## https://sploitus.com/exploit?id=28F50EB1-379F-5BEA-A9A1-4CA681634FBA
# CodeAlpha_SecureCodingReview
**Cyber Security Internship โ CodeAlpha โ Task 3: Secure Coding Review**
A manual security code review of a small Python (Flask) web application. The project
includes the intentionally vulnerable original code, a full written review report, and a
remediated version with every issue fixed.
## Files
- `vulnerable_app.py` โ the original application, containing 10 intentionally planted
vulnerabilities (each marked with a `# VULN-n` comment)
- `SECURITY_REVIEW_REPORT.docx` โ the full review report: executive summary, methodology,
a findings summary table, and a detailed write-up of each vulnerability with
before/after code and remediation guidance
- `secure_app.py` โ the remediated version of the application, with every finding fixed
(marked with matching `# FIX-n` comments)
## Summary of findings
| # | Vulnerability | Severity | CWE |
|---|---|---|---|
| 1 | Hardcoded secret key | High | CWE-798 |
| 2 | Weak password hashing (MD5, unsalted) | Critical | CWE-916 |
| 3 | SQL Injection (multiple endpoints) | Critical | CWE-89 |
| 4 | Verbose authentication error messages | Low | CWE-203 |
| 5 | Reflected Cross-Site Scripting (XSS) | High | CWE-79 |
| 6 | OS Command Injection | Critical | CWE-78 |
| 7 | Path Traversal on file download | High | CWE-22 |
| 8 | Insecure Deserialization (pickle) | Critical | CWE-502 |
| 9 | Debug mode enabled in production | High | CWE-489 |
| 10 | Server exposed on all network interfaces | Medium | CWE-668 |
## Methodology
Manual, line-by-line static code review โ each HTTP endpoint was traced from user input
to its eventual sink (SQL query, shell command, file path, deserializer, or HTML output)
to identify missing validation, sanitization, or encoding. Findings are mapped to MITRE
CWE identifiers. Automated tools such as Bandit or Semgrep are recommended as a
complementary, repeatable check in CI/CD going forward.
## Disclaimer
`vulnerable_app.py` is intentionally insecure and included **for educational purposes
only**, to demonstrate the review process. Do not deploy it.
## Author
Ashutosh Kumar Ray โ CodeAlpha Cyber Security Internship, Task 3 submission.