Haven’t used them myself, but I see https://www.securecodewarrior.com mentioned, aim is to teach developers and seems engaging.