Vylink is a full-stack portfolio project demonstrating secure file sharing, authentication, and cloud storage integration — built following OWASP Top 10 guidelines, with pre-signed S3 URLs for safe, time-limited file delivery.
- 🌐 Live Demo
- 🛡️ Security Highlights
- 🛠️ Tech Stack
- ✅ Completed Features
- 🏗️ Architecture
- 🚀 Quick Start
- 📊 Project Milestones
- 🚧 Roadmap
⚠️ Known Limitations- 📄 License
- 🔗 Connect
| Page | Link |
|---|---|
| App | vylink.duckdns.org |
| Register | /register |
| Login | /login |
Try it: register → log in → upload an image from the dashboard → create a share link with an expiry.
The features that matter most for a project built around secure file delivery.
- 🔐 JWT auth via
httpOnlycookies: no tokens exposed to client-side JS - 🔑 Google OAuth: reduces password-based attack surface
- 🔒 HTTPS everywhere: Let's Encrypt certificate served through Nginx, with HSTS
- 🧹 Bleach input sanitization: blocks stored/reflected XSS
- 🛡️ Full OWASP security header set: CSP, HSTS, X-Frame-Options, nosniff
- ⏱️ 60-second expiring pre-signed S3 URLs: private bucket, no public file exposure
- ⚡ Rate limiting on uploads and shares: throttles abuse and scraping
- 🚫 Access control: users can only see and manage their own files
| Category | Technology |
|---|---|
| Frontend | React, TypeScript, Tailwind CSS, React Router |
| Backend | Python, Django REST Framework |
| Database | PostgreSQL |
| Cache | Redis |
| Storage | AWS S3 (pre-signed URLs) |
| Auth | JWT (httpOnly cookies), Google OAuth |
| Tooling | Docker, Docker Compose |
| Server | AWS EC2 (Ubuntu), Nginx reverse proxy |
| SSL | Let's Encrypt (Certbot) |
| Domain | DuckDNS (vylink.duckdns.org) |
Browser ──HTTPS──► Nginx (EC2) ──► React UI
│
└──► Django API ──► PostgreSQL + Redis
│
└──► S3 (pre-signed URLs)
| Component | Role |
|---|---|
| Nginx + Let's Encrypt | HTTPS entry point and reverse proxy on EC2 |
| React | Frontend UI |
| Django REST Framework | API, JWT auth, rate limiting |
| PostgreSQL / Redis | Data storage / caching and throttling |
| S3 pre-signed URLs | Private bucket, temporary file access |
| Docker Compose | Runs the backend, database, and cache as containers |
Just want to try it? Use the live app: vylink.duckdns.org
Want to run it locally? You need Docker and Docker Compose.
# 1. Clone the repo
git clone https://github.com/Ruchika402/Vylink.git
cd Vylink
# 2. Create your env file from the template
cp backend/config/.env.example backend/config/.env
# 3. Build and start all containers
docker compose up -d --build
# 4. Set up the database
docker compose exec backend python manage.py migrate
# 5. Create an admin user
docker compose exec backend python manage.py createsuperuserFill in your values in backend/config/.env before step 3. See .env.example for every variable you need (Django, database, Redis, AWS S3). Never commit your real .env.
Open http://localhost:3000 and you're in.
Requires Python 3.11+, Node.js 18+, PostgreSQL, and Redis. In your .env, set the database and Redis hosts to localhost.
# Backend
cd backend
python -m venv venv
source venv/bin/activate # Windows: venv\Scripts\activate
pip install -r requirements.txt
python manage.py migrate
python manage.py runserver
# Frontend (new terminal)
cd frontend
pnpm install
pnpm start| Phase | Status |
|---|---|
| Backend API (Django + DRF) | ✅ Complete |
| Frontend UI (React + Tailwind) | ✅ Complete |
| Core Security | ✅ Complete |
| Cloud Storage (S3 pre-signed URLs) | ✅ Complete |
| Docker Containerization | ✅ Complete |
| AWS EC2 Deployment | ✅ Complete |
| HTTPS + Domain | ✅ Complete |
| Logging & Monitoring | 📝 Planned |
| CI/CD (GitHub Actions) | 📝 Planned |
- Google OAuth redirect URI update for the production domain
- Fix login rate limiting (5 attempts/min)
- CI/CD pipeline with GitHub Actions
- Structured logging and Sentry error tracking
- More unit and integration tests
- API documentation with Swagger/OpenAPI
- Custom domain to replace DuckDNS
- S3 pre-signed URLs sometimes fail signature validation (being fixed)
- Login rate limiting has a bug (upload/share limits work)
- Share link page shows image metadata correctly; image rendering in progress
- Automated tests are in progress (4 security tests implemented)
- CI/CD pipeline not yet set up
MIT © 2026 Ruchika Adak
Built with security-first principles.