Secure Coding Review Conducted by Amantle Maakelo
A complete secure code review workflow: a deliberately-vulnerable Flask "internal banking portal" sample app, a professional-format audit report identifying 10 real vulnerabilities (manually reviewed + confirmed with Bandit static analysis), and a fully remediated version of the code, re-scanned to verify the fixes actually work.
Internal financial tools are often built fast, by small teams, without a formal security review and that's exactly where serious vulnerabilities slip through. Rather than review a toy "hello world" app, this project audits a small transaction-handling application (login, fund transfers, account statements, admin panel), the same feature set as countless real internal banking tools — so the findings actually reflect what a reviewer would encounter in a banking or fintech environment.
CodeAlpha_SecureCodingReview/
├── README.md
├── audit-target/
│ ├── app.py # the AS-FOUND vulnerable application
│ └── requirements.txt
├── fixed-code/
│ ├── app.py # the REMEDIATED application
│ ├── templates/ # Jinja2 templates (autoescaping enabled)
│ └── requirements.txt
└── docs/
├── AUDIT_REPORT.md # full findings report (start here)
├── bandit_raw_output.txt # Bandit scan of the vulnerable version
└── bandit_fixed_output.txt # Bandit scan of the fixed version (0 issues)
Start with docs/AUDIT_REPORT.md — it's the
main deliverable and reads like a professional security audit report.
| Severity | Count |
|---|---|
| Critical | 3 |
| High | 5 |
| Medium | 1 |
| Low | 1 |
Covers SQL injection, broken access control, weak cryptography, reflected XSS, missing CSRF protection, path traversal, and security misconfiguration , mapped to both CWE and OWASP Top 10 (2021) categories.
- Manual review of every route using the OWASP Top 10 as a checklist
- Automated static analysis with Bandit to cross-check and catch anything missed
- Remediation using framework-native, industry-standard controls
(parameterized queries,
werkzeug.securitypassword hashing,Flask-WTFCSRF protection, Jinja2 autoescaping, proper access-control decorators) - Re-verification — Bandit re-run against the fixed code confirms zero remaining issues, so the fix is demonstrated, not just claimed
# Vulnerable version (for review/demo purposes only — do not expose publicly)
cd audit-target
pip install -r requirements.txt
python3 app.py
# Fixed version
cd fixed-code
pip install -r requirements.txt
export VITABANK_SECRET_KEY=$(python3 -c "import secrets; print(secrets.token_hex(32))")
export VITABANK_ADMIN_BOOTSTRAP_PASSWORD="ChangeMe123!"
python3 app.pyTo reproduce the static analysis:
pip install bandit
bandit audit-target/app.py
bandit fixed-code/app.py- Ability to read and reason about real application code through a security lens, not just run a scanner and copy-paste output
- Familiarity with the OWASP Top 10 and CWE classification, and how to communicate findings clearly to a technical or non-technical audience
- Practical remediation skills , not just "this is bad" but concrete, framework-appropriate fixes
- A verification mindset: claims are backed by a re-scan, matching how a real audit would close out findings
audit-target/app.py is intentionally vulnerable and built solely for
this educational audit exercise. It should never be deployed to a public
or production environment.
Amantle Maakelo Pivoting into Cybersecurity & SAP GitHub
© 2026 Amantle Maakelo. All rights reserved. This repository is proprietary, not open source. It is published only so that prospective employers, clients, and collaborators can review the author's work.
You may view and read it, and quote short excerpts with attribution when
reviewing or commenting on the author's work. Any other use — copying,
modifying, redistributing, hosting, or building on it, commercial or
not — requires the owner's prior written permission, requested via
GitHub. See LICENSE
for the full terms.