ShieldSense

Trust · Authority · Speed

ShieldSense Cybersecurity Academy (SCA)

Start training
Enterprise training platformAfrica regulatory scenariosMission-ready delivery

Enterprise secure coding for payment, identity, and regulated workloads.

ShieldSense Cybersecurity Academy (SCA) extends globally proven secure development practices with mobile money, BVN/NIN, and USSD banking scenarios — built on battle-tested security frameworks for African financial and government teams.

Explore scenariosView curriculum

academy.boot()

region = "Nigeria"

accent = "#9BCF33"

tracks = ["mobile money", "BVN/NIN", "USSD"]

framework = "Battle-tested secure development"

3

Regulatory labs

100%

Enterprise ready

24/7

Team training

NDPA

Aligned content

Nigeria-specific scenarios

Hands-on labs for real banking and identity failure modes.

Transaction tampering

Fintech wallet

Fix the vulnerability in this mobile money transfer code

Validate account ownership, bind transfers to signed intents, and prevent client-side amount manipulation.

app.post("/transfer", async (req, res) => {
  const { fromWallet, toWallet, amount } = req.body;
  // Vulnerable: trusts client-supplied wallet and amount.
  await ledger.debit(fromWallet, amount);
  await ledger.credit(toWallet, amount);
  res.json({ status: "sent" });
});

Derive the source wallet from the authenticated session, enforce server-side limits, require idempotency keys, and sign the transfer intent before ledger mutation.

Sensitive data exposure

Identity API

Spot the BVN/NIN data leak in this API endpoint

Remove unnecessary identifiers from responses and add audit-safe masking for regulated data.

app.get("/customers/:id", async (req, res) => {
  const customer = await db.customer.find(req.params.id);
  // Vulnerable: leaks full BVN and NIN to any support role.
  res.json(customer);
});

Return only fields required by the caller's role, mask BVN/NIN, log purpose-bound access, and require step-up approval for full identity retrieval.

Session fixation

USSD banking

Prevent a USSD session hijack in this banking app

Tie USSD sessions to short-lived nonces and reject replayed menu transitions.

function continueSession(msisdn, sessionId, menuChoice) {
  const session = sessions.get(sessionId);
  // Vulnerable: session is not bound to phone number or nonce.
  return route(menuChoice, session.accountId);
}

Bind session IDs to MSISDN, rotate nonce per menu step, expire idle sessions quickly, and verify SIM-swap risk before high-value actions.

SCA Track 4 — Secure Code Developer

Four hands-on challenges synced to ShieldSense Cybersecurity Academy progress.

Launch a challenge below. When you mark it complete, progress reports to your SCA dashboard and counts toward SCSD certification eligibility.

Vulnerability Pattern Recognition

Launch challenge →

Mobile Money API Security (Nigeria-specific)

Launch challenge →

Cloud & CI/CD Security

Launch challenge →

Code Review Mastery

Launch challenge →

ShieldSense Certified Professional

Free SCA tracks lead to paid SCP certifications

Complete self-paced labs here, then validate your skills with timed SCP exams — SCSA, SCSD, SCIR, SCTH, SCCS, SCA, and SCAAA — with tamper-proof digital certificates.

Explore SCP Certifications →