cybersecurity
Rollkeeper
A Flask student-records app with role-based access control, atomic audit logging, layered rate limiting, and a CI pipeline (Ruff/pytest/Bandit/pip-audit) -- not just a CRUD demo with security controls bolted on.
38/38
Automated tests passing (pytest)
0
Ruff lint issues (src + tests)
0
Bandit security scan issues (-ll, medium+ severity)
0
pip-audit known vulnerabilities (pinned dependencies)
25/25 passing
Project #13 Selenium E2E suite (real browser, live app)
Started as a single-admin Flask CRUD app for student records with a real secure-development baseline (hashed passwords, CSRF protection, input validation, secure cookies). Rebuilt with a deny-by-default RBAC system (Admin/Staff, re-checked from the database on every request via Flask-Login -- never cached in the session), an atomic append-only audit log (every mutation logs who/what/when/where/outcome in the same transaction, never logging credentials or tokens), structural mass-assignment prevention (the role field exists on exactly one admin-only form), layered anti-enumeration rate limiting (Flask-Limiter, per-IP and per-claimed-account), safe bounded search/sort/pagination, and a CI pipeline (Ruff, pytest, Bandit, pip-audit; GitHub Actions pinned to commit SHAs). 37 automated tests plus a live browser walkthrough verify the RBAC boundaries, an explicit privilege-escalation regression test, and transaction atomicity under a forced failure.