I recommend teaching them web app security (CRSF, SQL injection, etc).