SecureSphere: secure web app and security lab
2026Security
A full-stack app built to show secure development in practice: Argon2id auth, server-side sessions, role-based access, an append-only audit trail and a lab comparing vulnerable and secure code.
Problem
Security is usually taught as a list of rules. It is much harder to see what a real injection or broken access check looks like next to the fix, running against a real API.
Solution
SecureSphere is a real application, not a mock. Users register with live password guidance, sign in with Argon2id-hashed passwords, and manage their own sessions, which are server-side, stored as hashes and rotated on every password change. CSRF tokens protect every form, and accounts lock after repeated failed sign-ins. Admins manage users, roles and lockouts through audited, confirmed actions, and a security monitor filters the append-only audit trail by type, severity and outcome. A built-in lab runs SQL injection, XSS, password hashing, input validation and authorisation demos against the API, side by side with the secure version. The stack is React 19 and TypeScript on the front end and FastAPI, SQLAlchemy and PostgreSQL on the back end.
Outcome
The project ships with a written threat model and security policy, 67 backend and 21 frontend tests, and a CI pipeline that runs Ruff, Bandit and pip-audit. It runs with Docker Compose behind an unprivileged nginx, or locally on SQLite with one click.