Capstone project for Application Security for Developers
Secure the Partner app before the audit
A partner bank will audit the Partner app before connecting payments. Build a small practice copy of the Partner app's invoice API in Node (NestJS or Express) with login, search, and list and download invoices for a shop, starting from the unsafe patterns shown as the 'before' code in the lessons. Then review it as an auditor would: find the flaws, rate them consistently, fix the important ones with tests that would catch a regression, threat-model the payments feature the bank wants to connect, and add a CI pipeline that fails builds only for real risks. Everything runs on your own machine or in your own repository; never test anyone else's system.
What you hand in
- A findings report with severity ratings and evidence from your practice API
- Fixes as pull requests or commits, each with a test that fails before the fix and passes after
- A threat model for connecting payments: data-flow diagram, trust boundaries, STRIDE threats and mitigations
- A CI security pipeline (SAST, SCA, secret scanning) with documented thresholds and suppressions
Check your work
Tick each item when your project meets it. Be strict: this is the rubric the reviewer uses.
- Findings are reproducible from the report alone and rated with one consistent scale (for example CVSS or a written internal scale)
- The access-control fix checks ownership on the server for every invoice and is proven by a test where one shop cannot read another's invoice
- Injection fixes use parameterised queries and allow-lists instead of escaping or blocklists, with tests
- Sessions or tokens have expiry, audience and issuer checks and a revocation story, and passwords are stored with a slow salted hash
- The threat model draws trust boundaries and turns each important threat into a mitigation with an owner
- Dependencies are locked, scanned and documented in an SBOM, and no secret is committed
- Pipeline checks fail builds only for new, real, fixable risks, and every suppression has a reason, an owner and an expiry
0 of 7 checked
Model answer
The model answer opens once your capstone passes the review, so you can compare your work with an outline of a strong submission.
Hand in your capstone
Your links are checked automatically, then the work is scored against the rubric above, item by item, with comments. A pass counts toward the course certificate and shows on your profile.
Loading…