Work in progress
Security
A living showcase where I attack my own site on purpose and show what happens - the payload, the response, and the defense that stops it. Reading the code is one thing; watching it refuse a real attack is another. The demos below are being built.
-
Reflected XSS
soonFeed hostile <script> into inputs and URLs. User data is rendered with textContent only, so it should stay inert.
-
SQL injection
soonClassic ' OR 1=1 payloads against search and login. The backend uses SeaORM's parameterised queries, so they land as literal strings.
-
CSRF / forged session
soonTamper with and replay the session cookie. It is httpOnly and signed, so a forged cookie is rejected - there is already a live test for exactly this.
-
Admin gating
soonHit /api/admin/* while signed out or as a non-admin. Every handler re-checks server-side: 401 or 403, no data leaks.
-
Rate limiting
soonHammer the write and buy endpoints past the limiter and watch it answer 429 instead of falling over.
-
Bot and path guards
soonAim junk paths and bot user-agents at the analytics collector and confirm they are filtered out, not stored.
Nothing here targets anyone else's systems - it is only ever pointed at this site, running on my own hardware.