dependency versions (e.g., express@4.18.2, not ^4.18.2).
Use lockfiles (package-lock.json, Pipfile.lock).
Verify package signatures where possible.

Performance Tips

Cache dependency scans to speed up CI.
Use tools like Renovate or Dependabot for automated updates.

Common Errors

Ignoring npm audit warnings.
Using latest tags in production.
Not auditing transitive dependencies.

A04: Cryptographic Failures

Cryptographic failures happen when sensitive data is not protected properly, whether through weak algorithms, missing encryption, or bad key handling. It sat at second in 2021 and moved to fourth in 2025.

Real-World Examples

Storing passwords with MD5 or SHA-1. An application that stores passwords as unsalted MD5 hashes has effectively stored them in plaintext.
Encrypting data with AES-ECB mode (reveals patterns in identical plaintext blocks).
Using a static IV with AES-CBC.
Transmitting data over plain HTTP.
Hardcoding encryption keys in source code.

Prevention

Vulnerable code:

const crypto = require('crypto');

// ❌ Vulnerable — MD5 is not a password hash
const hash = crypto.createHash('md5').update(password).digest('hex');

Fixed code:

const bcrypt = require('bcrypt');

// ✅ Fixed — bcrypt with a cost factor of 12+
const hash = await bcrypt.hash(password, 12);
const valid = await bcrypt.compare(inputPassword, hash);

GitHub Examples

OWASP Cryptographic Failures Guide — Official examples.

Practical Exercise

Find a login form in your app. Check how passwords are hashed. If it's MD5, SHA-1, or unsalted SHA-256, migrate to bcrypt or Argon2.

Troubleshooting

Problem: "My bcrypt hashes are too slow."
Fix: Adjust the cost factor. Start at 10 for development, 12+ for production. Test login latency.

Best Practices

Use bcrypt, Argon2, or scrypt for passwords.
Always use HTTPS in production.
Rotate encryption keys periodically.

Performance Tips

Cache bcrypt hashes where possible (e.g., session tokens).
Use hardware security modules (HSMs) for key storage in high-security environments.

Common Errors

Using MD5 or SHA-1 for passwords.
Storing encryption keys in code or .env files.
Using ECB mode for encryption.

A05: Injection

Injection is when untrusted input is interpreted as a command or query, letting an attacker change what the application does. It includes SQL injection, XSS, command injection, LDAP injection, and NoSQL injection. It dropped from third in 2021 to fifth in 2025 as frameworks made the common cases harder, but it has not gone away.

SQL Injection

Vulnerable code:

// ❌ Vulnerable SQL injection
const query = `SELECT * FROM users WHERE email = '${req.body.email}'`;

Fixed code:

// ✅ Fixed — parameterized query
const result = await db.query(
  'SELECT * FROM users WHERE email = $1',
  [req.body.email]
);

NoSQL Injection (MongoDB)

Vulnerable code:

// ❌ Vulnerable NoSQL injection
User.findOne({ username: req.body.username, password: req.body.password });
// Attacker sends: { "password": { "$gt": "" } }

Fixed code:

// ✅ Fixed — validate input type before querying
if (typeof req.body.password !== 'string') return res.status(400).end();
User.findOne({ username: req.body.username, password: req.body.password });

XSS (Cross-Site Scripting)

Vulnerable code (React):

// ❌ Vulnerable — dangerouslySetInnerHTML
<div dangerouslySetInnerHTML={{ __html: userComment }} />

Fixed code:

// ✅ Fixed — let React escape by default
<div>{userComment}</div>

GitHub Examples

OWASP Injection Guide — Official examples.
SQLMap — Automated SQL injection tool.

Practical Exercise

Set up a login form vulnerable to SQL injection. Use the payload ' OR '1'='1 to bypass authentication. Then extract all user data using UNION-based injection.

Troubleshooting

Problem: "My parameterized query is still vulnerable."
Fix: Ensure you're not concatenating user input anywhere in the query string. Use placeholders ($1, ?) exclusively.

Best Practices

Use parameterized queries or ORM methods.
Validate and sanitize all input.
Use frameworks with built-in XSS protection (e.g., React, Vue).

Performance Tips

Use prepared statements for repeated queries.
Cache validated input schemas.

Common Errors

Concatenating user input into SQL queries.
Using dangerouslySetInnerHTML in React without sanitization.
Trusting NoSQL query objects from user input.

A06: Insecure Design

Insecure design is a flaw in the intended logic of an application rather than a mistake in its implementation. You can't patch it with a security header because the problem is the plan itself. It held at fourth in 2021 and sits at sixth in 2025.

Real-World Examples

A password reset flow that sends a six-digit code but never limits how many guesses you get.
A checkout that lets you apply the same single-use discount a thousand times.
A transfer that accepts a negative amount and moves money the wrong way.

Prevention

The fix is threat modeling before you write a line of code. For every new feature, ask: what's the worst thing an attacker can do with this? STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) is a useful checklist.

GitHub Examples

OWASP Insecure Design Guide — Official examples.
Threat Modeling Templates — OWASP templates for STRIDE.

Practical Exercise

Design a password reset flow. Add rate limiting (e.g., max 5 attempts per hour). Test by trying to brute-force the code.

Troubleshooting

Problem: "My feature works but can be abused."
Fix: Add business logic constraints (e.g., rate limits, one-time tokens, negative value checks).

Best Practices

Threat model every new feature.
Use the STRIDE framework.
Test for business logic abuse, not just technical bugs.

Performance Tips

Use in-memory rate limiters (e.g., Redis) for high-traffic apps.
Cache threat model decisions for similar features.

Common Errors

Skipping threat modeling for "simple" features.
Assuming users will only use features as intended.
Not testing edge cases (e.g., negative amounts, zero values).

A07: Authentication Failures

Authentication failures are weaknesses in how an application confirms who a user is and keeps them logged in. OWASP shortened the 2021 name "Identification and Authentication Failures" to just "Authentication Failures" in 2025, but the substance is the same. It stayed at seventh.

Real-World Examples

Weak session tokens that never expire.
Missing rate limits on login endpoints.
Accepting JWTs signed with alg: none.

The JWT alg: none attack is a real bypass—some libraries in 2015–2018 would accept an unsigned token if the header specified "alg": "none".

Prevention

Vulnerable code:

const jwt = require('jsonwebtoken');

// ❌ Vulnerable — trusts the algorithm from the token
const decoded = jwt.decode(token); // doesn't verify signature

Fixed code:

// ✅ Fixed — specify algorithm explicitly
const decoded = jwt.verify(token, process.env.JWT_SECRET, {
  algorithms: ['HS256'] // reject anything else, including 'none'
});

GitHub Examples

OWASP Authentication Failures Guide — Official examples.

Practical Exercise

Create a login endpoint. Try brute-forcing it with 100 requests. Add rate limiting (e.g., max 5 attempts per minute per IP).

Troubleshooting

Problem: "My JWT library accepts alg: none tokens."
Fix: Explicitly specify allowed algorithms in jwt.verify(). Never trust the algorithm from the token header.

Best Practices

Use strong session tokens (e.g., 256-bit random values).
Set session expiration times.
Rate limit login endpoints.

Performance Tips

Use Redis for distributed rate limiting.
Cache JWT verification results for short-lived tokens.

Common Errors

Accepting alg: none in JWTs.
Not expiring session tokens.
Missing rate limits on authentication endpoints.

A08: Software or Data Integrity Failures

Software or data integrity failures occur when an application trusts code or data without verifying it has not been tampered with. The 2025 name swaps "and" for "or" but keeps the meaning from 2021. It stayed at eighth.

Real-World Examples

Insecure deserialization (e.g., Python pickle, PHP unserialize(), Java ObjectInputStream).
Auto-update mechanisms that fetch code over an unverified channel.
CI/CD pipelines that deploy artifacts without checking a signature.

The SolarWinds attack is the textbook example—malicious code injected into a trusted build pipeline that then got signed and distributed to thousands of customers.

Prevention

Never deserialize untrusted data using Java's native ObjectInputStream, Python's pickle, or PHP's unserialize() without strict type checking. Use JSON with schema validation instead.

GitHub Examples

OWASP Integrity Failures Guide — Official examples.

Practical Exercise

Create a Python endpoint that accepts a pickle-serialized object. Try sending a malicious payload that executes os.system('whoami'). Then switch to JSON with schema validation.

Troubleshooting

Problem: "My app deserializes user input and crashes."
Fix: Switch to JSON. If you must deserialize, use strict type checking and allowlists.

Best Practices

Use JSON with schema validation (e.g., Joi, Pydantic).
Sign and verify CI/CD artifacts.
Use HTTPS for all update mechanisms.

Performance Tips

Cache validated JSON schemas.
Use binary serialization (e.g., Protocol Buffers) for high-performance needs.

Common Errors

Deserializing untrusted data with pickle or unserialize().
Not verifying CI/CD artifact signatures.
Fetching updates over HTTP.

A09: Security Logging and Alerting Failures

Security logging and alerting failures mean an application does not record security-relevant events or does not raise an alarm when something goes wrong, so attacks go unnoticed. OWASP renamed the 2021 "Monitoring" to "Alerting" in 2025 to stress that collecting logs is useless if nobody is watching them. It stayed at ninth.

Real-World Examples

Not logging failed logins.
Not logging access control decisions.
Logging sensitive data (e.g., passwords, tokens, PII).

The average time to detect a breach is still measured in months. That's almost always a logging failure.

What to Log

Authentication events (success and failure).
Access control decisions.
Input validation failures.
Privilege escalation attempts.

What NOT to Log

Passwords.
Full credit card numbers.
Session tokens.
PII in URLs (e.g., /reset?token=abc123 leaks the reset token).

GitHub Examples

OWASP Logging Guide — Official examples.

Practical Exercise

Add logging to your login endpoint. Log success and failure (but not passwords). Set up an alert for more than 5 failed logins per minute from the same IP.

Troubleshooting

Problem: "My logs are full of sensitive data."
Fix: Use structured logging with field redaction (e.g., Winston with custom formatters).

Best Practices

Log all security-relevant events.
Redact sensitive fields before logging.
Set up alerts for anomalous patterns.

Performance Tips

Use asynchronous logging to avoid blocking requests.
Sample high-volume logs (e.g., log 1 in 100 successful logins).

Common Errors

Logging passwords or tokens.
Not logging failed authentication attempts.
Not setting up alerts for security events.

A10: Mishandling of Exceptional Conditions

Mishandling of exceptional conditions is a brand new 2025 category covering what happens when an application meets an error or an unexpected state and handles it insecurely. It replaces SSRF in the tenth slot, since SSRF moved up into Broken Access Control.

Real-World Examples

Fail-open logic: an authorization check throws an exception when a service is unreachable, and the surrounding code treats the exception as "allow" instead of "deny".
Verbose error responses that leak stack traces with database credentials.
Unhandled exceptions that leave the application in a half-processed, exploitable state.

Prevention

Always fail closed on errors. If an authorization check fails or throws an exception, deny access by default.

Vulnerable code:

try {
  const allowed = await checkPermission(userId, resourceId);
  if (allowed) return res.json(data);
} catch (err) {
  // ❌ Vulnerable — fail-open on error
  return res.json(data);
}

Fixed code:

try {
  const allowed = await checkPermission(userId, resourceId);
  if (allowed) return res.json(data);
} catch (err) {
  // ✅ Fixed — fail-closed on error
  return res.status(500).json({ error: 'Service unavailable' });
}

GitHub Examples

OWASP Exceptional Conditions Guide — Official examples.

Practical Exercise

Create an endpoint that depends on an external service. Simulate the service being down. Verify your app denies access instead of failing open.

Troubleshooting

Problem: "My app allows access when a service is down."
Fix: Wrap authorization checks in try-catch blocks and deny access on errors.

Best Practices

Fail closed on all errors.
Use custom error pages that don't leak internals.
Log exceptions for debugging.

Performance Tips

Use circuit breakers for external services.
Cache authorization decisions where possible.

Common Errors

Failing open on authorization errors.
Leaking stack traces in error responses.
Not handling edge cases (e.g., null values, empty arrays).

Learning Resources

Official OWASP Resources

OWASP Top 10:2025 — Official documentation.
OWASP Web Security Testing Guide — Detailed testing methodology.
OWASP Application Security Verification Standard (ASVS) — Verification checklist.

Hands-On Labs

HackerDNA Web Attacks Course — Browser-based OWASP Top 10 labs.
DVWA (Damn Vulnerable Web App) — Local vulnerable app for practice.
PortSwigger Web Security Academy — Free XSS, SQLi, and more labs.

GitHub Repositories

OWASP Top 10:2025 Checklist — 249 CWEs with examples.
Agent Skills Security Checklist — Prevention tips.
Claude Code OWASP Skill — OWASP Top 10:2025, ASVS 5.0, and language-specific quirks.

Books and Courses

The Web Application Hacker's Handbook — Classic reference.
OWASP Testing Guide — Free online.
Cyber security course in Bangalore BTM layout — Local training options for hands-on learning.

Final Thoughts

Pick one item from this list right now and check your current project against it. Broken Access Control is the highest-value target—search your codebase for every route handler and verify each one has an explicit ownership or role check, not just an authentication middleware. That single audit will surface more real vulnerabilities than any automated scanner you run this week.

The OWASP Top 10 is the map, not the territory. Memorizing the ten names gets you through a quiz; recognizing broken access control in a live application when the only clue is a number that increments takes practice. Every risk on this list is a pattern you learn to see by exploiting it, failing, and trying again until the shape of the flaw is obvious.

Start with one lab, one endpoint, one fix. Then move to the next. That's how you build secure software—one commit at a time.

If you found this useful, share it with your team. Better yet, run through one of the practical exercises together in your next security review. Happy coding, and stay secure. 🛡️

Java Collections Framework Explained

Ascent Software Training Institute — Mon, 07 Sep 2026 07:22:18 +0000

Java Collections Framework Explained: A Hands-On Dev.to Tutorial

If you’ve ever wondered why your Java code slows down as data grows, the culprit is often the wrong collection choice. This tutorial walks you through the Java Collections Framework (JCF) with practical examples, performance tips, and exercises you can run today.

Whether you’re preparing for a java full stack course in bangalore or leveling up your backend skills, mastering collections is non-negotiable. Let’s dive in.

What Is the Java Collections Framework?

The Java Collections Framework is a unified architecture for representing and manipulating collections of objects. It provides:

Interfaces (e.g., List, Set, Map)
Implementations (e.g., ArrayList, HashSet, HashMap)
Algorithms (e.g., sorting, searching via Collections utility)
Concurrency utilities (e.g., ConcurrentHashMap, CopyOnWriteArrayList)

Think of it as Java’s built-in toolbox for data structures.

Core Interfaces and When to Use Them

1. `List` – Ordered, Indexable Collections

Use when you need:

Ordered elements
Random access by index
Allow duplicates

Common implementations:

ArrayList – Fast reads, cheap appends
LinkedList – Rarely needed; poor cache locality
Vector – Legacy; avoid in new code

List<String> names = new ArrayList<>();
names.add("Alice");
names.add("Bob");
System.out.println(names.get(0)); // Alice

Tip: Pre-size if you know the approximate count:

List<String> names = new ArrayList<>(1000);

This avoids repeated internal resizing.

2. `Set` – Unique Elements

Use when you need:

No duplicates
Fast membership checks

Common implementations:

HashSet – O(1) lookup, no order
LinkedHashSet – Insertion order preserved
TreeSet – Sorted elements (O(log n))

Set<Integer> ids = new HashSet<>();
ids.add(1);
ids.add(1); // ignored
System.out.println(ids.size()); // 1

Caution: TreeSet doesn’t allow null.

3. `Map` – Key-Value Pairs

Use when you need:

Fast lookup by key
Associative arrays

Common implementations:

HashMap – O(1) lookup, no order
LinkedHashMap – Insertion order
TreeMap – Sorted keys
ConcurrentHashMap – Thread-safe, high concurrency

Map<String, Integer> scores = new HashMap<>();
scores.put("Alice", 95);
System.out.println(scores.get("Alice")); // 95

Pro tip: Tune HashMap with initial capacity and load factor:

Map<String, Integer> scores = new HashMap<>(1024, 0.75f);

Default load factor is 0.75. Lower = more memory, fewer collisions.

4. `Queue` / `Deque` – FIFO, LIFO, Priority

Use when you need:

Task scheduling
BFS/DFS traversals
Producer-consumer patterns

Common implementations:

ArrayDeque – Faster than LinkedList for stacks/queues
PriorityQueue – Priority-based processing
ConcurrentLinkedQueue – Thread-safe queues

Queue<String> queue = new ArrayDeque<>();
queue.offer("Task1");
queue.offer("Task2");
System.out.println(queue.poll()); // Task1

Avoid: LinkedList for queues unless you truly need node-level manipulation.

Practical Exercise 1: Build a Student Registry

Let’s create a small project to manage students in a training program.

GitHub repo structure:

student-registry/
├── src/
│   └── main/
│       └── java/
│           └── com/
│               └── example/
│                   └── StudentRegistry.java
├── pom.xml
└── README.md

StudentRegistry.java:

package com.example;

import java.util.*;

public class StudentRegistry {
    private List<String> students = new ArrayList<>();
    private Set<String> uniqueIds = new HashSet<>();
    private Map<String, Integer> scores = new HashMap<>();

    public void addStudent(String id, String name, int score) {
        if (!uniqueIds.add(id)) {
            throw new IllegalArgumentException("Duplicate ID: " + id);
        }
        students.add(name);
        scores.put(id, score);
    }

    public List<String> getStudents() {
        return new ArrayList<>(students); // defensive copy
    }

    public Integer getScore(String id) {
        return scores.get(id);
    }

    public static void main(String[] args) {
        StudentRegistry registry = new StudentRegistry();
        registry.addStudent("S001", "Alice", 92);
        registry.addStudent("S002", "Bob", 88);

        System.out.println(registry.getStudents()); // [Alice, Bob]
        System.out.println(registry.getScore("S001")); // 92
    }
}

Try this:

Add a method to remove a student by ID
Use TreeMap to keep scores sorted
Add validation for score range (0–100)

Performance Tips That Matter

1. Choose the Right Collection

Use Case	Best Choice	Why
Fast random access	`ArrayList`	O(1) get/set
Frequent head/tail ops	`ArrayDeque`	Better cache locality
Unique elements	`HashSet`	O(1) contains
Sorted keys	`TreeMap`	O(log n) range queries
Thread-safe map	`ConcurrentHashMap`	No full locking
Read-heavy concurrent list	`CopyOnWriteArrayList`	Snapshot iteration

2. Pre-Size Collections

Avoid repeated resizing:

// Bad
List<String> list = new ArrayList<>();
for (int i = 0; i < 10000; i++) list.add("x");

// Good
List<String> list = new ArrayList<>(10000);

Same for HashMap:

Map<String, Integer> map = new HashMap<>(1024);

3. Avoid `LinkedList` Unless Necessary

LinkedList has:

Poor cache locality
Higher memory overhead
Slower iteration

Use ArrayList or ArrayDeque instead.

4. Use Immutable Collections for Static Data

List<String> days = List.of("Mon", "Tue", "Wed");
Map<String, Integer> scores = Map.of("Alice", 95, "Bob", 88);

Benefits:

Thread-safe by design
No accidental mutations
Clear intent

5. Tune `HashMap` Load Factor

Default load factor = 0.75.

Higher (e.g., 0.9) → less memory, more collisions
Lower (e.g., 0.5) → more memory, fewer collisions

Tune based on your use case.

6. Avoid Boxing Overhead

// Bad for performance
List<Integer> numbers = new ArrayList<>();
for (int i = 0; i < 1000000; i++) numbers.add(i);

// Better for tight loops
int[] numbers = new int[1000000];
for (int i = 0; i < numbers.length; i++) numbers[i] = i;

Boxing adds memory and CPU overhead.

7. Use Streams Carefully

Streams are great for readability but avoid in tight loops:

// Fine for complex transformations
list.stream()
    .filter(x -> x > 10)
    .map(x -> x * 2)
    .collect(Collectors.toList());

// Avoid in high-frequency paths
for (int i = 0; i < list.size(); i++) {
    // traditional loop is faster
}

Common Errors and How to Fix Them

1. `ConcurrentModificationException`

Cause: Modifying a collection while iterating.

// Bad
for (String s : list) {
    if (s.equals("remove")) list.remove(s); // throws!
}

// Good
list.removeIf(s -> s.equals("remove"));

Or use an iterator:

Iterator<String> it = list.iterator();
while (it.hasNext()) {
    if (it.next().equals("remove")) it.remove();
}

2. `NullPointerException` with `TreeSet`/`TreeMap`

Cause: These don’t allow null keys.

Set<String> set = new TreeSet<>();
set.add(null); // throws!

Fix: Use HashSet if you need null support.

3. Raw Types and `ClassCastException`

Cause: Using collections without generics.

// Bad
List names = new ArrayList();
names.add("Alice");
Integer x = (Integer) names.get(0); // ClassCastException

// Good
List<String> names = new ArrayList<>();
names.add("Alice");

Always parameterize your collections.

4. Thread Safety Issues

Cause: Using non-thread-safe collections in concurrent code.

// Bad in multi-threaded context
List<String> list = new ArrayList<>();

// Good
List<String> list = Collections.synchronizedList(new ArrayList<>());
// Or better
List<String> list = new CopyOnWriteArrayList<>();

For maps, prefer ConcurrentHashMap.

Practical Exercise 2: Thread-Safe Cache

Build a simple cache with ConcurrentHashMap.

Cache.java:

package com.example;

import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ConcurrentMap;
import java.util.concurrent.TimeUnit;

public class Cache<K, V> {
    private final ConcurrentMap<K, CacheEntry<V>> map = new ConcurrentHashMap<>();
    private final long ttlMillis;

    public Cache(long ttlMillis) {
        this.ttlMillis = ttlMillis;
    }

    public void put(K key, V value) {
        map.put(key, new CacheEntry<>(value, System.currentTimeMillis()));
    }

    public V get(K key) {
        CacheEntry<V> entry = map.get(key);
        if (entry == null) return null;
        if (System.currentTimeMillis() - entry.timestamp > ttlMillis) {
            map.remove(key);
            return null;
        }
        return entry.value;
    }

    private static class CacheEntry<V> {
        final V value;
        final long timestamp;
        CacheEntry(V value, long timestamp) {
            this.value = value;
            this.timestamp = timestamp;
        }
    }

    public static void main(String[] args) throws InterruptedException {
        Cache<String, String> cache = new Cache<>(1000);
        cache.put("key1", "value1");
        System.out.println(cache.get("key1")); // value1
        TimeUnit.SECONDS.sleep(2);
        System.out.println(cache.get("key1")); // null (expired)
    }
}

Try this:

Add a remove method
Add stats (hits, misses)
Use computeIfAbsent for atomic loads

Best Practices Checklist

✅ Program to interfaces: List<String> list = new ArrayList<>();
✅ Pre-size collections when count is known
✅ Prefer immutability: List.of(), Map.of()
✅ Use concurrent collections for thread safety
✅ Avoid LinkedList unless truly needed
✅ Tune HashMap load factor and capacity
✅ Avoid boxing in performance-critical code
✅ Use streams for readability, not micro-optimizations
✅ Handle null carefully (know which collections allow it)
✅ Profile before optimizing – measure real data volumes

Learning Resources

Official Docs: Java Collections Framework (Oracle)
Deep Dives:
- Java Collections Performance Guide 2026
- Mastering Java Collections & Stream API
Cheat Sheets:
- Java Collections Cheat Sheet (Dev.to)
- ScholarHat Java Collections Cheat Sheet
Books:
- Effective Java by Joshua Bloch (3rd ed.)
- Java Concurrency in Practice by Brian Goetz

Final Thoughts

The Java Collections Framework isn’t a buffet of similar options—it’s a precision toolset. Choosing the right collection is a design decision that compounds as your system scales.

Start with ArrayList, HashMap, and HashSet for most cases. Tune with capacity, load factor, and concurrency utilities as needed. And always measure before optimizing.

If you’re taking a java full stack course in bangalore, practice these patterns until they’re muscle memory. Your future self (and your teammates) will thank you.

Your turn: Which Java collection do you find most misunderstood? Drop a comment below.

# Docker Interview Questions: A Hands-On Tutorial for Developers

Ascent Software Training Institute — Thu, 03 Sep 2026 09:34:26 +0000

Docker Interview Questions: A Hands-On Tutorial for Developers

Docker interview preparation becomes much easier when you stop memorizing isolated definitions and start building small, working examples. In this tutorial, you’ll create a containerized Python API, connect it to Redis with Docker Compose, inspect its networking and storage, and practice answering common interview questions using real commands.

If you are preparing for a DevOps role or planning to enroll in an AWS DevOps course in Bangalore, Docker interview questions are an important part of your preparation. Docker is widely used in CI/CD, cloud deployments, microservices, and infrastructure automation.

The examples use standard Docker workflows: images, containers, Dockerfiles, volumes, networks, Compose, caching, and troubleshooting. Docker’s official learning examples cover the same progression from running containers to building images, using volumes, networking services, Compose, and multi-stage builds. github

1. Prepare the Example Project

Create a new project:

mkdir docker-interview-lab
cd docker-interview-lab

Create this structure:

docker-interview-lab/
├── app.py
├── requirements.txt
├── Dockerfile
├── .dockerignore
└── compose.yaml

Create a small API

Add the following to app.py:

from flask import Flask, jsonify
import os
import socket

app = Flask(__name__)

@app.get("/")
def home():
    return jsonify({
        "message": "Docker interview lab is running",
        "hostname": socket.gethostname(),
        "environment": os.getenv("APP_ENV", "development")
    })

@app.get("/health")
def health():
    return jsonify({"status": "healthy"})

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5000)

The important detail is:

app.run(host="0.0.0.0", port=5000)

If the application listens only on 127.0.0.1, it may work inside the container but remain inaccessible from your host machine.

Add this to requirements.txt:

Flask==3.1.0

Create .dockerignore:

__pycache__/
*.pyc
.git/
.env
.venv/
venv/

A .dockerignore prevents unnecessary files from being sent to the Docker build context. This makes builds faster and helps avoid accidentally copying local secrets or development files into the image.

2. Question: What Is Docker?

Docker is a platform for packaging and running applications in isolated containers.

A container includes the application and its required runtime dependencies, libraries, configuration, and filesystem changes. Unlike a virtual machine, a container does not usually include a complete guest operating system kernel. Containers share the host kernel while remaining isolated through operating-system features.

A useful interview answer is:

Docker packages an application and its dependencies into a portable image. A container is a running instance of that image, isolated from other processes but sharing the host operating system kernel.

Container versus virtual machine

Area	Container	Virtual machine
Operating system	Shares the host kernel	Includes a guest OS
Startup time	Usually very fast	Usually slower
Resource usage	Generally lower	Generally higher
Isolation	Process-level isolation	Hardware or hypervisor-level isolation
Packaging unit	Image	VM disk image
Typical use	Services, CI, development	Stronger isolation, different kernels, legacy workloads

Containers are not automatically equivalent to virtual machines. If an interviewer asks about security isolation, explain that the isolation boundary and threat model differ.

3. Question: What Is the Difference Between an Image and a Container?

An image is an immutable template containing application files, dependencies, metadata, and filesystem layers.

A container is a runnable instance of an image. When Docker starts a container, it adds a writable layer on top of the image’s read-only layers.

Try it:

docker pull python:3.12-slim
docker images

Run an interactive Python container:

docker run --rm -it python:3.12-slim python

Inside the Python prompt:

print("Running inside a container")

Exit:

exit()

The --rm flag removes the container after it stops.

Now run a named container in the background:

docker run -d \
  --name interview-python \
  python:3.12-slim \
  sleep 300

Inspect it:

docker ps
docker inspect interview-python

Stop and remove it:

docker stop interview-python
docker rm interview-python

Useful distinction:

docker ps shows running containers.
docker ps -a shows running and stopped containers.
docker images lists local images.
docker inspect displays low-level metadata.
docker logs displays a container’s standard output and error streams.

4. Question: What Happens During `docker run`?

Consider this command:

docker run -d --name web -p 8080:5000 my-api:1.0

Docker generally performs these steps:

Checks whether the image exists locally.
Pulls the image if it is unavailable locally.
Creates a container from the image.
Adds a writable container layer.
Configures networking.
Maps host port 8080 to container port 5000.
Starts the container’s configured process.

The port format is:

host_port:container_port

Therefore:

-p 8080:5000

means that requests to port 8080 on your machine are forwarded to port 5000 inside the container.

5. Build the API Image

Add this to Dockerfile:

FROM python:3.12-slim

WORKDIR /app

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

COPY requirements.txt .

RUN pip install --no-cache-dir -r requirements.txt

COPY app.py .

EXPOSE 5000

CMD ["python", "app.py"]

Build the image:

docker build -t docker-interview-api:1.0 .

Run it:

docker run -d \
  --name docker-api \
  -p 8080:5000 \
  -e APP_ENV=container \
  docker-interview-api:1.0

Test it:

curl http://localhost:8080/
curl http://localhost:8080/health

View logs:

docker logs docker-api

Follow logs continuously:

docker logs -f docker-api

Enter the running container:

docker exec -it docker-api sh

Inside the container:

pwd
ls
python --version

Leave the shell:

exit

Clean up:

docker stop docker-api
docker rm docker-api

6. Question: Explain the Main Dockerfile Instructions

`FROM`

Defines the base image:

FROM python:3.12-slim

Use a trusted and maintained base image. Docker’s build guidance recommends choosing trusted images, keeping images small, and rebuilding regularly so dependencies and base-image security fixes are included. docs.docker

`WORKDIR`

Sets the working directory for subsequent instructions:

WORKDIR /app

It is preferable to using repeated RUN cd /app commands because WORKDIR applies consistently to future instructions and the container’s default process.

`COPY`

Copies files from the build context into the image:

COPY requirements.txt .
COPY app.py .

`RUN`

Executes a command while building the image:

RUN pip install --no-cache-dir -r requirements.txt

The result becomes part of an image layer.

`EXPOSE`

Documents the port that the application expects to use:

EXPOSE 5000

It does not publish the port to the host. You still need:

-p 8080:5000

`CMD`

Defines the default command:

CMD ["python", "app.py"]

`ENTRYPOINT`

Defines the main executable for the container. For example:

ENTRYPOINT ["python"]
CMD ["app.py"]

The resulting default command is equivalent to:

python app.py

A common interview distinction is that CMD supplies defaults that can be replaced, while ENTRYPOINT is intended to define the executable. The exact behavior also depends on whether shell or exec form is used.

Prefer exec form:

CMD ["python", "app.py"]

It handles signals more reliably than:

CMD python app.py

7. Question: How Does Docker Image Layer Caching Work?

Each Dockerfile instruction can create a layer. Docker reuses a cached layer when the instruction and its relevant inputs have not changed.

This Dockerfile is cache-friendly:

COPY requirements.txt .

RUN pip install --no-cache-dir -r requirements.txt

COPY app.py .

If only app.py changes, Docker can reuse the dependency-installation layer.

This version is less efficient:

COPY . .

RUN pip install --no-cache-dir -r requirements.txt

Any source-code change can invalidate the COPY . . layer and force the dependency installation to run again.

Build with plain progress output:

docker build --progress=plain -t docker-interview-api:1.1 .

Inspect image size:

docker image ls docker-interview-api
docker history docker-interview-api:1.1

Performance tips:

Put stable instructions before frequently changing instructions.
Use .dockerignore.
Avoid copying the entire repository when only a few files are required.
Combine related package-installation commands carefully.
Remove package-manager caches where appropriate.
Use BuildKit cache mounts for package managers in larger projects.
Avoid rebuilding with --no-cache unless you specifically need a clean build.

8. Question: What Are Volumes and Bind Mounts?

Container filesystems are ephemeral. If a container is removed, data written only inside its writable layer disappears.

Named volume

Create a volume:

docker volume create app-data

Use it:

docker run --rm \
  -v app-data:/data \
  alpine \
  sh -c "echo persistent-data > /data/example.txt"

Read it from another container:

docker run --rm \
  -v app-data:/data \
  alpine \
  cat /data/example.txt

The data survives the first container because it is stored in the named volume.

Bind mount

A bind mount maps a host directory into a container:

docker run --rm \
  -v "$(pwd)":/workspace \
  alpine \
  ls /workspace

Bind mounts are useful during development because changes made on the host are immediately visible inside the container.

When should you use each?

Storage type	Best use
Named volume	Database data and Docker-managed persistent application data
Bind mount	Local development, source-code editing, configuration injection
Image layer	Static application files that do not need runtime persistence
External storage	Production data requiring independent durability and backup

Do not treat a container’s writable layer as a database backup strategy.

9. Question: How Does Docker Networking Work?

Docker provides isolated networks that allow containers to communicate.

Create a network:

docker network create interview-net

Start a container on it:

docker run -d \
  --name api \
  --network interview-net \
  docker-interview-api:1.0

Run a temporary troubleshooting container on the same network:

docker run --rm \
  --network interview-net \
  alpine \
  ping -c 3 api

On a user-defined Docker network, containers can typically reach one another by container name. This is why application configuration should use a service name such as redis, not localhost.

Inside a container:

localhost means the current container.
The host machine is a different network namespace.
Another container should be reached through its service or container name.

Inspect the network:

docker network inspect interview-net

Remove it after testing:

docker stop api
docker rm api
docker network rm interview-net

10. Add Redis with Docker Compose

Docker Compose is useful when an application consists of multiple services.

Create compose.yaml:

services:
  api:
    build:
      context: .
    container_name: interview-api
    ports:
      - "8080:5000"
    environment:
      APP_ENV: compose
      REDIS_HOST: redis
    depends_on:
      - redis

  redis:
    image: redis:7-alpine
    container_name: interview-redis
    volumes:
      - redis-data:/data

volumes:
  redis-data:

Start both services:

docker compose up --build

Run in the background:

docker compose up -d --build

View service status:

docker compose ps

View logs:

docker compose logs -f api

Stop the services:

docker compose down

Stop them and remove the named volume:

docker compose down -v

Be careful with -v: it deletes the Compose-managed volume and its stored data.

A common Compose interview question

Does depends_on mean the dependency is ready?

Not necessarily. It controls startup order, but a service may still be initializing when the dependent application starts. Production applications should implement retries, connection timeouts, and health-aware startup behavior.

A stronger Compose configuration can add a health check:

services:
  redis:
    image: redis:7-alpine
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  api:
    build: .
    depends_on:
      redis:
        condition: service_healthy

Your application should still handle temporary connection failures gracefully.

11. Question: What Is a Multi-Stage Build?

A multi-stage build separates compilation or dependency-building tools from the final runtime image.

For a Python application, a simple example is:

FROM python:3.12-slim AS builder

WORKDIR /build

COPY requirements.txt .

RUN pip install \
    --no-cache-dir \
    --prefix=/install \
    -r requirements.txt


FROM python:3.12-slim

WORKDIR /app

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

COPY --from=builder /install /usr/local
COPY app.py .

EXPOSE 5000

CMD ["python", "app.py"]

Build it:

docker build -t docker-interview-api:multi-stage .

The final image does not need the builder’s temporary working files. This can reduce image size and attack surface. Docker’s official starter material includes multi-stage builds as a method for separating build-time and runtime dependencies. github

Multi-stage builds are especially useful for:

Go binaries.
Java applications.
Node.js front-end bundles.
TypeScript applications.
Applications with native compilation dependencies.

12. Question: Why Should Containers Avoid Running as Root?

Running as root inside a container can increase the impact of an application compromise. It does not solve every container-security concern, but using a non-root user is a practical hardening step.

Update the Dockerfile:

FROM python:3.12-slim

WORKDIR /app

RUN useradd --create-home appuser

COPY requirements.txt .

RUN pip install --no-cache-dir -r requirements.txt

COPY --chown=appuser:appuser app.py .

USER appuser

EXPOSE 5000

CMD ["python", "app.py"]

Check the user:

docker build -t docker-interview-api:secure .
docker run --rm docker-interview-api:secure id

Other security practices include:

Do not place passwords or API keys in a Dockerfile.
Do not commit .env files containing credentials.
Use secret-management features appropriate to your deployment platform.
Avoid --privileged unless there is a clearly justified requirement.
Expose only necessary ports.
Use specific image versions rather than relying blindly on latest.
Scan images in CI and rebuild them regularly.
Use minimal runtime images where compatibility allows.

13. Practical GitHub Workflow

Put the project under version control:

git init
git add .
git commit -m "Add Docker interview lab"

Create a repository on GitHub, then connect and push it:

git branch -M main
git remote add origin YOUR_REPOSITORY_ADDRESS
git push -u origin main

Do not copy credentials into the repository. Your .dockerignore should exclude local environments and secret files, but review the repository before pushing:

git status
git diff --cached

A basic GitHub Actions workflow can build the image on every push. Create .github/workflows/docker.yml:

name: Docker Build

on:
  push:
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Build image
        run: docker build -t docker-interview-api:test .

This does not publish an image. It simply confirms that the Dockerfile can build in a clean environment.

For a real project, add:

Unit tests.
Image vulnerability scanning.
Image tagging based on commit SHA.
Registry authentication through GitHub Secrets.
Deployment only after tests and security checks pass.

Docker maintains official example repositories covering Compose, sample applications, CI, image caching, and multi-stage builds. github

14. Troubleshooting Guide

Error: “Cannot connect to the Docker daemon”

Check whether Docker Desktop or the Docker service is running:

docker version

On Linux systems using systemd:

sudo systemctl status docker
sudo systemctl start docker

If permissions are the problem, your user may not have access to the Docker socket.

Error: “Port is already allocated”

Find the process using the port:

docker ps

Change the host-side port:

docker run -p 8081:5000 docker-interview-api:1.0

The application still listens on port 5000 inside the container; only the host port changed.

The container exits immediately

A container stays alive only while its main process is running.

Check its status and logs:

docker ps -a
docker logs container_name

Do not use a long-running command merely to hide application failures. Identify why the main process stopped.

The API is unreachable

Check these items:

docker ps
docker logs docker-api
docker port docker-api

Also verify that:

The application listens on 0.0.0.0.
The correct port mapping is used.
The container is running.
A host firewall is not blocking the port.

`localhost` does not reach Redis

From the API container, localhost refers to the API container itself. In Compose, use:

REDIS_HOST=redis

Do not use localhost unless Redis is running in the same container, which is usually a poor service-design choice.

Changes are not appearing

If the source is copied into the image, rebuild it:

docker compose up --build

For development, mount the source directory:

services:
  api:
    build: .
    ports:
      - "8080:5000"
    volumes:
      - .:/app

A bind mount can hide files that were copied into the image at the same path. This sometimes causes confusing behavior.

Permission denied on mounted files

The host user ID and container user ID may differ. Check:

id
docker run --rm image_name id

Choose a consistent development strategy rather than changing permissions broadly with unsafe commands.

15. Performance and Reliability Tips

Use these principles when answering practical Docker interview questions:

Keep the build context small with .dockerignore.
Order Dockerfile instructions to preserve cacheable layers.
Use multi-stage builds for compiled artifacts.
Select a suitable minimal base image, but test compatibility before switching to Alpine or distroless images.
Avoid installing development tools in the runtime image.
Use health checks for meaningful service readiness.
Set CPU and memory limits where appropriate.
Configure application workers based on workload rather than copying a default number.
Send logs to standard output and error so the runtime can collect them.
Add graceful shutdown handling for applications receiving termination signals.
Use persistent volumes or external storage for stateful data.
Tag releases immutably, for example with a version or commit SHA.
Rebuild images regularly to receive dependency and base-image updates.

An image that builds quickly but contains unnecessary packages, runs as root, stores secrets, or loses data on restart is not production-ready.

16. Practice Exercises

Try these without looking at the answers first.

Exercise 1: Inspect a container

Run:

docker run -d --name nginx-lab -p 8088:80 nginx:stable

Then find:

The container IP address.
The image ID.
The published port.
The container’s main process.

Useful commands:

docker inspect nginx-lab
docker port nginx-lab
docker top nginx-lab

Clean up:

docker rm -f nginx-lab

Exercise 2: Prove volume persistence

Create a named volume.
Write a file from one container.
Remove that container.
Read the file from another container.

Explain why the file remains after the container is deleted.

Exercise 3: Break and fix networking

Start Redis with Compose.
Configure the API to use localhost.
Observe the connection failure.
Change the hostname to redis.
Explain the difference between container-local and Compose-network addressing.

Exercise 4: Improve the Dockerfile

Modify the API image to:

Run as a non-root user.
Use a .dockerignore.
Avoid pip cache files.
Separate stable dependency installation from source-code copying.
Add a health check.

Example:

HEALTHCHECK --interval=30s --timeout=3s \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:5000/health')"

Test the result:

docker inspect --format='{{json .State.Health}}' container_name

17. Quick Interview Revision

Here are concise answers you can practice aloud:

What is Docker?

A platform for packaging and running applications in isolated, portable containers.
Image versus container?

An image is an immutable template; a container is a running instance of that image.
What does -p 8080:5000 mean?

It maps host port 8080 to container port 5000.
Does EXPOSE publish a port?

No. It documents the intended container port. Port publishing requires -p or Compose’s ports.
Why use .dockerignore?

To reduce build context size and prevent unnecessary or sensitive files from entering the build.
Why use multi-stage builds?

To keep build tools and temporary files out of the final runtime image.
What happens to container data after removal?

Data in the container’s writable layer is lost; data in a named volume can persist.
How do containers communicate in Compose?

Through the Compose network, usually using service names as DNS hostnames.
Why should applications not depend on localhost for another service?

Because localhost refers to the current container.
How do you troubleshoot a stopped container?

Check docker ps -a, inspect its exit status, and read docker logs.
What is a good Docker security practice?

Use trusted, versioned images, avoid secrets in images, run as non-root, limit privileges, and scan regularly.
How do you improve build speed?

Use .dockerignore, order layers for caching, avoid unnecessary context files, and use multi-stage or BuildKit caching where appropriate.

Learning Resources

For continued practice, work through Docker’s official getting-started material and inspect its sample applications rather than only reading command references. The official examples demonstrate containers, images, volumes, bind mounts, networking, Compose, caching, and multi-stage builds in a connected workflow. github
Developers preparing for an AWS DevOps course and placement in Bangalore can use this hands-on Docker lab to practice containerization, networking, image optimization, Docker Compose, and troubleshooting.

The most effective routine is:

Build a small service.
Containerize it.
Add a second service.
Persist its data.
Break the networking deliberately.
Diagnose the failure from logs and inspection commands.
Improve the Dockerfile.
Automate the build with CI.

That process prepares you for Docker interviews much better than memorizing commands alone.

## Skills Required to Become a Cyber Security Professional: A Developer’s Hands‑On Roadmap

Ascent Software Training Institute — Wed, 02 Sep 2026 11:33:29 +0000

Skills Required to Become a Cyber Security Professional: A Developer’s Hands‑On Roadmap

If you’re a developer eyeing cyber security, you don’t need to start from zero. You already speak code, understand systems, and can automate. This tutorial turns those strengths into a practical, project‑driven path to become a security professional—complete with labs, GitHub examples, and troubleshooting tips you can actually use. eccu
Developer working on cybersecurity skills with code, security logs, and network diagram on a dark-themed laptop screen.

Why This Guide Is Different

Most “skills” lists read like job descriptions. This one is built for builders. You’ll:

Map your dev skills to security roles
Set up a home lab that doesn’t break your laptop
Ship small, portfolio‑ready projects each week
Learn the exact tools hiring managers in Bangalore and beyond look for in 2026

We’ll keep marketing out of it. No “guaranteed placement.” Just the work.

Step 1 — Pick Your Security Lane (Based on Your Dev Superpowers)

Cyber security isn’t one job. It’s a family of roles. As a developer, some paths will feel natural.

If you enjoy…	Try this role	Why it fits devs	Starter project idea
Building APIs, debugging auth flows	AppSec / Secure Code Review	You already read code and think in edge cases	Add security headers, fix OWASP Top 10 in a sample app
Infrastructure, Docker, CI/CD	DevSecOps / Cloud Security	You automate deploys and care about pipelines	Build a GitHub Actions pipeline with SAST, SCA, secret scanning
Networks, logs, “what happened?”	SOC Analyst / Detection Engineering	You like tracing requests and reading logs	Spin up a SIEM lab, write detections for SSH brute force
Breaking things (ethically)	Penetration Tester / Red Team	You love finding why code fails under weird input	Run a local vulnerable app, document findings, propose fixes

Pick one lane for the next 8–12 weeks. You can pivot later, but focus wins. certcompass

Step 2 — Set Up Your Security Lab (Without Wrecking Your Machine)

You need a safe place to break things. Here’s a minimal, repeatable setup.

Prerequisites

A laptop with at least 16 GB RAM (8 GB works, but 16 is smoother)
Virtualization enabled in BIOS
~40 GB free disk

Install the Core Stack

Virtualization
- Install VirtualBox or VMware Workstation Player.
- Create two VMs:
  - kali-linux (attacker)
  - ubuntu-server (target)
Networking
- Set both VMs to “Host‑only Adapter” so they can talk to each other but not your home network.
- Note their IPs (e.g., 192.168.56.101, 192.168.56.102).
Target App

On ubuntu-server, deploy a deliberately vulnerable app for practice:

   # On ubuntu-server VM
   sudo apt update
   sudo apt install -y docker.io docker-compose
   sudo systemctl enable --now docker

   # Clone a vulnerable app (e.g., OWASP Juice Shop)
   git clone https://github.com/juice-shop/juice-shop.git
   cd juice-shop
   docker-compose up -d

Access it from Kali at http://<ubuntu-ip>:3000. github

SIEM Option (for SOC path) If you’re leaning SOC/detection, spin up a lightweight SIEM in another VM or container (e.g., Wazuh or Elastic Security). Many Bangalore training programs now include SIEM labs because it’s a core 2026 skill. tutorsbot

Troubleshooting tip: If Docker containers won’t start inside the VM, ensure nested virtualization is allowed (for VMware: virtualhw.version = "19" and vhv.enable = "TRUE" in .vmx).

Step 3 — Build the Core Skills (With Code, Not Just Theory)

You don’t need to memorize every RFC. You do need working fluency in a few areas. Treat each as a mini‑project.

3.1 Networking Fundamentals (Dev‑Style)

You already call APIs. Now see how packets move.

Exercise: Map an HTTP request to TCP/IP layers.

On Kali, install tcpdump and wireshark (GUI optional).
From Kali, hit the Juice Shop:

   curl -v http://<ubuntu-ip>:3000

In another terminal, capture traffic:

   sudo tcpdump -i any -n host <ubuntu-ip> and port 3000 -w js-shop.pcap

Open js-shop.pcap in Wireshark. Identify:
- Ethernet → IP → TCP → HTTP
- Source/dest ports, sequence numbers, SYN/ACK handshake

Why this matters: Network fluency is non‑negotiable for security roles in 2026, from SOC to pentesting. scaler

3.2 Linux & Scripting for Security

Most servers run Linux. Most security tooling is CLI‑first.

Exercise: Write a Python script to parse auth logs and flag suspicious IPs.

On ubuntu-server:

# Simulate some SSH logs (or use /var/log/auth.log if SSH is enabled)
sudo apt install -y openssh-server
# Generate some failed logins from Kali:
# ssh nonexist@<ubuntu-ip> (repeat with wrong password)

Python script (log_analyzer.py) on Kali or your host:

import re
from collections import Counter

LOG_FILE = "auth.log"  # copy from ubuntu-server if needed

FAILED_PATTERN = re.compile(r"Failed password for .* from (?P<ip>\d+\.\d+\.\d+\.\d+)")

def analyze_log(path: str, threshold: int = 5):
    ips = []
    with open(path) as f:
        for line in f:
            m = FAILED_PATTERN.search(line)
            if m:
                ips.append(m.group("ip"))
    counts = Counter(ips)
    suspects = [ip for ip, c in counts.items() if c >= threshold]
    return suspects

if __name__ == "__main__":
    suspects = analyze_log(LOG_FILE)
    if suspects:
        print("🚨 Suspicious IPs:")
        for ip in suspects:
            print("-", ip)
    else:
        print("No obvious brute-force patterns found.")

Run:

python log_analyzer.py

Extend it:

Output JSON for a SIEM ingest
Add a simple alert (email/Slack webhook) when threshold is crossed

This is exactly the kind of automation SOC and detection engineers build. jobaajlearnings

3.3 Secure Coding & OWASP Top 10 (AppSec Path)

You don’t need to be a crypto expert, but you must stop common mistakes.

Exercise: Harden a small Node/Express app against OWASP Top 10 issues.

Sample app.js:

const express = require("express");
const helmet = require("helmet");
const rateLimit = require("express-rate-limit");
const { body, validationResult } = require("express-validator");

const app = express();
app.use(express.json());
app.use(helmet()); // Security headers

// Rate limit login attempts
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // 5 attempts
  message: "Too many login attempts, try again later.",
});

app.post(
  "/login",
  loginLimiter,
  body("email").isEmail().normalizeEmail(),
  body("password").isLength({ min: 8 }),
  (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    // TODO: real auth logic here (with hashed passwords, not plaintext!)
    res.json({ ok: true });
  }
);

app.listen(3001, () => console.log("Secure-ish app on http://localhost:3001"));

Key practices embedded:

Input validation with express-validator
Security headers via helmet
Rate limiting to slow brute force
Server‑side validation only (no trusting the frontend)

Common dev mistakes this avoids: trusting user input, missing security headers, no rate limiting, and weak auth patterns. datacentre

Troubleshooting:

If helmet breaks your app (e.g., CORS issues), configure it selectively:

  app.use(helmet({ crossOriginResourcePolicy: false }));

If rate limiting feels too strict in dev, increase max or whitelist your IP.

3.4 Cloud & DevSecOps Basics (If You Like Pipelines)

Cloud security is a default requirement in 2026 roles. You don’t need multi‑cloud mastery; start with one provider and CI/CD security. ascentcourses

Exercise: Add security checks to a GitHub Actions pipeline.

.github/workflows/ci-security.yml:

name: CI with Security Gates

on:
  push:
    branches: [main]
  pull_request:

jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install deps
        run: npm ci

      - name: SAST (CodeQL)
        uses: github/codeql-action/init@v3
        with:
          languages: javascript
      - uses: github/codeql-action/analyze@v3

      - name: Dependency scan (npm audit)
        run: npm audit --audit-level=high

      - name: Secret scan (truffleHog example)
        run: |
          pip install truffleHog
          trufflehog filesystem . --regex --entropy=False --fail

This pipeline:

Runs static analysis (CodeQL)
Blocks high‑severity vulnerable dependencies
Scans for accidentally committed secrets

Common errors & fixes:

trufflehog fails on false positives: add .trufflehog.yml to ignore known safe patterns.
CodeQL seems slow on first run: that’s normal; subsequent runs are faster due to caching.

This is the kind of “DevSecOps” skill many Bangalore teams now expect alongside basic cloud knowledge. devopstraininginstitute

Step 4 — Turn Skills Into Portfolio Projects (GitHub‑Ready)

Hiring managers want evidence, not just certificates. Ship small, focused repos with clear READMEs.

Project Ideas by Path

AppSec / Secure Code

Repo: secure-express-starter
- Express template with helmet, rate limiting, input validation, CSP, and secure cookie flags.
- README: “How I hardened this app against OWASP Top 10.”
- Link to a short blog post explaining each control. dev

SOC / Detection Engineering

Repo: ssh-bruteforce-detection-lab
- Terraform or manual steps to spin up a Linux VM.
- Log collection config (e.g., Wazuh agent or Elastic agent).
- KQL/Sigma rules to detect repeated failed SSH logins.
- Screenshots of alerts and a simple dashboard. linkedin

DevSecOps / Cloud Security

Repo: ci-security-gates-node
- Sample Node app + GitHub Actions pipeline with SAST, SCA, secret scanning.
- A “Security.md” explaining each gate and how to tune it.
- Optional: add container scanning (Trivy) if you Dockerize the app. devopstraininginstitute

Penetration Testing (Ethical)

Repo: juice-shop-findings
- Document 5–10 vulnerabilities you found in a local vulnerable app.
- For each: description, steps to reproduce, impact, and remediation.
- Emphasize responsible, lab‑only testing. github

Structure each repo like this:

repo/
  README.md        # What, why, how to run, what you learned
  docs/            # Architecture diagrams, threat model (optional)
  src/             # Code, configs, rules
  scripts/         # Automation (log parser, scan wrappers)
  SECURITY.md      # How you approached security

Aim for 3–4 solid repos over 2–3 months. That’s enough to show range without burning out.

Step 5 — Learn the Tools That Actually Show Up in Jobs

You don’t need every tool, but you should be comfortable with a few in each category.

Category	Starter tools	Why they matter
SIEM / Log analysis	Wazuh, Elastic Security, Azure Sentinel (labs)	Core for SOC and incident response roles cambridgeinfotech
Vulnerability scanning	OWASP ZAP, Burp Community, Trivy (containers)	AppSec and DevSecOps basics
Network analysis	Wireshark, tcpdump, Nmap	Understand traffic, services, and exposure scaler
Secure coding	ESLint + security plugins, CodeQL, Semgrep	Catch issues before merge
Secrets management	dotenv (dev), AWS Secrets Manager / Vault (prod concepts)	Stop API keys in code dev

Practical exercise: Pick one tool per week. Install it in your lab, run it against your target app or VM, and write a 300–500 word note: what it found, what was noise, how you’d tune it.

Step 6 — Fix the Common Errors Developers Hit in Security

These show up again and again in 2026 code reviews and breach post‑mortems.

1) Trusting User Input

Mistake: Validating only in the frontend or assuming “my users won’t do that.”

Fix:

Validate on the server with schemas (e.g., Zod, Pydantic, express-validator).
Reject unexpected fields; don’t silently ignore them. appsecengineer

2) Hardcoding Secrets

Mistake: API keys, DB passwords, and tokens in source code or .env committed to Git.

Fix:

Use environment variables; add .env to .gitignore.
For production, use a secrets manager (AWS Secrets Manager, Vault, Doppler).
Rotate any key that ever touched Git history. dev

3) Weak Password Storage

Mistake: Storing plaintext passwords or using MD5/SHA1.

Fix:

Use bcrypt or Argon2id with a proper work factor.
Never design your own crypto. skillstuff

4) No HTTPS / Missing Security Headers

Mistake: Running HTTP in prod, or ignoring headers like HSTS, CSP.

Fix:

Enforce HTTPS (Let’s Encrypt + redirect).
Set Strict-Transport-Security, Content-Security-Policy, etc. (Helmet makes this easy). dev

5) Client‑Only Authorization

Mistake: Hiding buttons in the UI and calling that “security.”

Fix:

Enforce authorization on the server for every resource access.
Use RBAC/ABAC and deny‑by‑default logic. datacentre

Troubleshooting pattern: When you’re unsure, ask: “If I curl this endpoint directly, without the frontend, is it still safe?” If not, fix it.

Step 7 — Performance Tips: Learn Faster Without Burning Out

You’re not trying to know everything. You’re trying to be useful, quickly.

Timebox labs: 60–90 minutes, then stop. Consistency beats marathons.
One concept, one project: Don’t learn “networking” in abstract; learn it by capturing and analyzing traffic for your vulnerable app.
Teach as you go: Write short posts (like this) or internal notes. Explaining forces clarity.
Reuse, don’t rebuild: Keep a “security snippets” repo: log parsers, Dockerfiles for labs, CI templates.
Focus on transferable skills: Scripting, reading logs, threat modeling, and secure design patterns pay off across roles. eccu

Step 8 — Troubleshooting Your Learning Path

“I don’t have time.”

Cut scope, not frequency. Two 45‑minute sessions per week beat one 6‑hour weekend crash.
Tie learning to your current work: add one security check to your team’s CI, or write a log parser for an app you already maintain.

“My laptop is slow.”

Use smaller VMs (1–2 GB RAM each).
Prefer containerized labs (Docker) over full VMs when possible.
Run only one heavy tool at a time (e.g., SIEM or Burp, not both).

“I’m lost in tools.”

Pick one path (AppSec, SOC, DevSecOps, or Pentest) and ignore the rest for 8 weeks.
For each tool, ask: “What problem does this solve?” If you can’t answer in one sentence, pause and read the docs’ “why” section first.

“I’m not sure if I’m improving.”

Measure output, not hours:
- Number of labs completed
- Number of security findings documented
- Number of CI security gates added
Revisit your first repo after a month. You should see clearer READMEs, better structure, and fewer “copy‑paste” configs.

Step 9 — Learning Resources That Don’t Feel Like Marketing

Use these as references, not gospel. Combine with your own labs.

Foundations & Roadmaps

“Cybersecurity Career Path 2026 Guide” – role breakdowns, skills, certs unihackers
“Skills Required for Cybersecurity Jobs in 2026” – networking, cloud, IR, ethical hacking overview collegesimplified
“Developer to Cybersecurity: Realistic Transition Guide 2026” – timeline, specialization, portfolio advice certcompass

Hands‑On Projects & Labs

GitHub: CarterPerez-dev/Cybersecurity-Projects – 70 projects from beginner to advanced github
GitHub: aw-junaid/cybersec-projects – offensive/defensive tools and simulations github
TryHackMe / Hack The Box (free tiers) – guided labs for SOC, network analysis, and pentesting linkedin

Secure Coding & Mistakes

“5 Common Security Mistakes Developers Still Make (and How to Fix Them)” – practical Node/Express examples dev
“Top 9 Secure Coding Mistakes Developers Still Make” – patterns and checklists you can apply today appsecengineer
“10 Security Mistakes Developers Still Make in 2026” – server‑side validation, dependency hygiene, SDLC tips sapnasecurity

Local Context (Bangalore)

If you’re in Bengaluru and considering structured learning, look for programs that emphasize live labs, SIEM, cloud security, and OWASP Top 10 rather than just theory. Many local providers now advertise “cyber security course in bangalore” and “cyber security training in bangalore” with hands‑on components; evaluate them by syllabus and lab access, not just placement claims.
ascent

A Simple 12‑Week Plan (Developer Edition)

Adjust based on your chosen lane.

Weeks 1–2: Foundations + Lab

Set up VMs, vulnerable app, and basic networking captures.
Complete 2–3 beginner projects from a cybersecurity‑projects repo. github

Weeks 3–5: Core Skills

Networking + Linux scripting (log analyzer).
Secure coding: harden a small app against OWASP Top 10.
Start one tool deep dive (e.g., OWASP ZAP or Wazuh). scaler

Weeks 6–8: Specialization Sprint

AppSec: add SAST/SCA to CI, write secure coding guidelines for your team.
SOC: build a detection rule set for brute force and suspicious logins.
DevSecOps: container scanning, policy‑as‑code basics, secrets management patterns. linkedin

Weeks 9–12: Portfolio & Polish

Ship 2–3 GitHub projects with solid READMEs.
Write 2–3 short posts (Dev.to, LinkedIn, or internal wiki) explaining what you built and why it matters.
Map your experience to job descriptions; tailor your resume around projects, not just courses. eccu

Final Thought: You’re Already Closer Than You Think

Developers bring huge advantages to security: you can read code, automate boring tasks, and think in systems. The gap isn’t “knowing everything”; it’s directing that ability toward threats, logs, and failure modes.

Start small. Break something in your lab. Fix it. Document it. Repeat. That loop—more than any single course or certificate—is what turns a developer into a cyber security professional. eccu

If you want, tell me your current stack (language, cloud, typical apps), and I’ll sketch a customized 4‑week mini‑plan with specific repos and tools to use.

DEV Community: Ascent Software Training Institute

Build an Angular + Spring Boot App From Scratch (and Fix the Errors You'll Hit)

Build an Angular + Spring Boot App From Scratch (and Fix the Errors You'll Hit)

The plan

Part 1: The Spring Boot backend

The entity

The repository

A request DTO

The controller

Clean validation errors

Run and test

Part 2: The Angular frontend

Set up the dev proxy

Enable HttpClient

The model and service

The component

Practical exercises

Troubleshooting and common errors

Best practices

Performance tips

GitHub examples worth reading

Learning resources

Where to go from here

Wrapping up

Python Data Structures Explained: A Practical Tutorial with Code Examples"

Python Data Structures Explained: A Hands-On Guide

Step 1: Lists

List comprehensions

The aliasing trap

Step 2: Tuples

Step 3: Dictionaries

Counting things

Grouping with defaultdict

Dict comprehensions and merging

Step 4: Sets

Step 5: Stacks and Queues

Stack (LIFO): use a list

Queue (FIFO): use collections.deque

Step 6: Heaps and Sorted Lookups

heapq: priority queues

bisect: binary search on sorted lists

Step 7: Choosing the Right One

Performance Tips

Common Errors and Troubleshooting

Best Practices

Practical Exercises

Mini project: a log summarizer

GitHub Examples to Read (and Build)

Where This Fits in a Bigger Learning Path

Learning Resources

Wrapping Up

CI/CD Pipelines Explained: A Hands-On Guide for Developers

CI/CD Pipelines Explained: A Hands-On Guide for Developers

Table of Contents

1. What CI/CD Actually Means

2. Setting Up Your First Pipeline

3. A Real Example: Node.js App with GitHub Actions

4. Adding Tests, Linting, and Build Steps

5. Deploying Automatically

6. Practical Exercises

7. Troubleshooting Common Failures

8. Best Practices That Actually Matter

9. Performance Tips

10. Learning Resources

Wrapping Up

Nmap Tutorial for Network Scanning: A Practical Guide for Developers and Security Engineers

Nmap Tutorial for Network Scanning: A Practical Guide for Developers and Security Engineers

Table of Contents

1. What Is Nmap and Why It Matters

2. Nmap Architecture

3. Installation

4. Core Scanning Concepts

4.1 Port States

4.2 TCP Handshake and the SYN Scan

5. Common Scan Types (with Code)

5.1 Basic Host Discovery (Ping Sweep)

5.2 TCP SYN Scan (Stealth Scan)

5.3 TCP Connect Scan (No Root Required)

5.4 UDP Scan

5.5 Service and Version Detection

Queue (FIFO): use `collections.deque`