Cyber Security Projects (Real Vulnerabilities, Real Portfolio)

The best security projects are real vulnerabilities you find and fix, not write-ups you read. These are real vulnerable systems you harden in a live cloud workspace - close a SQL injection, fix broken auth, scrub a secret from git - each one a portfolio piece.

Why fixing beats reading

Reading about a vulnerability is not the same as closing one under real constraints. Doing it builds the judgment security roles hire for, and gives you proof you did it.

18 projects to start with

Secure a Webhook Endpoint (HMAC + Replay)Security · Senior Move JWT to httpOnly Cookies (XSS + CSRF)Security · Senior Patch the JWT None-Algorithm BypassSecurity · Mid Build API Key AuthenticationSecurity · Mid Implement OAuth 2.0 With PKCESecurity · Mid Migrate MD5 Password Hashes to bcryptSecurity · Mid Rotate a Leaked JWT Secret Without LogoutSecurity · Mid Move a Plaintext Secret to AWS Secrets ManagerSecurity · Mid Scope an AWS KMS Key Policy to One RoleSecurity · Mid Fix an IDOR Exposing Other Users' InvoicesSecurity · Mid Block an SSRF in a URL FetcherSecurity · Mid Close a SQL Injection in a Search EndpointSecurity · Junior Neutralize a Stored XSS in CommentsSecurity · Junior Remove Hardcoded Credentials From Source CodeSecurity · Junior Hash Passwords Instead of Storing PlaintextSecurity · Junior Stop Login Brute-Force With Rate LimitingSecurity · Junior Block a Path Traversal VulnerabilitySecurity · Junior Close an Open Redirect VulnerabilitySecurity · Junior

Pick by the area to show

Web appsec? The injection and access-control ones. Secrets and crypto? The hashing and history-scrub ones. Each finished fix is evidence on your portfolio.

Build your portfolio free. You are in a real cloud workspace in 30 seconds - fix real systems, show real work.

Start free →