Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
In YOUR OWN lab, stand up a deliberately-vulnerable practice app (e.g. OWASP Juice Shop or a sample you control — never a system you don't own). Identify real OWASP Top 10 issues — at minimum an injection flaw, a stored/reflected XSS, a broken-access-control issue, and weak authentication — and FIX each: parameterize queries, add context-aware output encoding + a CSP, enforce authorization server-side, and store passwords with a salted slow hash. Document each vulnerability, why it's exploitable (conceptually), and the remediation. No attacks outside your lab.
Correctly identifies and explains (conceptually) at least 4 distinct OWASP Top 10 issues in the lab app.
Each issue is actually fixed with the correct defense (parameterized queries, encoding+CSP, server-side authz, salted hashing).
Shows the fix works (the issue no longer reproduces in the lab); no regressions introduced.
Strictly confined to an owned/authorized lab; no third-party targets; responsible framing.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# Find & fix an intentionally-vulnerable app ## Goal In YOUR OWN lab, stand up a deliberately-vulnerable practice app (e.g. OWASP Juice Shop or a sample you control — never a system you don't own). Identify real OWASP Top 10 issues — at minimum an injection flaw, a stored/reflected XSS, a broken-access-control issue, and weak authentication — and FIX each: parameterize queries, add context-aware output encoding + a CSP, enforce authorization server-side, and store passwords with a salted slow hash. Document each vulnerability, why it's exploitable (conceptually), and the remediation. No attacks outside your lab. ## Acceptance criteria - [ ] Vulnerability analysis: Correctly identifies and explains (conceptually) at least 4 distinct OWASP Top 10 issues in the lab app. - [ ] Remediation: Each issue is actually fixed with the correct defense (parameterized queries, encoding+CSP, server-side authz, salted hashing). - [ ] Verification: Shows the fix works (the issue no longer reproduces in the lab); no regressions introduced. - [ ] Ethics & scope: Strictly confined to an owned/authorized lab; no third-party targets; responsible framing. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.