Stage 5 of 5
Stage 5: Professional Skills
The skills hiring teams expect: team Git workflows, web security defenses and accessibility.
What this stage covers
12 hands-on lessons built around runnable examples. Every lesson is published as a full page below — read it, copy the code, do the assignment, then check the solution.
- Branching & PRs
- Merge conflicts
- XSS & CSRF
- SQL injection
- WCAG 2.1
- ARIA
Git Collaboration
4 lessonsCollaborate in a team without fear: branching, conflicts, pull requests and recovery.
About this subject
Course Overview
Git is easy to learn alone and hard to use in a team. This course covers the workflows that keep a shared repository healthy: feature branches, conflict resolution, pull-request review and the recovery commands for when something goes wrong — 4 lessons.
Prerequisites
- A GitHub account
- Git installed (
git --version) - A terminal
- Basic command-line comfort
Lesson List
| Lesson | Title | Key Topics |
|---|---|---|
| Lesson 01 | Branching Strategy | feature branches, switch, merging, protecting main |
| Lesson 02 | Resolving Conflicts | conflict markers, merge vs rebase, aborting safely |
| Lesson 03 | Pull Request Review | PR descriptions, review comments, squash merge, branch protection |
| Lesson 04 | Advanced Git | stash, reset, revert, cherry-pick, reflog, bisect |
Study Method
- Do every drill in a scratch repository, never in a real project.
- Break the repository on purpose; recover it with
reflog. - Read
git log --graph --oneline --allafter every exercise until the shape is obvious. - Write the command sequence in your own words after each drill.
- Practise a review on a partner's PR — reviewing teaches more than authoring.
Setup
git config --global user.name "Your Name"
git config --global user.email "[email protected]"
git config --global init.defaultBranch main
git --version
References
Branching Strategy
Feature branches and a workflow a whole team can follow.
Resolving Conflicts
Merge conflicts, rebase versus merge, and how to finish cleanly.
Pull Request Review
Writing good pull requests, reviewing code and squash merging.
Advanced Git
stash, reset, revert and cherry-pick for when things get messy.
Web Security
4 lessonsDefend real applications against XSS, CSRF and SQL injection.
About this subject
Course Overview
Most breaches are not sophisticated. They are a missing output escape, a concatenated SQL query or a secret in a public repository. This course covers the attacks that matter for web applications and the concrete defences for each — 4 lessons.
Prerequisites
- JavaScript and Node.js
- Express basics
- HTML forms and HTTP basics
- A local development environment
Lesson List
| Lesson | Title | Key Topics |
|---|---|---|
| Lesson 01 | XSS Defense | stored/reflected/DOM XSS, escaping, DOMPurify, CSP, HttpOnly |
| Lesson 02 | CSRF and Authentication | SameSite, synchroniser tokens, sessions vs JWT, bcrypt |
| Lesson 03 | SQL Injection | prepared statements, allow-listed identifiers, ORMs, least privilege |
| Lesson 04 | HTTPS and Environment Variables | TLS, HSTS, security headers, .env, secret rotation |
Study Method
- Run the vulnerable example first; understand the attack before the fix.
- Apply the fix, then replay the exact payload and confirm it fails.
- Read the OWASP Top 10 entry for each topic.
- Check your own projects with the same payloads.
- Never test attacks against systems you do not own.
Setup
npm install express express-session better-sqlite3 bcrypt dotenv
Generate a secret:
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
References
XSS Defense
innerHTML risks, output escaping and Content Security Policy.
CSRF and Authentication
SameSite cookies, CSRF tokens and JWT authentication basics.
SQL Injection
Prepared statements, parameterized queries and ORM defenses.
HTTPS and Environment Variables
TLS, security headers and managing secrets with .env.
Web Accessibility
4 lessonsMake sites usable by everyone: semantics, ARIA, accessible forms and media.
About this subject
Course Overview
Accessibility is the difference between a site that works for some visitors and one that works for all of them. This course covers WCAG, semantics, ARIA, forms, media and the testing habits that find real barriers — 4 lessons, aligned with WCAG 2.1 AA.
Prerequisites
- HTML and CSS fundamentals
- JavaScript and the DOM
- A browser with developer tools
- A screen reader for testing (NVDA on Windows, VoiceOver on macOS)
Lesson List
| Lesson | Title | Key Topics |
|---|---|---|
| Lesson 01 | Accessibility Concepts | POUR, WCAG 2.1 levels, assistive tech, auditing |
| Lesson 02 | Semantics and ARIA | landmarks, headings, five rules of ARIA, focus management |
| Lesson 03 | Form Accessibility | labels, fieldset, aria-describedby, live errors, contrast |
| Lesson 04 | Images and Media | alt decision tree, SVG, captions, transcripts, reduced motion |
Study Method
- Unplug the mouse for one full exercise. Nothing else teaches keyboard access as quickly.
- Run Lighthouse and axe, but treat them as a starting point.
- Test one form with a screen reader every lesson.
- Fix issues in your own pages, not just the examples.
- Write the user impact next to every finding.
Testing Tools
- Keyboard — Tab, Shift+Tab, Enter, Space, Escape, arrow keys
- Lighthouse — Chrome DevTools → Lighthouse → Accessibility
- axe DevTools — browser extension
- NVDA (Windows) or VoiceOver (macOS)
- Contrast checker — WebAIM Contrast Checker
References
Accessibility Concepts
WCAG 2.1, screen readers and auditing with Lighthouse.
Semantics and ARIA
Roles, ARIA attributes, keyboard navigation and focus management.
Form Accessibility
Labels, error announcements and color contrast.
Images and Media
Writing alt text, captions, transcripts and color-blind friendly content.
The 5-stage series
64 lessons totalLearn this stage with a mentor
Work through these lessons on your own, or join a guided cohort at our Pitampura campus and online.