SoundAdvice

SoundAdvice is a music advice forum where anyone can post a question and an admin approves it before it goes public. The forum itself is mostly a pretext: it needs accounts, roles, sessions, user-submitted HTML and file uploads, which makes it a realistic thing to attack. Every security control in it is hand-written. The platform runs on four packages, express, pg, bcrypt and dotenv, with sessions, CSRF tokens, the HTML sanitiser, the multipart file parser, rate limiting, password screening, encrypted email storage and a hash-chained audit log all built on Node's standard library. In a real product most of that would come from a library, but the point was to build each control and then try to break it, which is hard to do when the mechanism is hidden behind someone else's API.

This page is only an introduction. The README is where the project is actually documented with all the security implementations.

Security flyer

A two-page flyer explaining a selection of the security measures implemented in SoundAdvice to a non-technical reader, covering encryption at rest, the tamper-evident audit log, magic-byte file checks, least privilege and NIST password guidelines. It also carries the OWASP ZAP result: all 31 endpoints scanned, with 0 high-severity, 0 medium-severity and 0 confirmed vulnerabilities. The pages below are previews, so open the PDF to read it.

Read the details

Everything above is a summary. The README covers the full feature set, the five classic web vulnerabilities and how each is mitigated, the audit log design, the from-scratch multipart parser, and the separate attacker app used to verify the CSRF and cross-origin defences.