This workshop is here to give you the skills you need to make your APIs secure. We're going to think like an attacker to test APIs and like a defender to figure out the best ways to protect them. With deep-dive talks, real-world demos, fun quizzes, and hands-on labs, you'll learn how to lock down your APIs.
During this hands-on training, we'll explore:

The security model of API-based web applications

Recognizing and addressing authorization failures

Understanding Broken Object Property Level Authorization (BOPLA)

Fixing Broken Object Level Authorization (BOLA)

Testing the security of APIs that use JWTs

Best practices for making JWTs secure in modern APIs

Identifying, exploiting, and fixing Server-Side Request Forgery (SSRF) issues

Understanding Cross-Origin Resource Sharing (CORS)

Configuring secure CORS policies for various use cases

Tracking user authentication securely with sessions or tokens

Relying on OAuth 2.0/2.1 for securing APIs

Q & A throughout the workshop to clear up any doubts


This workshop is about more than theory. We're all about giving you practical security tips you can use right away as an API developer. We dig into the root causes of API threats and how to handle them. We don't just skim the surface of problems and solutions - we get into the why's and how's, looking at common fixes, why some fall short, and which ones are currently the best way to go.
By the end of this workshop, you'll be up-to-speed on the best practices for API security. You'll also leave with a handy list of steps to check and boost the security of your applications.




This training is perfect for developers and architects who work a lot with APIs. If your role involves building, testing, or designing modern apps, this workshop will give you a thorough, up-to-date understanding of the best ways to keep things secure. We'll often use NodeJS, Flask, and Spring Boot in our code examples and demos, but you'll easily be able to apply what you learn to other languages and frameworks.




These testimonials from previous workshops give you a good idea of what to expect:

Trainer is great and an expert in the domain. All of the topics are very relevant. Practical examples for most of the topics. Excellent communication and addressing of questions.

Even though the topic is broad, there was no single moment where my focus went astray. Philippe talks in a way to keep you interested to listen to him.

I liked the the pleasant and relaxed way of speaking and the fresh style of presentation of this kind of dry stuff :)

Philippe is a friendly and knowledgable trainer and delivered an interesting course that was well presented. Questions were answered promptly and in a detailed way.


To participate in this training, you should have some experience with building API-based applications. Knowledge of application security can be helpful, but is not required.




To participate in the lab sessions, participants need a computer with a full-featured modern browser installed (preferably Chrome).


2 Days

14-15 Sept

Bulletproof APIs: Hands-On API Security

Security

Most software starts out pretty simple: front end, back end, maybe a database, and you’re done. Then the client wants an API, a mobile app, notification emails, realtime chat; cloud gives you elastic hosting, apps that dynamically scale based on workload and traffic, and if you’re just starting out with distributed systems design, the possibilities can be overwhelming. APIs, message queueing, REST, GraphQL, gRPC… what should you choose, how does it work, how do you get started?

This workshop gives you a hands-on introduction to the most important messaging patterns used in modern application development. Using C# and .NET, we’ll build a series of small example apps and services, wire them together using these patterns, and discuss how - and why - you’d apply the same patterns in your own applications.


Working with HTTP APIs: testing and tooling

Interactive documentation with OpenAPI and Swagger

Distributed queues with RabbitMQ and EasyNetQ

Contract-first development using protocol definitions

Integrating browsers with distributed systems

Adding instrumentation to your distributed apps

Principles of observability: spans, traces, metrics and logs


This workshop is aimed at developers with some experience writing applications using C# and Microsoft .NET. The workshop can be run in person or online. Attendees will be writing and running .NET code during the workshop, so will need a computer running Windows, macOS or Linux, and the Microsoft .NET 10 SDK from 

. The sample application and examples used during the workshop all run on .NET 10, and are tested on Linux, macOS and Windows.

Building Distributed Systems with .NET 10

.NET

To be fair, the people who abuse this term are also the people who probably fall under this category. I prefer “Agentic Programming” instead. I have pushed thousands of lines of code in production using agentic programming. Code that would have taken me months to write myself now takes merely days.

In this workshop, we’ll explore agentic programming as a disciplined engineering practice, not a toy.
Using Claude Code, I’ll show how to collaborate with AI agents to produce maintainable, reviewable, and production-ready code, without surrendering architectural control, correctness, or performance.

What Claude Code is, how it works, and how you should use it.

Designing clear agent boundaries and responsibilities.

How to turn vague intent into explicit, testable instructions.

Create plans that can run for hours on end, generating and testing code as they go.

This is not a “let the AI take the wheel” session. It’s about teaching the AI to work like a senior engineer, while you stay firmly in charge. If you believe AI coding tools are dangerous, flaky, or fundamentally incompatible with serious software engineering, then this workshop is for you.



A laptop with your favourite IDE installed

Node (we will also cover .NET, but it is optional)

Vibe Coding for Production

In this workshop, we will dive deep into how .NET implements asynchronous programming under the hood to become experts using async/await!

Join me as we uncover the ways that the .NET compiler modifies each of our async methods. We'll learn how to build a custom implementation of `Task` from scratch and use it with the built-in async/await keywords. Then we'll dive deep into the .NET source code to understand the importance of internal framework tools like SynchronizationContext, ExecutionContext, Principal, ThreadStatic and more!


C# Developers who have used async/await but don’t yet know how it works under the hood

Become an Expert with Async/Await in C#

Concurrency

Programming Languages

Day 1: Build an Enemy with Real Game AI
Day 2: Build a Physics-Driven Weapon System

Most developers use game engines.
In this workshop, we crack one open and start hacking the systems that make it work.

Over two creative days, we extend a custom-built .NET 3D engine powering The Omega Strain — not by importing packages, but by writing real game systems ourselves.

No Unity.
No Unreal.
No physics middleware.

Just vectors, delta time, collision boxes, gravity, and code.




We design and implement a new enemy from scratch. Using state machines, distance checks, spatial awareness, and real-time updates, we build AI that reacts inside a running engine.



 
We build a weapon system with real 3D trajectory physics — velocity vectors, normalization, ballistic motion, gravity, collision detection, and impact handling.

This workshop is not about building a AAA game.
It’s about understanding what game engines actually do — by building the moving parts yourself.

If you love games, this workshop will show you what really happens under the hood — and even if you build APIs for a living, it will sharpen your understanding of real-time systems, architecture under constraints, and how physics, state, and performance interact in complex software.



C# developers curious about game engine internals, real-time systems, and performance-driven architecture.




Basic C# knowledge recommended. No prior game development experience required.

Build a 3D Game System from Scratch (No Engine Required)

Gaming

3D Modeling

This hands-on workshop will equip you with practical skills to implement your own MCP servers, clients, and MCP-enabled knowledge bases — and build interactive AI applications that connect your organizational knowledge to advanced AI models in a controlled, secure manner.

Day 1: Foundations — Servers & Knowledge

Introduction to Model Context Protocol and its business applications

Core MCP concepts: Server/client architecture, agents, resources, and tool calling

RAG fundamentals and architecture patterns

Hands-on exercises: Building a local MCP server and RAG pipeline

MCP Apps: Creating interactive AI-powered applications

MCP Clients: Building your own host applications

Deployment options: Remote MCPs, Cloud providers and hosting alternatives

Preparing for production: Security considerations and optimization strategies

Final exercise: Building an MCP App that exposes your knowledge base

Basic Python or JavaScript programming knowledge

Familiarity with AI/ML concepts (helpful but not required)

Laptop with necessary development environment

This training is targeted at developers and people with a medium+ technical skill level and interest for AI.



Bring your laptop with your preferred IDE and either Python or Node installed. We recommend an AI-coding agent like Claude Code, Cursor or GitHub Copilot, but not required!


 
You need access to an LLM provider with an embedding model like OpenAI or Azure Foundry, but you can also use Ollama if you would like to run everything locally and free.

Context Is King: Building AI Apps with MCP & RAG

If you have ever been put off moving from HTTP or RPC-based solutions to messaging because of the need to learn how to implement messaging-based solutions, this workshop will get you started.

If you have been using messaging but want to gain a firmer understanding of how to build event driven architectures, this workshop will help you understand how to succeed with reactive approaches.

The material is presented in two parts: an introduction to using messaging middle-ware (including hands-on exercises in RabbitMQ and Kafka) and the fundamentals of how we construct event driven architectures.

Hands-on exercises are offered in C#, Java, JavaScript, Python and Go.

Topics covered will include:




- Distribution
- Integration Styles
- Messaging Patterns
- Queues and Streams
- Managing Asynchronous Architectures




- Flow
- Process Automation
- Control Flow
- Activities


We will use Rabbit MQ for examples. You need not have the latter installed on your machine, but you should have Docker installed on your machine, as exercises will use Docker Compose.

This is a Bring Your Own Device (BYOD) course. At BYOD courses delegates are required to bring their own laptop with the necessary software installed.

The exercises are self-paced and you will find it helpful to have headphones to listen to the material that accompanies each exercise (though scripts are provided for those who cannot use headphones).

Practical Messaging

DevOps

Architecture

Microservices

What are the different architectures? Why should we choose one over the other? Or should we choose a combination of them for some applications? How do we make such decisions? What should be the process or the approach that will lead us towards selecting a more suitable or appropriate architecture, one that comes from proper analysis rather than infatuation or desire to build something because that's seems to be the current trend.


In this workshop, we will take a very systemic approach to going from requirements to choosing suitable architectures. We will cover the following topics, not by simple talking about these, but by way of hands-on exercises and interactive and collaborative sessions:

- Challenges with selecting Architectures
-  Functional and non-functional requirements
- Evaluating trade offs
- Methodical Mapping from requirements to patterns
- Architectural Patterns
- Underpinnings of monoliths and distributed architectures
- Hands-on exercises to analyze application requirements
- Groups labs to evaluate the architectural patterns for different application characteristics
- Using AI to assist with requirements analysis
- Cautiously Using AI to guide along the selection process
- Next steps beyond choosing architecture




- Senior programmers
- Team leads*Architects
- Technical managers and directors



Dr. Venkat Subramaniam is an award-winning author, founder of Agile Developer, Inc., an instructional professor at the University of Houston, and creator of the dev2next and Arc of AI conferences.
He has trained and mentored thousands of software developers in the US, Canada, Europe, Asia, and Africa, and is a regularly-invited speaker at several international conferences. Venkat helps his clients effectively apply and succeed with sustainable agile practices on their software projects.
Venkat is a (co)author of multiple technical books, including the 2007 Jolt Productivity award winning book Practices of an Agile Developer. You can find a list of his books at <

NDC { Oslo }

Workshops

09:00 - 17:00 (UTC+02)

Vibe Coding for Production

Nick Chapsas

Context Is King: Building AI Apps with MCP & RAG

Aleksander Stensby

Bulletproof APIs: Hands-On API Security

Philippe De Ryck

Architectural Patterns: Common Solutions for Building Large Scale Systems

Venkat Subramaniam

Practical Messaging

Ian Cooper

Building Distributed Systems with .NET 10

Dylan Beattie

Become an Expert with Async/Await in C#

Brandon Minnick

Build a 3D Game System from Scratch (No Engine Required)

Jarle Adolfsen