Secure Image Scanning Platform with Authentication Hardening
Core authentication system, session management, and registration flow are complete and secure. Image upload and color scanning are functional. Search and delete features were planned but not implemented.
This project implements security best practices throughout the application stack. Built with PHP, MySQL, and JavaScript featuring bcrypt + SHA512 password hashing, session hardening, and brute-force attack mitigation.
PictureScanner is a web-based image scanning application that allows users to upload and analyze images with embedded metadata extraction and color profiling. Built as a collaborative team project with emphasis on secure authentication flows and defensive coding practices.
Team Members: Gill, MDeque, JC
- Frontend: HTML5, CSS3, JavaScript, Bootstrap
- Backend: PHP, MySQL (mysqli with prepared statements)
- Note: Uses Bootstrap 3 (legacy). Fully functional but would require migration for Bootstrap 5 compatibility.
- Authentication: bcrypt + SHA512, session management
- Architecture: MVC-inspired separation of concerns
- Password Hashing — Combined bcrypt and SHA512 for defense-in-depth
- Session Hardening — Regenerated session IDs on login, timeout enforcement
- Brute-Force Protection — Login attempt throttling and account lockout
- SQL Injection Prevention — Prepared statements (mysqli) throughout authentication and registration flows
- XSS Mitigation — Input sanitization and output escaping
- CSRF Protection — Token-based request validation
- Secure Authentication — Multi-layer password hashing, session regeneration
- Session Management — Hardened cookies, HTTP-only flags, secure transport
- SQL Injection Prevention — PDO prepared statements, parameter binding
- XSS/CSRF Mitigation — Input sanitization, token validation
- Full-Stack Development — PHP/MySQL/JavaScript integration
- Team Collaboration — Distributed development, version control workflow
MIT License - See LICENSE file for details.
Built with ❤️ by Jon Gill - Security-focused developer transitioning from law enforcement investigation
Demonstrating secure authentication architecture and full-stack development