We’ll consider simplicity from a number of viewpoints, including essential versus accidental complexity, value demand versus failure demand, simple versus simplistic.

We’ll also look at typical sources of complexity in our coding habits, along with code examples in various languages.

We'll see that many practices and approaches can be used both to simplify and to complicate. It's all in knowing how and when versus how not to and when not to use them. For example, we can encourage reuse through code libraries, platforms and services, but we can also make an architecture needlessly complex and draw in unnecessary dependencies, with implications for maintainability and security. Similarly, AI assistance can be employed to make code simpler and easier to work with but, without attention and guidance, it can make things more complicated and harder in the long run, becoming a new source of legacy.

We’ll explore verbose and convoluted code, the effect of programming paradigm and how we can turn down the imperative noise of many languages and styles with declarative techniques.

We'll talk about what we might (or might not) mean by clean code, and whether that's a helpful approach.

We'll learn it’s not just in our programming and languages where we find complexity: our development processes, tools, architectures and organisational cultures can often encourage unnecessary complexity, costing us time, effort and opportunity where simplicity would have had the opposite effect. Suffering from heavy Agile™ ceremony? Too much certification and not enough action? That.

We’ll look at how we can work with incomplete knowledge without adding speculative complexity of so-called future proofing.

We’ll acknowledge technical debt and neglect for what they are and understand why legacy is so often the opposite of simple, no matter what its backstory or business value. We want to make sure that as well as recognising unnecessary complexity in the small and the large, that we also have an idea of the practices that can help with simplification.


As well as presenting concepts, examining themes and considering code, this masterclass will also offer plenty of opportunity for questions and discussion, plus some hands-on refactoring exercises (options will be available in different programming languages).

What kinds of complexity do we find in software systems?

What are the costs of accidental complexity in code and architecture?

Where does complexity appear in our organisations and processes?

The technical debt consequences of long-term technical neglect

Refactoring as an act of simplification, discovery and evolution

The role of testing in keeping code, architecture, delivery and life simple

How to be the human in the loop when working with AI code generation

Programming paradigms and their effect on complexity

Declarative programming versus imperative programming

Keeping code, architecture and development process lean

2 Days

14-15 Sept

Keeping It Simple

.NET

Agile

Architecture

Functional Programming

JavaScript

Testing

Work skills

In 2025, one AI builder reproduced the same insecure defaults across 170 independent applications — not because 170 developers made the same mistake, but because one model did, at scale, and nobody stopped to check.

This is two-day workshop on vibe coding security. Day 1 teaches you to build security into how you prompt, review, and test AI-generated code — so the vulnerabilities do not ship in the first place. Day 2 turns the lens on your tools: how attackers exploit AI coding assistants, MCP servers, and agentic workflows to compromise your development environment, and how to stop them. Both days are hands-on throughout, with labs on the SecDim platform.

We finish with a high-energy attack and defence secure coding wargame. Plenty of learning and fun, guaranteed.

Module 1 — What Is Vibe Coding and Why Security Gets Left Behind


Real incidents, real code, real consequences. This module makes the case that what happened to those 170 applications was not bad luck — it was predictable. It sets the threat model for the rest of the day and establishes what a developer actually needs to change to close the gap.


AI does not make random mistakes. It repeats the same ones. This module shows which vulnerability classes appear most consistently in AI-generated code, why they appear, and why that predictability is actually useful — once you know what to look for.

Module 3 — Secure Design Before You Prompt


The most effective place to catch a vulnerability is before you write the first prompt. This module gives you a structured way to think about threats at the design stage and turn them into constraints that shape what the AI builds.
LAB: Threat analysis on a user story


A prompt is a specification. What you leave out of it, the AI leaves out of the code. This module shows how to carry your threat analysis into the prompt itself, so that security requirements are built in from the first line of generated code rather than patched in afterwards.
LAB: Rewrite insecure prompts with security constraints


AI-generated code looks polished. It passes functional tests. The reviewer's instinct is to approve it — and that instinct is wrong. This module teaches how to review AI output as an attacker would: what to look for, how to trace risk through a codebase, and how to turn your AI assistant into an adversary that finds what you missed.
LAB: Prompt Injection.ml, Prompt Injection2.ml, Prompt Injection3.ml

Module 6 — Security Tests AI Will Not Write


Ask AI to write tests and it writes tests that pass. It does not test what an attacker would do. This module covers the gap between the test suite your AI generates and the one that would catch a real exploit — and shows how to use AI to write the adversarial tests it would otherwise skip, starting from the test suite you already have.
LAB: Generate adversarial security tests from an existing test suite

Module 7 — Your Dev Toolchain Is an Attack Surface


AI coding assistants, chat interfaces, MCP servers, and autonomous agents each introduce a new attack surface — not in the application you are building, but in your own development environment. This module introduces the threat model for the modern AI-powered dev workflow and frames the rest of the day.

Module 8 — Prompt Injection in the Dev Toolchain


Attackers do not need to compromise your machine. They leave instructions where your AI will find them — and your AI follows those instructions. This module covers how that attack works against real developer workflows and what it takes to stop it.
LAB: Prompt injection in dev toolchain challenges


MCP servers connect your AI agent to live systems — filesystems, databases, APIs, and external services. That makes them high-value targets. This module covers the attack surface MCP introduces: how servers get weaponised, how your agent gets redirected, and how to evaluate and harden the MCP servers in your own workflow.
LAB: MCP Poison.ai, MCP Rug Pull.ai, MCP Line Jumping.ai, MCP Execution Hooking.ai, MCP Tool Collision.ai

Module 10 — Fuzzing: What It Is and Why It Finds What Everything Else Misses


Code review catches logic you can read. Tests catch behaviour you thought to specify. This module introduces a third approach that finds the vulnerabilities neither of those surfaces — the crashes, panics, and logic failures that only appear under inputs no developer would write by hand — and explains where it fits in the vibe coding workflow.


Writing the inputs that break software is time-consuming work. AI can do most of it. This module shows how to turn a test suite you already have into a fuzzer, use AI to generate the inputs most likely to surface real bugs, and wire the whole thing into a pipeline that runs without you. Learners leave with a working setup built from their own code.
LAB: Generate a fuzz harness using AI


A competitive attack and defence wargame where participants apply everything learned across both days. This is consistently rated the highlight of the workshop. Participants who place on the workshop leaderboard carry their score into the conference-wide competition, where the challenge continues with prizes.

Recognise why AI-generated code introduces the same vulnerabilities across every codebase, and why that predictability is something you can act on

Analyse a feature for threats before writing a prompt, and carry those threats into code generation as explicit security requirements

Review AI-generated code the way an attacker would — and use AI itself to find what a standard code review misses

Protect your development environment against the attacks that target AI coding assistants, MCP servers, and agentic workflows

Use AI to generate the security tests and fuzz inputs — and ship software that has actually been tested against an adversary

MacBook, Linux laptop, or Windows laptop with WSL/VM

Latest version of Firefox, Brave, or Chrome

Access to all theoretical and practical workshop content

Access to all labs and challenges locally and on the SecDim platform

2 months of additional self-paced labs on the SecDim wargame platform

Access to a private Q&A forum for post-workshop questions

Build Fast, Ship Secure: The Vibe Coder's Security Workshop

Security

This workshop is here to give you the skills you need to make your APIs secure. We're going to think like an attacker to test APIs and like a defender to figure out the best ways to protect them. With deep-dive talks, real-world demos, fun quizzes, and hands-on labs, you'll learn how to lock down your APIs.
During this hands-on training, we'll explore:

The security model of API-based web applications

Recognizing and addressing authorization failures

Understanding Broken Object Property Level Authorization (BOPLA)

Fixing Broken Object Level Authorization (BOLA)

Testing the security of APIs that use JWTs

Best practices for making JWTs secure in modern APIs

Identifying, exploiting, and fixing Server-Side Request Forgery (SSRF) issues

Understanding Cross-Origin Resource Sharing (CORS)

Configuring secure CORS policies for various use cases

Tracking user authentication securely with sessions or tokens

Relying on OAuth 2.0/2.1 for securing APIs

Q & A throughout the workshop to clear up any doubts


This workshop is about more than theory. We're all about giving you practical security tips you can use right away as an API developer. We dig into the root causes of API threats and how to handle them. We don't just skim the surface of problems and solutions - we get into the why's and how's, looking at common fixes, why some fall short, and which ones are currently the best way to go.
By the end of this workshop, you'll be up-to-speed on the best practices for API security. You'll also leave with a handy list of steps to check and boost the security of your applications.




This training is perfect for developers and architects who work a lot with APIs. If your role involves building, testing, or designing modern apps, this workshop will give you a thorough, up-to-date understanding of the best ways to keep things secure. We'll often use NodeJS, Flask, and Spring Boot in our code examples and demos, but you'll easily be able to apply what you learn to other languages and frameworks.




These testimonials from previous workshops give you a good idea of what to expect:

Trainer is great and an expert in the domain. All of the topics are very relevant. Practical examples for most of the topics. Excellent communication and addressing of questions.

Even though the topic is broad, there was no single moment where my focus went astray. Philippe talks in a way to keep you interested to listen to him.

I liked the the pleasant and relaxed way of speaking and the fresh style of presentation of this kind of dry stuff :)

Philippe is a friendly and knowledgable trainer and delivered an interesting course that was well presented. Questions were answered promptly and in a detailed way.


To participate in this training, you should have some experience with building API-based applications. Knowledge of application security can be helpful, but is not required.




To participate in the lab sessions, participants need a computer with a full-featured modern browser installed (preferably Chrome).


Bulletproof APIs: Hands-On API Security

In this two-day class, you'll learn about the challenges of distributed systems, and what you can do to create software that is much more likely to work when users need it to.

Whether you're building a fine-grained microservice architecture, or a more monolithic distributed system, you'll learn concrete practices to help make your software more robust.

This is not a coding masterclass, but it is interactive. This is a class about concrete practice, but presented in a technology agnostic way.




Each class is different, with the attendees shaping what content we will cover in each class, but expect to cover:

Resilient Distributed Systems

Most software starts out pretty simple: front end, back end, maybe a database, and you’re done. Then the client wants an API, a mobile app, notification emails, realtime chat; cloud gives you elastic hosting, apps that dynamically scale based on workload and traffic, and if you’re just starting out with distributed systems design, the possibilities can be overwhelming. APIs, message queueing, REST, GraphQL, gRPC… what should you choose, how does it work, how do you get started?

This workshop gives you a hands-on introduction to the most important messaging patterns used in modern application development. Using C# and .NET, we’ll build a series of small example apps and services, wire them together using these patterns, and discuss how - and why - you’d apply the same patterns in your own applications.


Working with HTTP APIs: testing and tooling

Interactive documentation with OpenAPI and Swagger

Distributed queues with RabbitMQ and EasyNetQ

Contract-first development using protocol definitions

Integrating browsers with distributed systems

Adding instrumentation to your distributed apps

Principles of observability: spans, traces, metrics and logs


This workshop is aimed at developers with some experience writing applications using C# and Microsoft .NET. The workshop can be run in person or online. Attendees will be writing and running .NET code during the workshop, so will need a computer running Windows, macOS or Linux, and the Microsoft .NET 10 SDK from 

. The sample application and examples used during the workshop all run on .NET 10, and are tested on Linux, macOS and Windows.

Building Distributed Systems with .NET 10

To be fair, the people who abuse this term are also the people who probably fall under this category. I prefer “Agentic Programming” instead. I have pushed thousands of lines of code in production using agentic programming. Code that would have taken me months to write myself now takes merely days.

In this workshop, we’ll explore agentic programming as a disciplined engineering practice, not a toy.
Using Claude Code, I’ll show how to collaborate with AI agents to produce maintainable, reviewable, and production-ready code, without surrendering architectural control, correctness, or performance.

What Claude Code, Codex and Cursor are, how they work, and how you should use them

Designing clear agent boundaries and responsibilities.

How to turn vague intent into explicit, testable instructions.

Create plans that can run for hours on end, generating and testing code as they go.- Securing your agentic code

Much more (workshop contents are constantly updated as new models and tools are released)

This is not a “let the AI take the wheel” session. It’s about teaching the AI to work like a senior engineer, while you stay firmly in charge. If you believe AI coding tools are dangerous, flaky, or fundamentally incompatible with serious software engineering, then this workshop is for you.



A laptop with your favourite IDE installed

Vibe Coding for Production

In this workshop, we will dive deep into how .NET implements asynchronous programming under the hood to become experts using async/await!

Join me as we uncover the ways that the .NET compiler modifies each of our async methods. We'll learn how to build a custom implementation of `Task` from scratch and use it with the built-in async/await keywords. Then we'll dive deep into the .NET source code to understand the importance of internal framework tools like SynchronizationContext, ExecutionContext, Principal, ThreadStatic and more!


C# Developers who have used async/await but don’t yet know how it works under the hood

Become an Expert with Async/Await in C#

Concurrency

Programming Languages

Day 1: Build an Enemy with Real Game AI
Day 2: Build a Physics-Driven Weapon System

Most developers use game engines.
In this workshop, we crack one open and start hacking the systems that make it work.

Over two creative days, we extend a custom-built .NET 3D engine powering The Omega Strain — not by importing packages, but by writing real game systems ourselves.

No Unity.
No Unreal.
No physics middleware.

Just vectors, delta time, collision boxes, gravity, and code.




We design and implement a new enemy from scratch. Using state machines, distance checks, spatial awareness, and real-time updates, we build AI that reacts inside a running engine.



 
We build a weapon system with real 3D trajectory physics — velocity vectors, normalization, ballistic motion, gravity, collision detection, and impact handling.

This workshop is not about building a AAA game.
It’s about understanding what game engines actually do — by building the moving parts yourself.

If you love games, this workshop will show you what really happens under the hood — and even if you build APIs for a living, it will sharpen your understanding of real-time systems, architecture under constraints, and how physics, state, and performance interact in complex software.



C# developers curious about game engine internals, real-time systems, and performance-driven architecture.




Basic C# knowledge recommended. No prior game development experience required.

Build a 3D Game System from Scratch (No Engine Required)

Gaming

3D Modeling

Two-day training session on AI agents, MCP, and Skills facilitated by Aleksander Stensby from GritAI. This training gives you the foundation to build MCP servers and MCP Apps, reusable agent skills, and wire everything into capable autonomous agents that actually work.

This hands-on workshop will equip you with practical skills to build your own MCP servers, CLI tool wrappers, and interactive MCP Apps — and then go further by creating reusable skills that turn simple tool-calling agents into capable, autonomous systems. You'll leave with a working agent powered by tools and skills you built yourself.

Day 1: Context & Connectivity — MCP Servers, Apps & Tools

Introduction to the AI agent stack: LLMs in a loop with tools and why context is king

Core MCP concepts: Host/client/server architecture, tools, resources, and prompts

Building a working local MCP server (Python or TypeScript)

MCP Apps: Adding interactive UI components to your MCP Server

CLI tools with direct API access as an alternative and complement to MCP

Hands-on exercises: Build an MCP server, extend it with an MCP App

What skills are and why they're the missing layer in most agent setups

Skills vs. tools vs. prompts: Understanding the capability stack

The skill creator pattern: Using AI to capture and formalise skills from workflows

Workflow capture: Turning expert knowledge into reusable agent skills

Agentic loop architecture: How LLMs, tools, and skills combine across frameworks

Provider-agnostic patterns: Claude, OpenAI, Gemini and beyond

Final exercise: Building a capable agent combining MCP tools and custom skills

Basic Python or JavaScript programming knowledge

Familiarity with AI/ML concepts (helpful but not required)

Laptop with necessary development environment

This training is targeted at developers and people with a medium+ technical skill level and interest for AI.



Bring your laptop with your preferred IDE and either Python or Node installed. We recommend an AI coding agent like Claude Code, Cursor, or GitHub Copilot.
Bring your favorite sauce! You need access to an LLM provider like Anthropic, OpenAI or Azure Foundry, but you can also use Ollama if you would like to run everything locally and free. Claude Code is highly recommended and will be used for a lot of the demonstrations during the workshop.

Context and Skills Are All Your Agent Needs

In this hands-on workshop, you'll build AI agents that can reason about data, use tools, and hold meaningful conversations.

You'll create a personal finance assistant. An agent that understands natural language, retrieves transaction data, maintains memory across conversations, and helps users make better financial decisions.




- Working with Large Language Models: LLM fundamentals, prompt engineering basics, and raw API calls without abstractions.
- Calling AI services from C#.
- Tool calling: Giving agents the ability to take actions and retrieve external data.
- Reasoning loops: How agents think, plan, and iterate.
- Memory and context management: Maintaining state across conversations.

We'll use Azure AI services throughout the workshop, but the patterns and code apply to other providers like OpenAI, Anthropic, and Google.


By the end of this workshop, you'll have:


- A working AI agent integrated into a .NET backend
- Practical experience with tool use and memory
- A clear mental model for when agents add value versus simpler AI approaches
- Confidence to apply these patterns in your own applications


Yes, if you want to move beyond basic AI integration and build something that reasons. 


- Know how to build APIs with C#
- Have some exposure to AI concepts (prompts, completions, embeddings)
- Prefer learning by doing over slides and theory



- Your favourite IDE
- .NET 10
- Docker
- Git and a GitHub account
- An Azure account (expect around 5–10 € of usage)

Build Your First AI Agent in .NET

GenAI

This two-day deep-dive workshop is for developers, architects, and technical leaders who want to understand how enterprise AI systems are actually designed, delivered, and scaled in production.

You’ll learn how real-world solutions emerge from the combination of data platforms, agents, integration layers and governance—and why most teams fail by treating AI as an isolated application instead of a connected system.



We’ll walk through the full lifecycle of enterprise AI delivery:

selecting use cases that deliver real ROI (and avoiding “UAT purgatory”)

designing architectures across data, agents, integration, and experience layers

choosing between pro-code, low-code, and data-platform approaches

applying retrieval, knowledge, and semantic patterns effectively

embedding governance, evaluation, and safety from day one

Through architecture deep dives and live demos of emerging capabilities, you’ll gain a clear understanding of what to use, when, and why.

A key theme throughout the workshop is the shift in the developer role itself. Modern AI engineers are no longer just writing code—they are orchestrating intelligence across copilots, agents, data platforms, and enterprise systems.

By the end, you’ll leave with practical frameworks, architectures, and an opinionated view of how to build AI systems that are scalable, governed, and production-ready.

Designing Enterprise AI Systems: From Use Cases to Production Reality

Cloud

If you have ever been put off moving from HTTP or RPC-based solutions to messaging because of the need to learn how to implement messaging-based solutions, this workshop will get you started.

If you have been using messaging but want to gain a firmer understanding of how to build event driven architectures, this workshop will help you understand how to succeed with reactive approaches.

The material is presented in two parts: an introduction to using messaging middle-ware (including hands-on exercises in RabbitMQ and Kafka) and the fundamentals of how we construct event driven architectures.

Hands-on exercises are offered in C#, Java, JavaScript, Python and Go.

Topics covered will include:




- Distribution
- Integration Styles
- Messaging Patterns
- Queues and Streams
- Managing Asynchronous Architectures




- Flow
- Process Automation
- Control Flow
- Activities


We will use Rabbit MQ for examples. You need not have the latter installed on your machine, but you should have Docker installed on your machine, as exercises will use Docker Compose.

This is a Bring Your Own Device (BYOD) course. At BYOD courses delegates are required to bring their own laptop with the necessary software installed.

The exercises are self-paced and you will find it helpful to have headphones to listen to the material that accompanies each exercise (though scripts are provided for those who cannot use headphones).

Practical Messaging

DevOps

Microservices

What are the different architectures? Why should we choose one over the other? Or should we choose a combination of them for some applications? How do we make such decisions? What should be the process or the approach that will lead us towards selecting a more suitable or appropriate architecture, one that comes from proper analysis rather than infatuation or desire to build something because that's seems to be the current trend.


In this workshop, we will take a very systemic approach to going from requirements to choosing suitable architectures. We will cover the following topics, not by simple talking about these, but by way of hands-on exercises and interactive and collaborative sessions:

- Challenges with selecting Architectures
-  Functional and non-functional requirements
- Evaluating trade offs
- Methodical Mapping from requirements to patterns
- Architectural Patterns
- Underpinnings of monoliths and distributed architectures
- Hands-on exercises to analyze application requirements
- Groups labs to evaluate the architectural patterns for different application characteristics
- Using AI to assist with requirements analysis
- Cautiously Using AI to guide along the selection process
- Next steps beyond choosing architecture




- Senior programmers
- Team leads*Architects
- Technical managers and directors

A git client to access a git repository (details will be provided at the start of the workshop)

Your favorite text editor to create and edit text files

 Access to any AI tool like ChatGPT, Claude, etc. for part of the workshop when we will involve AI



Dr. Venkat Subramaniam is an award-winning author, founder of Agile Developer, Inc., an instructional professor at the University of Houston, and creator of the dev2next and Arc of AI conferences.
He has trained and mentored thousands of software developers in the US, Canada, Europe, Asia, and Africa, and is a regularly-invited speaker at several international conferences. Venkat helps his clients effectively apply and succeed with sustainable agile practices on their software projects.
Venkat is a (co)author of multiple technical books, including the 2007 Jolt Productivity award winning book Practices of an Agile Developer. You can find a list of his books at <

Architectural Patterns: Common Solutions for Building Large Scale Systems

Creating new apps with Aspire is an easy process, but adding Aspire to existing apps can be overwhelming - especially if you want to take advantage of all of Aspire's features. Maddy, Aspire PM, has Aspirified hundreds of apps, and is bringing a slightly-more-structured version of the process to a workshop format.


This workshop will be interactive and adapt to the attendees - bring any codebase you want, and work through Aspirification in your real usecase. We will cover the basics of Aspire, how to Aspireify apps for both local dev and deployment, and deep dive into customizations based on the attendees requests. Both days will also include some unstructured exploration time where you can work on your Aspirification with Maddy and the Aspire team's guidance.

Aspireify your Stack

Tools

Modern application design is more complex than it was a decade or two ago. A modern application is expected to be mobile-first and cloud-based. Microsoft’s answer to these demands was to create ASP.NET Core. A decade later, ASP.NET Core has matured into a trusted development platform covering all components needed in a modern application architecture.

Multi-platform, microservices, multi-client, and highly-mobile users bring a set of challenges that were not present a decade ago. A modern application cannot be secured just by handling access control in the single UI of the application, because there is no longer any single UI. There are web applications, mobile apps and APIs that are exposed to partners and third-party developers. Internally, an application often consists of multiple microservices calling each other. These services are also frequently reused between different applications and externally visible APIs.

To properly secure this landscape, a zero-trust approach is required. There should be a verifiable proof of the end user (or end machine) identity for any user session established or API.

This workshop is your chance to dive into all these security-related technologies. Learn how to securely connect native and browser-based applications to your back-ends and integrate them with enterprise identity management systems as well as social identity providers and services.

After attending this workshop you will have a good understanding of the concepts and will be ready to start implementing a modern identity and access management solution tailored to your organization’s needs.

The ASP.NET Core Authentication and Authorization System Design Principles.

How to use external authentication and offer single sign-on and single logout.

How to securely call APIs on behalf of the authenticated user.

The principles of the OpenID Connect and OAuth 2.0 Protocols.

An overview on how to configure, customize, and deploy Duende IdentityServer.

Day 2: OpenID Connect (OIDC) & OAuth 2.0

Token Lifetime Management & Refresh Tokens


Attendees will need to bring a computer with the latest .NET Core SDK and the IDE of their choice (e.g. Visual Studio) installed.

NDC { Oslo }

Workshops

09:00 - 17:00 (UTC+02)

Vibe Coding for Production

Nick Chapsas

Context and Skills Are All Your Agent Needs

Aleksander Stensby

Bulletproof APIs: Hands-On API Security

Philippe De Ryck

Architectural Patterns: Common Solutions for Building Large Scale Systems

Venkat Subramaniam

Practical Messaging

Ian Cooper

Building Distributed Systems with .NET 10

Dylan Beattie

Become an Expert with Async/Await in C#

Brandon Minnick

Build a 3D Game System from Scratch (No Engine Required)

Jarle Adolfsen

Designing Enterprise AI Systems: From Use Cases to Production Reality

Adam Stephensen

Linux Security and Isolation APIs Fundamentals

Michael Kerrisk

Aspireify your Stack

Maddy Montaquila

Keeping It Simple

Kevlin Henney

Identity & Access Control for modern Applications and APIs using ASP.NET 10

Anders Abel

Resilient Distributed Systems

Sam Newman

Build Your First AI Agent in .NET

Gui Ferreira

Build Fast, Ship Secure: The Vibe Coder's Security Workshop

Pedram Hayati

Davide Cioccia