Find and fix vulnerabilities in a small app

#Brief

This project is for authorised, defensive learning only. Use the practice target provided, which is built to be tested, and never test systems you do not own or have written permission to test. You will build a small, deliberately insecure app (or start from a provided vulnerable sample you run locally), so you control the whole target.

#What to build

1. Write or obtain a small web app with at least five planted flaws: SQL injection, broken access control (an insecure direct object reference), weak password hashing, a command-injection sink and a missing authorisation check

2. For each, write a safe test against your local instance that demonstrates the issue, and record impact and an OWASP mapping

3. Fix each flaw with the correct secure pattern, one commit per fix

4. Add tests that fail before and pass after each fix

5. Add Bandit or Semgrep to CI and set it to fail on medium and high findings

#Deliverables

• Repository with app/, tests/, FINDINGS.md and .github/workflows/

#How it is graded

Reviewers check out the pre-fix commit, run the tests to see them fail, then check out the fixed version and see them pass.

#Stretch

Add a DAST scan (for example OWASP ZAP baseline) against your running app in CI.