Security Project
A full, file-by-file security remediation of a deliberately vulnerable Node.js application. This project documents how real-world vulnerabilities are identified, exploited, and properly fixed — following modern secure coding practices.
OWASP Juice Shop is an intentionally insecure web application designed to simulate real-world vulnerabilities. In this project, I take a different approach: instead of just exploiting these flaws, I systematically fix them.
Each file in the backend is audited individually. For every vulnerable component, I:
The goal is not just to patch issues, but to understand how vulnerabilities interact and how they can be chained together in real attack scenarios. This includes testing with tools such as Burp Suite, Hydra, and hashcat, along with manual analysis of the TypeScript codebase.
Below are detailed audits of individual files. Each one represents a focused security analysis of a specific part of the application.
Many security exercises focus only on exploitation. This project goes further by demonstrating how to properly fix vulnerabilities in a maintainable and scalable way — which is what real-world engineering and security roles require.
It reflects a complete understanding of both offensive and defensive security practices.