CodeAlpha Cyber Security Internship · Task 3
Secure coding review, vulnerability identification, remediation, static analysis, and regression testing.
Overview • Workflow • Findings • Quick Start • Remediation • Evidence • Security & Privacy
Authorized-use notice: The vulnerable application in this repository is intentionally insecure and must remain in a controlled local environment. Do not expose it to untrusted users or deploy it as a production application.
The CodeAlpha Secure Coding Review project demonstrates a practical secure-coding workflow using a deliberately vulnerable Python application and a separately implemented secure reference version.
The review combines:
- manual source inspection
- Bandit 1.9.4 static security analysis
- security finding classification
- risk assessment
- secure remediation
- regression/security testing
- reproducible evidence and documentation
The project preserves the vulnerable application as an audit artifact so the before-and-after security differences remain visible and reviewable.
┌───────────────────────────────────┐
│ Controlled Vulnerable Application │
│ target_app/vulnerable_app.py │
└──────────────────┬────────────────┘
│
▼
Manual Source Inspection
+
Bandit Static Analysis
│
▼
Security Findings
│
▼
Risk Assessment
│
▼
Secure Remediation
│
▼
┌───────────────────────────────────┐
│ Secure Reference Implementation │
│ secure_version/secure_app.py │
└──────────────────┬────────────────┘
│
▼
Automated Regression Tests
1. Review controlled vulnerable source
↓
2. Run Bandit baseline
↓
3. Classify and document findings
↓
4. Implement secure coding controls
↓
5. Re-scan the secure reference
↓
6. Run regression/security tests
↓
7. Preserve reports and screenshots
The project was designed to demonstrate that a secure-coding review can:
- Identify weaknesses in intentionally vulnerable application code.
- Combine automated static analysis with manual inspection.
- Document security impact and review risk.
- Map weaknesses to concrete remediation controls.
- Implement a separate secure reference version.
- Re-run static analysis after remediation.
- Verify the secure implementation with automated tests.
- Preserve clear evidence of the before-and-after security state.
The review identified eight actionable security findings through a combination of Bandit evidence and manual source inspection.
| ID | Finding | Evidence | Review Risk |
|---|---|---|---|
| SC-001 | Hard-coded application secret | Bandit B105 | Medium |
| SC-002 | Weak password hashing | Manual review | High |
| SC-003 | SQL injection in create_user() |
Bandit B608 | High |
| SC-004 | SQL injection in find_user() |
Bandit B608 | High |
| SC-005 | OS command injection | Bandit B602 | High |
| SC-006 | Path traversal | Manual review | Medium |
| SC-007 | Unsafe deserialization with pickle |
Bandit B301/B403 | High |
| SC-008 | Plaintext password logging | Manual review | High |
Bandit also reports module-level advisories for:
B403 → pickle import
B404 → subprocess import
These advisories support the relevant actionable findings and are not counted as additional standalone vulnerabilities in the eight-finding review register.
Detailed analysis is available in
reports/FINDINGS.md.
| Component | Technology |
|---|---|
| Programming Language | Python 3 |
| Static Security Analysis | Bandit 1.9.4 |
| Automated Testing | pytest 9.1.1 |
| Database | SQLite |
| Secure Password KDF | PBKDF2-HMAC-SHA256 |
| Serialization | JSON |
| Version Control | Git / GitHub |
| Documentation | Markdown |
Python: 3.13.15
Bandit: 1.9.4
pytest: 9.1.1
CodeAlpha_SecureCodingReview/
│
├── reports/
│ ├── bandit_report.json
│ ├── FINDINGS.md
│ ├── REMEDIATION.md
│ └── SECURITY_REVIEW.md
│
├── screenshots/
│ ├── 00_project_banner.png
│ ├── 01_project_structure.png
│ ├── 02_bandit_baseline.png
│ ├── 03_security_findings.png
│ ├── 04_secure_remediation.png
│ ├── 05_tests_passed.png
│ └── README.md
│
├── secure_version/
│ ├── __init__.py
│ └── secure_app.py
│
├── target_app/
│ ├── __init__.py
│ └── vulnerable_app.py
│
├── tests/
│ └── test_security.py
│
├── tools/
│ └── run_review.py
│
├── .gitignore
├── LICENSE
├── README.md
└── requirements.txt
| Directory | Responsibility |
|---|---|
target_app/ |
Deliberately vulnerable audit target |
secure_version/ |
Remediated reference implementation |
tests/ |
Automated security/regression tests |
tools/ |
Review and Bandit helper |
reports/ |
Findings, remediation, review, and machine-readable analysis |
screenshots/ |
Visual evidence from the review workflow |
Install:
- Python 3.10+
- pytest 9.1.1
- Bandit 1.9.4
The recorded verification environment used Python 3.13.15.
cd CodeAlpha_SecureCodingReviewpython -m pip install -r requirements.txtpython -m pytest --versionpython -m bandit --versionThe vulnerable application exists only for controlled security-review practice.
Run locally:
python target_app\vulnerable_app.pyDo not:
- deploy it as a production application
- expose it to the network
- provide it with untrusted users or data
- use it against systems you do not own or have authorization to assess
The vulnerable source is intentionally retained so the security weaknesses can be reviewed and compared with the remediation.
python -m bandit -r target_apppython -m bandit -r target_app -f json -o reports\bandit_report.jsonpython tools\run_review.pyThe recorded Bandit baseline scanned 187 lines of code and reported:
High: 1
Medium: 3
Low: 3
Total: 7
The baseline is intentionally non-clean because target_app/ is deliberately
vulnerable.
The secure reference implementation is:
secure_version/secure_app.py
It demonstrates the corresponding defensive controls.
The application secret is loaded from:
CODEALPHA_APP_SECRET
rather than being hard-coded in the source.
Passwords are protected with:
PBKDF2-HMAC-SHA256
using a random salt and a configured work factor.
User-controlled values are passed to SQLite through parameterized placeholders instead of SQL string interpolation.
Command execution is restricted to an explicit allowlist and uses:
shell=False
with a timeout.
User-supplied filenames are resolved and checked so the final path remains inside the approved data directory.
The vulnerable pickle path is replaced with JSON serialization/deserialization.
Passwords and authentication secrets are not written to application logs.
Run:
python -m bandit -r secure_versionRecorded result:
Total lines of code: 257
Undefined: 0
Low: 2
Medium: 0
High: 0
The remaining low-severity findings are:
B404 → subprocess module-level advisory
B603 → subprocess call without shell interpretation
These do not indicate that the original shell=True command-injection
vulnerability remains.
The secure implementation uses:
explicit command allowlist
shell=False
timeout
Run:
python -m pytest -q8 passed
The regression/security suite verifies:
| Test Area | Verification |
|---|---|
| Password hashing | Salted PBKDF2 behavior |
| Password verification | Correct and incorrect credential handling |
| Salt uniqueness | Different salts for repeated hashing |
| Database access | Parameterized SQL operations |
| Serialization | JSON serialization/deserialization |
| Path security | Traversal rejection |
| Command execution | Allowlisting |
| Approved command | Expected command execution |
| JSON export | Valid JSON output |
A successful test run confirms that the secure reference implementation satisfies the project's regression checks.
Vulnerable Target
│
├── Hard-coded secret
├── Weak password hashing
├── SQL injection
├── Command injection
├── Path traversal
├── Unsafe pickle deserialization
└── Plaintext password logging
│
▼
Security Review + Bandit
│
▼
Remediation
│
▼
Secure Reference
│
├── Environment-based secret
├── PBKDF2-HMAC-SHA256
├── Parameterized SQL
├── Allowlisted shell=False execution
├── Path containment checks
├── JSON serialization
└── Secret-free logging
│
▼
Bandit Re-scan + pytest
The repository contains five visual evidence screenshots documenting the major stages of the security review.
Shows the organized repository structure, including the vulnerable target, secure version, tests, reports, tools, and evidence directories.
Shows the Bandit baseline scan against the intentionally vulnerable target.
Recorded baseline:
High: 1
Medium: 3
Low: 3
Total: 7
Shows the documented security finding register containing the eight actionable review findings.
Shows the secure reference implementation and key defensive controls including environment-based secrets, PBKDF2 password hashing, parameterized SQL, safe command execution, path validation, and secure logging.
Shows the completed automated verification:
8 passed
The screenshot index is also available in
screenshots/README.md.
Contains:
- finding register
- Bandit evidence
- CWE references
- security impact
- review risk
- recommendations
- remediation references
Contains:
- remediation matrix
- secure coding practices
- verification approach
- regression-test information
Contains:
- review scope
- methodology
- baseline analysis
- security findings
- verification
- final conclusion
Contains the machine-readable Bandit baseline generated from the vulnerable target.
| Task 3 Activity | Project Implementation |
|---|---|
| Select a language and application to audit | Controlled vulnerable Python application |
| Perform a security review | Manual source inspection |
| Use static analysis | Bandit 1.9.4 |
| Identify vulnerabilities | Eight actionable findings |
| Assess security risk | Finding-level review risk |
| Recommend secure practices | Documented recommendations |
| Implement remediation | Separate secure reference implementation |
| Verify remediation | pytest regression/security suite |
| Re-scan secure implementation | Bandit secure-version scan |
| Document the review | Findings, remediation, and review reports |
| Preserve evidence | Bandit JSON and screenshot evidence |
This repository is an educational secure-coding exercise.
Only assess:
Owned applications
Controlled laboratory environments
Explicitly authorized systems and data
Do not commit:
- production credentials
- API keys
- authentication tokens
- private secrets
- confidential application data
- sensitive logs
- private test data
- unauthorized security evidence
The vulnerable target should remain local and controlled.
Before committing:
git status --shortAlso verify that generated Python caches are excluded:
git check-ignore -v `
".pytest_cache" `
"__pycache__"Only source code, documentation, deliberate evidence, and reviewed machine-readable reports should be included in the public repository.
This project is an educational secure-coding review and remediation exercise.
It does not claim to be:
- a complete application security assessment
- a production penetration test
- a formal secure-development lifecycle
- a replacement for peer review
- a replacement for dependency, infrastructure, or deployment security testing
Bandit findings depend on the analyzer version and configured rules, while manual review depends on application context.
Passing the regression suite demonstrates expected behavior for the included tests. It does not prove the secure implementation is free of all possible security defects.
Controlled vulnerable target ✅
Manual security review ✅
Bandit baseline analysis ✅
Security findings documented ✅
Secure reference implementation ✅
Regression/security tests ✅ 8 passed
Secure-version Bandit re-scan ✅
Review documentation ✅
Evidence screenshots ✅
GitHub repository ✅ Published
Python version: 3.13.15
Bandit version: 1.9.4
pytest version: 9.1.1
Vulnerable baseline: 1 High / 3 Medium / 3 Low
Actionable findings: 8
Secure-version High findings: 0
Secure-version Medium: 0
Secure-version Low: 2
Regression tests: 8 passed
Evidence screenshots: 5
Subhadeep Adhikary
CodeAlpha Cyber Security Intern
This project is licensed under the MIT License.
See LICENSE for the complete license text.