This repository contains a comprehensive, enterprise-ready training program designed to help C# development teams adopt GitHub Copilot securely and effectively in real-world workflows.
The program goes beyond basic autocomplete and focuses on:
- Secure prompt-driven development
- AZ-2007 Azure security standards applied through code
- AI-assisted threat modelling and vulnerability detection
- End-to-end secure CI/CD pipeline automation
- OWASP-aligned code review and remediation
By the end of this training, participants will be able to:
- Generate secure ASP.NET Core code using structured Copilot prompts
- Configure Azure Key Vault, Managed Identity, and RBAC from code
- Identify and fix OWASP Top 10 vulnerabilities in C#, Python, and JavaScript
- Build a GitHub Actions pipeline with automated security gates
- Deploy a live application to Azure App Service through a secure pipeline
- C# / .NET Developers (0–10 years experience, evenly mixed)
- Engineering teams adopting AI-assisted development
- Tech leads evaluating Copilot adoption with a security focus
Shift from writing code → to designing secure instructions
Participants learn how to:
- Prompt AI tools with security constraints, not just functionality
- Review and validate AI-generated code against a security checklist
- Build security habits that survive beyond the training day
securenotes-starter/
├── lab01-prompt-engineering/ ← Session 2: Prompt patterns for secure C# code
├── lab02-az2007-azure-security/ ← Session 3: Key Vault, RBAC, STRIDE, Managed Identity
├── lab03-secure-coding/ ← Session 4: OWASP, IDOR fix, validation, JWT
├── lab04-code-security-antipatterns/ ← Session 5: Anti-patterns, Semgrep, BinaryFormatter
├── lab05-cicd-pipeline/ ← Session 6: GitHub Actions, SAST gates, deploy
├── lab06-testing-security/ ← Session 5+6: Vulnerability class + test suite
└── README.md
Each lab includes:
README.md— objective, time, steps, expected output, common mistakesprompts.md— copy-paste Copilot prompts for every exercise- Starter C# code with intentional gaps or TODO stubs
- A
prompt-log.mdtemplate to document participant results
Duration: Full-Day Intensive (8 Hours)
| Lab | Session | Topic | Duration |
|---|---|---|---|
| Lab 01 | Session 2 | Prompt Engineering for Secure C# Code | 75 min |
| Lab 02 | Session 3 | AZ-2007: Key Vault, RBAC & Threat Modelling | 75 min |
| Lab 03 | Session 4 | Secure Coding: OWASP, IDOR, Validation, JWT | 75 min |
| Lab 04 | Session 5 | Anti-Patterns, Semgrep & Code Security | 60 min |
| Lab 05 | Session 6 | CI/CD Pipeline: Security Gates & Azure Deploy | 60 min |
| Lab 06 | Sessions 5+6 | Testing & Vulnerability Class | 30 min |
- .NET 8 SDK
- Visual Studio 2022 or VS Code + C# Dev Kit
- Git + GitHub account
- Azure subscription (free tier sufficient)
- GitHub Copilot (or ChatGPT / another LLM for prompt exercises)
- Azure CLI (
azcommand) - Semgrep CLI (
pip install semgrep)
# 1. Fork this repo on GitHub — click Fork top-right
# 2. Clone YOUR fork
git clone https://github.com/YOUR-USERNAME/securenotes-starter.git
cd securenotes-starter
# 3. Open a lab
cd lab01-prompt-engineering
# Read README.md first, then open the .csproj in VS Code or Visual Studio
# 4. Verify .NET
dotnet --version # must show 8.x.xAll labs build on SecureNotes — a minimal ASP.NET Core 8 Web API.
It manages personal notes and demonstrates every security concept taught across the day.
The starter code contains 6 intentional security gaps. Each lab fixes specific gaps:
| Gap | Location | Type | Fixed in |
|---|---|---|---|
| 1 | appsettings.json |
Hardcoded DB connection string | Lab 02 |
| 2 | appsettings.json |
Hardcoded JWT secret | Lab 02 |
| 3 | NotesController.cs |
IDOR — no ownership check | Lab 03 |
| 4 | NotesController.cs |
No input validation | Lab 03 |
| 5 | Program.cs |
Stack trace in 500 responses | Lab 03 |
| 6 | Utils/NoteSerializer.cs |
BinaryFormatter insecure deserialization | Lab 04 |
- AI-assisted secure REST API development (C#)
- Azure Key Vault + Managed Identity integration
- STRIDE threat modelling applied to a real app
- OWASP Top 10 identification and remediation
- GitHub Actions pipeline with Semgrep + OWASP Dependency-Check gates
- FluentValidation, JWT security, safe error handling
Participants leave with:
- A working, deployed SecureNotes API on Azure App Service
- A fully configured GitHub Actions security pipeline
- A reusable secure prompt library (from
prompts.mdfiles) - Completed
prompt-log.mdfiles documenting every AI interaction - A 10-rules security takeaway card
- All AI-generated code must be reviewed before production use
- The starter repo contains deliberate vulnerabilities — do not deploy the starter to production
- Solution branches are available per lab:
lab02-complete,lab03-complete, etc.
This program can be tailored for:
- Organisation-specific codebases and internal frameworks
- Azure, AWS, or GCP cloud environments
- Specific compliance requirements (ISO 27001, SOC 2, PCI-DSS)
The future of secure development is not writing more secure code — it is designing better, safer instructions.