A full-stack cybersecurity portfolio and threat intelligence platform demonstrating security engineering principles, defensive coding, and real-world vulnerability awareness.
- Overview
- Architecture
- Security Features
- Threat Model
- OWASP Top 10 Protections
- Security Controls Implemented
- Attack Simulation Lab
- Getting Started
- Environment Variables
- API Documentation
- Future Improvements
CyberShield is a comprehensive cybersecurity platform built by a BTech Cybersecurity student. It demonstrates:
- Secure Authentication: JWT-based auth with rate limiting and brute-force detection
- Security Logging: SIEM-style dashboard with real-time event monitoring
- Threat Intelligence: Live CVE feeds, attack maps, and threat indicators
- Vulnerability Scanner: Simulated security assessment tool
- Attack Simulation: Educational lab for testing web vulnerabilities
Most student cybersecurity projects focus on visual aesthetics without implementing actual security controls. CyberShield demonstrates real security engineering by:
- Implementing proper authentication security
- Adding comprehensive security logging
- Demonstrating attack patterns and their mitigations
- Following OWASP best practices
┌─────────────────────────────────────────────────────────────┐
│ FRONTEND (React) │
│ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌────────┐ │
│ │ Home │ │Scanner │ │AttackLab│ │Security │ │ SOC │ │
│ └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘ └───┬────┘ │
│ │ │ │ │ │ │
└───────┼──────────┼───────────┼───────────┼───────────┼──────┘
│ │ │ │ │
▼ ▼ ▼ ▼ ▼
┌─────────────────────────────────────────────────────────────┐
│ BACKEND (Supabase Edge Functions) │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ API Gateway │ │
│ │ • Rate Limiting • Input Validation • Auth Check │ │
│ └─────────────────────────────────────────────────────┘ │
│ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ │
│ │ Auth │ │Security│ │ CRUD │ │Scanner │ │Visitor │ │
│ │Service │ │ Logs │ │ Routes │ │Service │ │Tracker │ │
│ └────────┘ └────────┘ └────────┘ └────────┘ └────────┘ │
└───────────────────────────┬─────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ DATABASE (PostgreSQL + RLS) │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────────┐ │
│ │ Profiles │ │ Projects │ │ AuthLogs │ │SecurityEvents│ │
│ └──────────┘ └──────────┘ └──────────┘ └──────────────┘ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────────┐ │
│ │BlogPosts│ │Threats │ │RateLimits │ │SuspiciousAct │ │
│ └──────────┘ └──────────┘ └──────────┘ └──────────────┘ │
└─────────────────────────────────────────────────────────────┘
| Layer | Technology |
|---|---|
| Frontend | React, TypeScript, Tailwind CSS, Framer Motion |
| Backend | Supabase Edge Functions (Deno) |
| Database | PostgreSQL with Row Level Security |
| Authentication | Supabase Auth (JWT) |
| Hosting | Supabase Cloud |
- JWT-based authentication with session management
- Rate limiting on login attempts (5 attempts per 15 minutes)
- Brute-force detection with automatic IP flagging
- Failed login tracking with suspicious activity alerts
- Admin role-based access control (RBAC)
- Server-side input sanitization for all forms
- Email format validation with regex patterns
- Length constraints on all text inputs
- DOMPurify for HTML sanitization in blog posts
- Parameterized queries to prevent SQL injection
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()| Endpoint | Limit | Window |
|---|---|---|
/auth/login |
5 attempts | 15 minutes |
/contact |
3 submissions | 1 hour |
/scan |
10 scans | 1 hour |
All security-relevant events are logged:
- Authentication attempts (success/failure)
- Rate limit violations
- Suspicious user agents
- Brute-force detection
- Admin actions (audit trail)
┌─────────────────────────────────────────────────────────────┐
│ EXTERNAL THREATS │
├─────────────────────────────────────────────────────────────┤
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │
│ │ Web App │ │ API │ │ Auth Flow │ │
│ │ (Frontend) │ │ (Endpoints) │ │ (Login/Reg) │ │
│ └──────┬──────┘ └──────┬──────┘ └──────┬──────┘ │
│ │ │ │ │
│ ┌──────▼──────┐ ┌──────▼──────┐ ┌──────▼──────┐ │
│ │ XSS Attacks │ │ SQL Inject │ │ Credential │ │
│ │ CSRF │ │ SSRF │ │ Stuffing │ │
│ │ Clickjacking│ │ Rate Limit │ │ Brute Force │ │
│ └─────────────┘ └─────────────┘ └─────────────┘ │
└─────────────────────────────────────────────────────────────┘
| Threat | Mitigation |
|---|---|
| Spoofing | JWT signatures, session validation |
| Tampering | Input validation, parameterized queries |
| Repudiation | Comprehensive audit logging |
| Information Disclosure | RLS policies, minimal data exposure |
| Denial of Service | Rate limiting, query timeouts |
| Elevation of Privilege | RBAC, admin verification |
┌─────────────┐ ┌─────────────┐ ┌─────────────┐
│ Browser │ ────▶ │ Edge Fn │ ────▶ │ Database │
│ (Untrusted) │ │ (Trusted) │ │ (Protected) │
└─────────────┘ └─────────────┘ └─────────────┘
│ │ │
│ TLS/HTTPS │ Service Role │
└───────────────────────┴──────────────────────┘
Mitigations:
- Row Level Security (RLS) on all database tables
- Role-based policies (admin vs analyst)
- Session verification on protected routes
- Admin-only API endpoints with token verification
Testing:
# Attempt to access admin endpoint without auth
curl -X GET https://api.cybershield.dev/admin
# Response: 401 UnauthorizedMitigations:
- HTTPS-only communication
- Secure JWT token handling
- No sensitive data in localStorage
- Environment variable secrets management
Mitigations:
- Parameterized queries (Supabase client)
- Input validation and sanitization
- DOMPurify for HTML content
- Type-safe TypeScript interfaces
Attack Lab Demonstration:
- SQL Injection payloads are blocked
- XSS payloads are sanitized
- Command injection attempts fail
Mitigations:
- Defense in depth architecture
- Rate limiting at multiple layers
- Input validation at edge and database
- Principle of least privilege
Mitigations:
- Security headers configured
- Error messages sanitized
- Debug mode disabled in production
- Default credentials changed
Mitigations:
- Regular
npm auditchecks - Dependency version pinning
- Supabase managed updates
Mitigations:
- Rate limiting on login
- Brute-force detection
- Failed login alerts
- Session expiration handling
Mitigations:
- JWT signature verification
- Input validation
- Database constraints
Mitigations:
- Comprehensive security logging
- Auth event tracking
- Admin audit trail
- SIEM-style dashboard
Mitigations:
- No arbitrary URL fetching
- Whitelisted external APIs only
- Input validation on all URLs
| Control | Status | Implementation |
|---|---|---|
| Input Validation | ✅ Active | Server-side + DOMPurify |
| Output Encoding | ✅ Active | HTML entity encoding |
| Authentication | ✅ Active | JWT + Supabase Auth |
| Authorization | ✅ Active | RLS + RBAC |
| Rate Limiting | ✅ Active | Edge function middleware |
| Security Headers | ✅ Active | Response headers |
| Logging | ✅ Active | Auth logs + Security events |
| CSRF Protection | ✅ Active | Token validation |
| XSS Prevention | ✅ Active | CSP + Sanitization |
| SQL Injection Prevention | ✅ Active | Parameterized queries |
The Attack Lab provides educational demonstrations of common web vulnerabilities:
-
Cross-Site Scripting (XSS)
- Reflected XSS payloads
- DOM-based XSS attempts
- All blocked by DOMPurify + CSP
-
SQL Injection
- Classic
' OR '1'='1payloads - UNION-based attacks
- All blocked by parameterized queries
- Classic
-
CSRF Attacks
- Form submission attempts
- Cross-origin requests
- All blocked by CSRF tokens + SameSite cookies
-
Authentication Bypass
- Credential stuffing simulations
- Brute-force attempts
- All blocked by rate limiting
-
JWT Tampering
- Algorithm confusion
- Payload modification
- All blocked by signature verification
-
Path Traversal
- Directory escape attempts
- Encoded path attacks
- All blocked by path whitelisting
- Node.js 18+
- npm or yarn
- Supabase account
# Clone the repository
git clone https://github.com/yourusername/cybershield.git
cd cybershield
# Install dependencies
npm install
# Set up environment variables
cp .env.example .env
# Edit .env with your Supabase credentials
# Run development server
npm run dev
# Build for production
npm run buildVITE_SUPABASE_URL=your-supabase-url
VITE_SUPABASE_ANON_KEY=your-anon-keyServer-side (Supabase):
SUPABASE_SERVICE_ROLE_KEY- For admin operationsSUPABASE_DB_URL- Database connection
| Endpoint | Method | Description |
|---|---|---|
/auth/login |
POST | Login with rate limiting |
/security/log/auth |
POST | Log auth events |
| Endpoint | Method | Description |
|---|---|---|
/security/logs |
GET | Get security logs (admin) |
/security/stats |
GET | Get security statistics (admin) |
| Endpoint | Method | Description |
|---|---|---|
/projects |
GET/POST | Projects CRUD |
/blog |
GET/POST | Blog posts CRUD |
/contact |
POST | Contact form (rate limited) |
| Endpoint | Method | Description |
|---|---|---|
/scan |
POST | Vulnerability scan (rate limited) |
/threats |
GET | Threat indicators |
/soc/incidents |
GET/PUT | SOC incidents |
- MFA/OTP implementation
- Device fingerprinting
- Geolocation-based alerts
- Docker containerization
- CI/CD security pipeline
- Automated vulnerability scanning
- SIEM integration (Splunk/ELK)
- Honeypot endpoints
- Custom WAF rules
- Threat intelligence API
- Machine learning anomaly detection
- Compliance reporting (SOC2, HIPAA)
Run regular scans:
# npm audit
npm audit
# Snyk
npx snyk test
# OWASP Dependency Check
./dependency-check.sh-
XSS Testing
- Navigate to Attack Lab
- Select XSS simulation
- View blocked payloads
-
SQL Injection Testing
- Try
' OR '1'='1in forms - Observe parameterized query protection
- Try
-
Rate Limiting Testing
- Rapidly submit login attempts
- Observe rate limit activation
MIT License - Educational purposes
- OWASP Foundation for security guidelines
- Supabase for backend infrastructure
- MITRE ATT&CK for threat intelligence framework
