David Spurlock
RésuméContact
Menu

Technical project· Secure development

Web Security Fundamentals

A compact Flask application that makes foundational web controls visible and testable through fictional accounts, owner-scoped data, protected forms, and a live security-status view.

This page documents a later portfolio reconstruction of a project originally completed during the ASU Cybersecurity Boot Camp in 2020. The current code, data, screenshots, and reports are not the untouched original submission.

ASU Cybersecurity Boot Camp · 2020Reviewed July 2026
← Back to all projects
Web security status page showing eight enabled application controls.
The secure-development lab makes authorization, CSRF, password, cookie, header, encoding, and input controls visible.
For
Recruiters and engineering reviewers evaluating applied web-security controls in a compact local application.
Role
Original bootcamp project work; later application design, secure implementation, control documentation, and testing
Build
Later portfolio reconstruction of an original bootcamp project

The problem

Why this needed to exist.

Security guidance becomes more useful when a reviewer can see the control in request behavior, application code, tests, response headers, and a concise interface rather than in a checklist alone.

Defining decision

Make controls visible in request behavior, application code, tests, response headers, and the interface instead of describing them only in a checklist.

Approach

How the system was shaped.

  1. Centralized request and response controls while keeping authorization decisions close to each route.
  2. Used parameterized SQL, Argon2id passwords, CSRF tokens, scoped access checks, allowlisted downloads, input limits, and browser security headers.
  3. Added HTTP probes and tests so controls can be inspected outside the interface.

Tradeoffs

What the design chooses—and gives up.

  • A small SQLite-backed application keeps the controls legible while excluding production identity, key management, and deployment architecture.

Evidence

What can be inspected.

  • The security-status page exposes eight enabled control families with concise implementation notes.
  • The project includes coverage, lint, and HTTP-probe workflows.

Lessons

What carries into the next system.

  • Security controls are easier to evaluate when behavior, tests, headers, and the interface tell the same story.