Working with backend services and APIs taught me to think about requests, data flows and failure handling. In my AppSec transition, I have been focusing on the assumptions hidden between those pieces: the route that selects a tenant, the permission that authorizes a write, and the transaction that commits a change.
I did not want a portfolio built only from security buzzwords. I wanted to show specific design decisions, deliberately hostile test cases, and an honest answer to “what did this actually prove?”
The first examines vulnerabilities and their remediations. The second tests how security controls behave together in a multi-tenant product. Both include mistakes, investigations, and explicit evidence limits.
I examined how ordinary application features fail under malicious inputs — from an order ID that belongs to another user to an outbound request that should never reach an arbitrary host. Each finding has a reasoned fix and regression coverage.
I explored what it takes to keep tenant boundaries trustworthy across API permissions, PostgreSQL RLS, sessions, webhooks, auditing and caching. A transaction timing bug found in the Master Review became the clearest lesson.
Numbers are tied to observed GitHub CI revisions in private repositories. They describe covered scenarios, not a production certification or immunity from unknown vulnerabilities.
Verified at the integrated .NET lab source revision. Review evidence also includes automated SAST, SCA, secret scanning, SBOM and ZAP DAST validation; DAST is documented from its separately reviewed revision.
Successful exact-merge-SHA CI, including real PostgreSQL Testcontainers, plus 17 Chromium tests and 36 pipeline-policy test cases. The targeted attack suites are subsets of the 793.
An independently concurrent PostgreSQL reader could refill stale project cache data before a writer committed. The review added post-commit invalidation and verified commit/rollback paths.
The process starts with a specific failure hypothesis and ends with its boundaries. A successful test answers that hypothesis — not every possible security question.
Identify actors, assets, attacker-controlled inputs and ownership of each security decision.
Design adversarial cases for denied access, tampered data, unexpected state and concurrent operations.
Fix the cause at the identity, API, browser, network, database or pipeline boundary.
Use reproducible tests and revision-specific CI; record what remains outside the verified scope.
These are independently built educational portfolio labs, not live customer systems. The original GitHub repositories are private. Source access, publication and deployment are separate decisions.