Main

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  # Enable automatic updates for Python dependencies (pip)
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly" # Options: daily, weekly, monthly

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,27 @@
+name: Dependabot Auto-Merge
+
+on: pull_request
+
+permissions:
+  pull-requests: write
+  contents: write
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    # Only run for pull requests opened by Dependabot
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Approve and Enable auto-merge for Dependabot PRs
+        run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --auto --merge "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -0,0 +1,43 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# Database files
+db.sqlite3
+db.sqlite3-journal
+db.sqlite3-shm
+db.sqlite3-wal
+alternative_db.sqlite3
+alternative_db.sqlite3-journal
+alternative_db.sqlite3-shm
+alternative_db.sqlite3-wal
+
+# Environments
+.env
+.venv/
+env/
+venv/
+ENV/
+
+# OS-generated files
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+
+# IDEs and editors
+.vscode/
+.idea/
+*.suo
+*.sw?
+*.tmp
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Static / Media directories
+staticfiles/
+media/

README.md

@@ -1,7 +1,69 @@
-# blango
+# Secure Code Review Case Study: Django Blango
 
-Starting point for the Advanced Django course. This is the equivalent of the following command:
+A comprehensive secure code review and vulnerability remediation case study of a Python/Django blogging application. Audited the codebase using automated SAST and manual analysis, resolved critical OWASP vulnerabilities, and published a professional PDF report.
 
+---
+
+## 🎯 The Challenge
+Analyzing complex logic vulnerabilities, raw SQL usage, insecure settings, and missing authentication/CSRF checks in Python-based web applications, and fixing them without breaking application compatibility.
+
+## 🛡️ The Solution & Hardening
+Audited code using Semgrep/Bandit and manual analysis. Patched SQL injections by migrating to Django ORM, resolved XSS with secure auto-escaping templates, secured authentication flows, enforced CSRF tokens, and delivered a complete PDF audit report.
+
+---
+
+## 📊 Summary of Identified Vulnerabilities & Solutions
+
+Below is a snapshot of the vulnerabilities identified during the audit and the remediation applied to secure them:
+
+| Vulnerability ID | Finding | Severity | OWASP Category | Remediation Action |
+|---|---|---|---|---|
+| **SEC-01** | Raw SQL Queries (SQL Injection) | **Critical** | A03:2021-Injection | Migrated raw database queries to parameterized **Django ORM** queries. |
+| **SEC-02** | Stored XSS in Comment Render | **High** | A03:2021-Injection | Removed the unsafe template bypass filter, allowing Django's auto-escaper to sanitize comments. |
+| **SEC-03** | Missing CSRF Verification | **High** | A01:2021-Broken Access Control | Replaced `@csrf_exempt` decorators with `@csrf_protect` on state-changing endpoints. |
+| **SEC-04** | Broken Access Control in Views | **High** | A01:2021-Broken Access Control | Added ownership verification checks to ensure authors can only edit/delete their own posts. |
+| **SEC-05** | Active Debug Mode in Prod | **Medium** | A05:2021-Security Misconfiguration | Configured dynamic configurations loading environment variables to disable debug in prod. |
+
+---
+
+## 🛠️ Secure Code Review Methodology
+
+### 1. Tool-Assisted Analysis (SAST)
+We ran automated Static Application Security Testing (SAST) tools to scan the Python code patterns:
+- **Bandit**: Identified hardcoded keys, active debug configurations, and insecure system calls.
+- **Semgrep**: Scanned for custom rules matching unsafe raw Django SQL queries.
+
+### 2. Manual Analysis (Line-by-Line Audit)
+We manually audited:
+- Input handling and query builders.
+- Template rendering files (checking for custom safe filters and JavaScript outputs).
+- View permissions (ensuring `PermissionDenied` exceptions are raised on unauthorized editing).
+- Session cookies settings.
+
+---
+
+## 📂 Deliverables & Reports
+
+- **Detailed Security Report**: You can read the full professional audit report containing in-depth vulnerability descriptions, proof-of-concepts, and risk analysis in the [Secure Code Review Report](Secure_Code_Review_Report.md).
+- **PDF Version**: A professional formatted PDF version of the report is available under `/reports/Secure_Code_Review_Report.pdf` (compile the Markdown file or check the release section).
+
+---
+
+## 🚀 How to Run the Security Analysis
+
+To replicate the automated security scans performed on this repository:
+
+### 1. Install Dependencies
+```bash
+pip install bandit semgrep
+```
+
+### 2. Run Bandit Scan
+```bash
+bandit -r blango/
+```
+
+### 3. Run Semgrep Scan
 ```bash
-$ django-admin.py startproject blango
+semgrep --config=auto blango/
 ```