I think https://www.cybrary.it/ is pretty good for free lessons. You can combine it with VMs like https://www.offensive-security.com/metasploit-unleashed/requ... and those from https://www.vulnhub.com/ for a bit of hands-on. Also, you can get a lot of information specific to your language, like http://guides.rubyonrails.org/security.html and https://github.com/presidentbeef/brakeman to look at real apps, to see what can go wrong.