CYBRARY Forge Secure Code
Review a real pull request under time pressure, with a scanner that is partly wrong.
What is in it
For engineering manager, appsec lead, platform team — teach developers to find the flaw the tooling missed and reject the finding it invented.
- A seeded pull request with one genuine flaw hidden among ordinary refactors
- A scanner report carrying false positives the learner must close with a reason
- A dependency list that is mostly a distraction, as it is on a real branch
- Graded on the hunk, the class of flaw, the false alarm and the fix asked for
- A second bench at /labs/appsec-review where an AI reviewer writes the patches and the developer adjudicates it, scored on a card of its own
What it is not
- No build runs and no code executes — the review is of the diff, as reviews are
- Not a replacement for your scanner; it teaches judgement about scanner output
Forge Secure Code against the field
19 capabilities that matter for this purchase, next to the platforms a buyer shortlists in this lane: Secure Code Warrior, HackEDU/Security Journey, Hack The Box Academy. Secure Code Warrior, HackEDU/Security Journey sit outside the eight-vendor research, so they carry no marks below — named for honesty, not scored.
- Review real pull requests with conflicting claims attached, then verify the fix against a running estate.
- Noisy scanner findings are planted, so waving through a false positive costs marks.
| What you need | Forge Secure CodeIncluded in the platform | HTB |
|---|---|---|
| Free entry route for an individual | Yes, in part Runs through Cybrary's existing free tier rather than a Forge-specific plan. | Hack The Box: Documented for Free entry route for an individual |
| Paid individual subscription | Yes, in part Sold as part of Cybrary, not separately packaged yet. | Hack The Box: Documented for Paid individual subscription |
| Guided hands-on labs | Yes See it live | Hack The Box: Documented for Guided hands-on labs |
| Job-role learning paths | Yes See it live | Hack The Box: Documented for Job-role learning paths |
| Foundational command line and operating-system learning | Yes See it live Seven Linux distributions and Windows 11, each with distro-accurate command behavior. | Hack The Box: Documented for Foundational command line and operating-system learning |
| Advanced offensive target practice | Yes, in part See it live Attack paths are modeled, not executed. Genuine exploitation needs the native lane. | Hack The Box: Documented for Advanced offensive target practice |
| Vendor's own practical certification program | Coming Cybrary certification exists; Forge-assessed credentials are not built. | Hack The Box: Documented for Vendor's own practical certification program |
| Completion certificates and CPE route | Yes, in part See it live | Hack The Box: Documented for Completion certificates and CPE route |
| Cloud-specific learning | Yes See it live | Hack The Box: Documented for Cloud-specific learning |
| Application-security and developer exercises | Yes See it live Graded secure code review: a seeded pull request with one real flaw, a scanner report that is partly wrong, and a dependency list that is mostly a distraction. | Hack The Box: Documented for Application-security and developer exercises |
| Operational-technology content and environments | Yes See it live A graded plant shift across Purdue levels, scored on the safe response rather than the IT one — containment that would blind the control room loses marks. | Hack The Box: Documented for Operational-technology content and environments |
| SCADA practice mapped to IEC 62443 zones, conduits and security levels | Yes See it live The plant is built to a zone and conduit model with target security levels, and every graded decision is listed against the foundational requirement it exercises — so a coverage answer comes from what learners did, not from a syllabus. | |
| Structured feedback after practice | Yes See it live Referee scoring with per-step reasoning and a debrief that discloses what was staged. | Hack The Box: Documented for Structured feedback after practice |
| Tests a customer's deployed security controls | By design, no Different business, different liability. Partner rather than relabel. | |
| Managed continuous validation service | By design, no | |
| Customer-specific production adversary scenarios | By design, no | |
| Retest remediation against actual defenses | By design, no We teach analysts to read and act on validation evidence; we do not produce it. | |
| A working corporate mail client inside the exerciseOutlook on the Windows desktop, Evolution on Linux: folders, threads, attachments, full headers and message source. | Yes See it live Phishing training is graded both ways — a missed lure costs the same as reporting a legitimate message. | |
| The full desktop exercise usable on a phoneA trackpad cursor, edge-following viewport, gestures, an on-screen keyboard and the taskbar folded into one reachable control. | Yes See it live |
The run behind this line: The update that shipped an implant
A supply-chain run: the flaw arrives through a dependency and a review that let it through, and the review bench is where it should have been caught.
Opponent: Package-registry attacker with a typosquatted build dependency. Shaped after Published registry compromises: event-stream, ua-parser-js, 3CX. Technique and zone identifiers are published by MITRE and ISA/IEC; the mapping is ours and is not an accreditation.
How it starts — the message delivered to the mailbox
- From
- Build Notifications <ci@northwind-builds.example>
- Subject
- Dependency update available: monitoring-agent 4.2.1-3
- Link
- shows “monitoring-agent 4.2.1-3”, really points at https://mirror.northwind-builds.example/pool/monitoring-agent_4.2.1-3.deb
- A policy line saying no review is required — the sentence the attacker needs
- The mirror is not the vendor's own distribution point
- The version exists only on this mirror
Graded verdict: phish — T1195.002. Nothing here sends or resolves anywhere real.
The steps, and the zone each one crosses
| # | Tactic | ATT&CK | On the range | IEC 62443 zone |
|---|---|---|---|---|
| 1 | Initial access | T1195.002 Supply chain compromise: software supply chain | The package installs and its postinst script drops a payload. | Build and release |
| 2 | Defense evasion | T1027 Obfuscated files or information | A base64 blob is decoded and unzipped into a dot-file in /tmp. | Build and release |
| 3 | Persistence | T1546.004 Unix shell configuration modification | A profile.d script re-launches the payload at every login. | Build and release |
| 4 | Command and control | T1071.004 Application layer protocol: DNS | TXT lookups carry the callback, with a web fallback. | Enterprise |
| 5 | Collection | T1005 Data from local system | Build secrets and deployment keys are gathered from the runner. | Build and release |
Zones in this run: Build and release (Purdue level 4, via Package registry and pipeline runners); Enterprise (Purdue level 4/5, via Internet mail and web egress). How the zone model is used.
The alerts the SIEM raises from this run
Package installed from a non-approved mirror
dpkg or rpm installing from a host outside the approved mirror list.
endpoint agent · stage 1 · LINE-SECCODE-01 · T1195.002
Maintainer script wrote an executable outside the package manifest
postinst creating a file the package does not declare.
endpoint agent · stage 2 · LINE-SECCODE-02 · T1027
Login shell configuration modified
A write to /etc/profile.d or a user rc file by a package script.
endpoint agent · stage 3 · LINE-SECCODE-03 · T1546.004
What the case has to hold before it closes
- The hunk in the diff that introduced the dependency
- The class of flaw, and the scanner finding that was a false alarm
- The fix, written as the change you would approve
- The build artifacts that must be rebuilt and the keys that must be rotated
Start learning this line
One real flaw in a seeded pull request, a scanner that is partly wrong, and a fix you have to name.
A tick means the other platform's own documentation shows it. A question mark means we could not confirm it publicly — it is never a claim that they lack it. Every Forge yes opens the working screen rather than a screenshot.