- How web applications work (request/response lifecycle)
- Common web application architectures
- OWASP Top 10 vulnerabilities (conceptual and practical impact)
- Input validation, authentication, and session management
- Secure application design principles
- Defensive controls and mitigation strategies