<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Secure Coding Training

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js curriculum --language python --framework owasp` | Generate secure coding curriculum for Python developers |
| `node agent.js lab-setup --platform webgoat --vulnerabilities sqli,xss,xxe` | Configure hands-on lab environment with target vulnerabilities |
| `node agent.js assess --team backend --scan-results results.json` | Assess developer competency from SAST scan trends |
| `node agent.js ctf-design --difficulty intermediate --topics injection,auth` | Design CTF challenges for secure coding practice |

### Examples

```bash
# Generate secure coding curriculum for Python developers
node agent.js curriculum --language python --framework owasp

# Configure hands-on lab environment with target vulnerabilities
node agent.js lab-setup --platform webgoat --vulnerabilities sqli,xss,xxe

# Assess developer competency from SAST scan trends
node agent.js assess --team backend --scan-results results.json

# Design CTF challenges for secure coding practice
node agent.js ctf-design --difficulty intermediate --topics injection,auth
```

## External Tools

| Tool | Command | Purpose |
|---|---|---|
| Semgrep | `semgrep scan --config auto .` | Static analysis for training feedback |
| OWASP ZAP | `zap-cli quick-scan http://lab:8080` | Dynamic testing for lab validation |
| Secure Code Warrior | `scw-cli --report team-progress` | Developer training platform |

## Compliance Frameworks

| Standard | Training Requirement |
|---|---|
| OWASP Top 10 | Web application security risks classification |
| SANS CWE Top 25 | Most dangerous software weaknesses |
| CERT Secure Coding | Language-specific secure coding standards |
| NIST SP 800-64 | Security considerations in SDLC |
