CodeAlpha Internship - Task 3: Secure Coding Review

This repository contains my submission for the Secure Coding Review task during my CodeAlpha internship.

Project Structure

• vulnerable_code.py: A Python backend script containing severe security vulnerabilities.
• secure_code.py: The completely refactored, secure version of the code.

Vulnerabilities Found & Fixed

1. Hardcoded Credentials

• Vulnerability: The secret key was typed directly into the code.
• Danger: If pushed online, anyone can steal this key and compromise the app.
• Fix: Utilized os.environ.get() to load the key securely out of the environment variables.

2. SQL Injection (SQLi)

• Vulnerability: Raw user input strings were stitched directly into the database query using f-strings.
• Danger: Attackers can inject custom SQL commands to steal or erase the entire database.
• Fix: Implemented parameterized queries using ? placeholders so input is handled strictly as data.

3. Information Disclosure (Poor Error Handling)

• Vulnerability: The application printed raw database errors (str(error)) out to the client.
• Danger: Explains the exact database architecture to potential attackers.
• Fix: Implemented internal server logging (logging) and standard error fallback screens for users.

Tools Used

• Bandit (Python Static Application Security Testing)