Security Engineering Projects
Every project below is a real security problem teams hit in production - injection, weak auth, leaked secrets, exposed endpoints. Find it and secure it in a live cloud workspace, and it lands on your portfolio.
Get started - freeLive cloud workspace in your browser · nothing to install
31 projects to build
Close a SQL Injection in a Search EndpointReplaced f-string SQL with parameterized queries (cursor.execute with %s placeholders), neutralizing the OR-1=Neutralize a Stored XSS in CommentsEscaped HTML entities on every comment before injection so <script> tags and onerror= handlers render as literRemove Hardcoded Credentials From Source CodeReplaced hardcoded DB password and API secret with os.environ reads - credentials no longer leak via repo acceHash Passwords Instead of Storing PlaintextSwitched /register to generate_password_hash() before storing, /login to check_password_hash() for verificatioStop Login Brute-Force With Rate LimitingAdded per-IP attempt tracking on /login - 5 failures in 60s returns 429 Too Many Requests, successful logins sBlock a Path Traversal VulnerabilityResolved the requested path with os.path.realpath() and rejected anything escaping the uploads directory - ../Close an Open Redirect VulnerabilityRestricted the redirect target to relative paths (starting with "/" but not "//") so phishing links pointing aForce HTTPS Redirects at the Nginx EdgeConfigured the port-80 server block to 301-redirect everything to https://$host$request_uri so plain HTTP neveRemove a Leaky Debug EndpointRemoved the /debug env-dump endpoint and flipped Flask off debug mode, eliminating the interactive debugger anHarden Session Cookie Security FlagsLoaded a strong secret_key from env and set HttpOnly + Secure flags on session cookies - forged sessions, JS cBuild an Input Validator for SQLi and XSSShipped a CLI validator with regex patterns that flag SQL injection (DROP, OR 1=1, UNION) and XSS (<script>, oLock Down a Public AWS S3 BucketDeleted an allow-all bucket policy and enabled all four BlockPublicAccess flags, closing the bucket to anonymoEnable Default Encryption on an AWS S3 BucketEnabled bucket-level default SSE-S3 (AES256) via `put-bucket-encryption` so every object written to the bucketBlock a Wildcard AWS IAM Trust PolicyReplaced the wildcard Principal on the cross-account role's trust policy with a specific account ARN so any AWScrub a Secret From Git HistoryUsed `git filter-branch` to drop `.env` (which had an `AWS_SECRET_ACCESS_KEY=...` line) from every commit in hFind Hardcoded API Keys With gitleaksUsed gitleaks to find the AWS / Stripe / Slack keys hardcoded in config.py and replaced them with os.environ.gSecure a Public S3 Bucket Leaking DataRemoved the public-read bucket policy on customer-data and added an aws_s3_bucket_public_access_block with allClose a Command Injection in a Diagnostics APIReplaced a shell-string subprocess call with an argument-list call so the path parameter can no longer inject Patch the JWT None-Algorithm BypassLocked jwt.decode to an explicit algorithms=["HS256"] allowlist so tokens forged with alg="none" or alg=HS256-Build API Key AuthenticationStood up an API-key system with SHA-256 hashed storage, X-API-Key middleware, per-key rate limiting, and creatImplement OAuth 2.0 With PKCEWrote the authorization-server side of the Auth Code + PKCE flow - verifies the code_verifier against the storMigrate MD5 Password Hashes to bcryptReplaced the MD5 password hashing in `auth.py` with bcrypt + per-user salt (cost factor 10), and added a transPatch a SQL Injection (OWASP)Replaced the string-concatenated SQL in /search with a parameterized psycopg2 call (cur.execute(sql, (param,))Rotate a Leaked JWT Secret Without LogoutAdded NEW_SECRET as the active signer and rewrote verify_jwt() to try NEW first then fall back to OLD - so alrMove a Plaintext Secret to AWS Secrets ManagerPulled `DB_PASSWORD` out of env into Secrets Manager and rewrote the app to fetch + cache it at boot, removingScope an AWS KMS Key Policy to One RoleReplaced the KMS key's "any principal in the account can decrypt" policy with a scoped policy that grants DecrFix an IDOR Exposing Other Users' InvoicesAdded a server-side ownership check so a user can only read their own invoices, closing an enumerable IDORBlock an SSRF in a URL FetcherAdded URL validation that blocks loopback, private, and link-local targets so the fetcher can no longer reach Secure a Webhook Endpoint (HMAC + Replay)Added Stripe-style HMAC-SHA256 signature verification + a ±5min timestamp window to the webhook ingress, rejecMove JWT to httpOnly Cookies (XSS + CSRF)Moved the JWT off `localStorage` (XSS-readable) into an httpOnly + SameSite=Strict + Secure cookie, and added Tighten Over-Permissive AWS IAM PoliciesScoped three wildcard IAM policies (api / worker / cron) to the exact actions + resource ARNs each role actual
Plus 8+ more Security projects in the workspace, with new ones added regularly.
More for Security engineers
Do real production work, free. Live cloud workspaces in your browser - every project you complete lands on your portfolio.
Get started - free