Home/ Curriculum/ Day 8
DAY 08 of 12

Harden & monetize

Lock the doors, secure the API, and start taking real money

You can do… by end of day
  • Firewall a server with ufw safe defaults — and never lock yourself out of SSH.
  • Store passwords safely (hashing) and block SQL injection.
  • Send real transactional email via a provider (SPF/DKIM).
  • Accept payments via a provider API + webhooks, and handle callbacks safely.
Deliverable

A hardened, secure API that can send real email and accept a (test) payment.

Big-picture hook

It's safe and it can earn. Last teaching stretch: make it smart (AI) and make it observable (you'll know when it's sick).

Concepts what you'll understand
  • ufw firewall: stateful, preinstalled; default-deny in, allow 22/80/443; the never-lockout rule (allow SSH first, keep a test session open).
  • Auth & password storage: never store plaintext; hash with a slow KDF (bcrypt/argon2) + salt.
  • SQL injection: parameterized queries, not string concatenation — the #1 web-app hole.
  • Transactional email: provider APIs, SPF/DKIM and deliverability — getting out of the spam folder.
  • Payments: provider APIs + webhooks; verify signatures and make charges idempotent so a retried callback doesn't double-charge.
The lab hands-on, ends with something live
  1. Firewall: enable ufw with safe defaults; open only what you need; prove you can still SSH in.
  2. Hash passwords: store and verify a password with a proper hash — never plaintext.
  3. SQL shield: take a vulnerable query and make it safe with parameterization.
  4. Email + payments: add the DNS records for email, and verify a payment webhook signature end-to-end.
Want this in another format? All formats