Projects

FauxVault

A purposely-vulnerable banking web application built for hands-on security training. Ten toggleable OWASP Top 10 vulnerabilities, switchable between hardened and vulnerable states in real time.

Existing security training platforms don't let learners isolate individual vulnerabilities or practice against a realistic dual attack surface, web UI and REST API. FauxVault addresses both: a fully functional banking portal where any of ten OWASP Web/API Top 10 vulnerabilities can be toggled on or off per module, in real time, per user.

Infrastructure and two vulnerability modules. I provisioned and configured the AWS EC2 host, security groups, and Docker deployment, and built the GitHub Actions CI/CD pipeline using OIDC federation between GitHub Actions and AWS IAM, deploying over AWS Systems Manager instead of SSH. I also implemented the Verbose Errors module and the Excessive Data Exposure / Mass Assignment module.

React/Vite and MUI on the frontend, Express.js on the backend, PostgreSQL with Row Level Security, three-service Docker Compose stack behind nginx, deployed on AWS EC2.

The original deploy plan used SSH; that got scrapped over credential-exposure risk and replaced with the OIDC/SSM approach above. A planned RDS migration got dropped when credits ran out, and containerized Postgres turned out to be the better call anyway. The original toggle design was global before being redesigned to per-user, session-local state once concurrent testing exposed the conflict.

Additional modules covering file upload vulnerabilities and command injection, plus broader adversarial test coverage.