Software Developer Capstone: Fix It Properly

Programme overview

The capstone of the Software Developer track. You join the team that owns Kasuwa's refunds service, a small Python codebase with a Flask API and SQLite, whose tests all pass while customers, finance, the mobile team and a security review have reported six bugs between them. You'll triage them by harm, turn each report into a failing test, fix a kobo lost to floating point and an off-by-one return window, exploit and then close a SQL injection that leaks every customer's email, and stop double refunds and over-refunds with an idempotency key, a unique index and a transaction. Then you'll make the API return the right status code for every bad request, review a teammate's pull request with a hard-coded secret and a silent except, and ship the fixes through Git, CI and release notes. Every command runs in Colab, and every output in the lessons comes from running it.

Curriculum

1. 01The Codebase and the Bug List25 min

   • The codebase and the bug listJoin Kasuwa's refunds team, get the service running, read its code and its (passing) tests, and triage six bug reports by the harm each one does.
2. 02Reproduce Before You Fix25 min

   • Reproduce before you fixTurn bug reports into failing tests that state the right behaviour exactly, using the reporters' own examples, so you know the bug is real and will know when it's fixed.
3. 03Fix the Money and the Window25 min

   • Fix the money and the windowFix ISSUE-101 and ISSUE-103 at their root by keeping money in whole kobo with Decimal and explicit rounding, and by writing the window rule the way the policy states it. Then prove the fix with the tests from lesson 2.
4. 04Close the Security Hole25 min

   • Close the security holeShow exactly what the SQL injection in the order search can do, fix it with a parameterised query, prove the fix with tests that attack it, and see why input checks are a second layer, not the fix.
5. 05No Double Refunds30 min

   • No double refundsFix ISSUE-102 and ISSUE-105 where they belong, in the database layer. Add an idempotency key with a unique index, refund the delivery fee once, cap refunds at what was paid, and do the check and the write in one transaction.
6. 06A Stricter API30 min

   • A stricter APIFix ISSUE-106 and the API's other blind spots. Return the right status code with a clear message for every kind of bad request, validate every field before using it, and test each case through the Flask test client.
7. 07Reviewing a Pull Request25 min

   • Reviewing a pull requestReview a teammate's pull request that adds "express refunds". Run a small automated scan of the added lines, then read for what no scanner catches, and write a review that's specific, kind and blocks what must be blocked.
8. 08Ship It25 min

   • Ship itShip a fix the way a team does, with a branch, small commits, a pull request that CI must pass, a version tag and release notes. Then plan your final project, which brings every fix together in one repository.

Assessment and certificate

You are assessed with a final assessment (pass mark 60%) and a final project. Your certificate is awarded when you meet those requirements. Paying for the programme does not award it on its own.