Embedded Files
APPLICATION & SOFTWARE SECURITY
Overview
I performed a structured secure code review on a small Flask application to uncover common weaknesses and apply targeted fixes. I combined automated static analysis with Bandit and a manual review focused on authentication, input handling, configuration, and error management. I then verified fixes and documented the results for repeatable use.
(How to Conduct a Secure Code Review)
Objectives
Build a practical review workflow that blends automated and manual techniques
Identify high impact issues aligned to the OWASP Top 10
Implement fixes with minimal changes and strong security gains
Produce clear documentation that developers can follow
Prerequisites
Basic Python and Flask familiarity
Knowledge of common web risks and the OWASP Top 10
Access to source code and a local run environment
Tools and technologies
Python, Flask, Bandit, Jinja templates
Environment variable management for secrets
Implementation
1. Environment setup
Created a virtual environment and installed Flask
Launched the app locally to understand routes, forms, and auth flows
2. Automated scan
Ran Bandit across the repository to flag insecure patterns
Triaged findings and mapped them to real risks in the codebase
3. Manual review
Authentication and sessions: removed hardcoded credentials, replaced with werkzeug.security password hashing and verification
Input handling: replaced direct rendering of untrusted input with escaping and proper templates
Configuration: ensured debug=False and separated development vs production settings
CSRF protection: added CSRF middleware for state-changing forms
Error handling: standardized safe error messages and avoided sensitive data leakage
4. Remediation
Introduced hashed passwords and secure checks
Implemented output encoding in dynamic views and migrated to Jinja templates
Added CSRF protection and secure cookies where applicable
Centralized settings so secrets and keys come from environment variables
5. Verification
Re-ran Bandit and smoke tests
Performed functional tests on login, user input, and error paths
Confirmed reduced risk surface without breaking key features
6. Documentation
Wrote a short review report with issues, severity, fixes, and diffs
Added a lightweight secure coding checklist for future reviews
Outcomes
Removed hardcoded secrets and unsafe rendering
Reduced exposure to XSS, broken auth, and misconfiguration
Delivered an actionable report developers can reuse
Skills demonstrated
Secure code review methodology
Python and Flask remediation patterns
Risk triage and developer-focused documentation
Google Sites
Report abuse