Cybersecurity Security Project

How it works

The project models one sensitive action: marking a loan returned. The actor must be authenticated, own the loan and act on an open loan. Failed requests should leave state unchanged and create a small audit event without secrets. The model is deliberately in-memory so its state transitions can be inspected; production storage requires atomic enforcement under concurrent requests.

Run the code

Save the complete source as security-project.py in a separate learning folder, then run python security-project.py. The reviewed runtime is Python 3.12.14 with the standard library; no third-party packages are required. These are local examples, not browser playground programs. Apache, MySQL and PHP are not needed.

Download the complete source

Local lab setup

Example

def return_loan(actor, loan, audit):
    permitted = actor is not None and actor == loan["owner"] and loan["state"] == "open"
    audit.append({"action": "return", "outcome": "allowed" if permitted else "denied"})
    if not permitted:
        return False
    loan["state"] = "returned"
    return True

loan = {"owner": "borrower-18", "state": "open"}
audit = []
assert not return_loan(None, loan, audit)
assert not return_loan("borrower-19", loan, audit)
assert loan["state"] == "open"
assert return_loan("borrower-18", loan, audit)
assert not return_loan("borrower-18", loan, audit)
assert loan["state"] == "returned"
assert [event["outcome"] for event in audit] == ["denied", "denied", "allowed", "denied"]
assert all(set(event) == {"action", "outcome"} for event in audit)
print("anonymous denied; other denied; owner returned; repeat denied")

Expected result

anonymous denied; other denied; owner returned; repeat denied

The test first tries anonymous and wrong-owner requests, checks that state remains open, then verifies a single successful return and a denied repeat. The audit contains only the approved action and outcome fields in this small model. Extend it with server-established identifiers and timestamps when integrating with real storage.