Hey, I’m Keerit ✳
Exploring the intersection of cybersecurity and code.
Learning by building. Making every project count.
A CLOSER LOOK / SECURE PYTHON
Scroll through the process.
See the thinking. Read the source.
THE QUESTION
A security review starts with careful reading. I traced how a local Python demo handled credentials, serialized data and subprocesses, then recorded the risks with Bandit and manual inspection.
THE REWRITE
The hardened implementation uses salted password hashing, JSON parsing and an allow-list for diagnostic commands. Here’s the actual validation function from my project.
THE HANDOFF
I turned the review into a report that connects each finding to its risk and a practical fix. The same approach carries through my web, API and phishing-awareness work.
### SC-01 - Hard-coded password- **Severity:** Medium- **Location:** `DATABASE_PASSWORD`- **Risk:** Secrets stored in source code can be exposed through repositories, backups, logs, or shared files.- **Fix:** Use environment variables or a secret-management service. Do not commit credentials. ### SC-02 - Weak password hashing (MD5)- **Severity:** High- **Location:** `create_password_hash()`- **Risk:** MD5 is fast and unsuitable for password storage, making password-guessing attacks more practical if hashes are exposed.- **Fix:** Use a dedicated password-hashing method such as Argon2, bcrypt, scrypt, or PBKDF2 with a unique salt and appropriate work factor. ### SC-03 - Unsafe deserializationdef load_preferences(serialized_data: str) -> dict[str, Any]: """Use JSON for data exchange and validate the expected structure.""" parsed = json.loads(serialized_data) if not isinstance(parsed, dict): raise ValueError("Preferences must be a JSON object.") return parsed 01 SCOPE & METHODOLOGY Local educational Python demo 02 FINDINGS & RISK Credentials · hashing · deserialization · subprocesses 03 REMEDIATION Safer patterns, with a hardened implementation 04 SUPPORTING EVIDENCE Manual review notes and Bandit scan Report overview · summarized from the project READMEDON’T JUST READ IT. TRY IT.
My Python function accepts a JSON object and rejects other shapes. Try this browser demonstration of the same check.
Read load_preferences() ↗Demonstrates parsing and object-type validation. It does not run Python or validate individual fields.
01 / SELECTED WORK
Real projects. Clear thinking.
A collection that keeps growing.
From an intentionally vulnerable Python demo to a hardened rewrite, with every security decision documented.
A careful look at transport security, browser protections and information exposure in a public training environment.
Exploring data minimisation and access controls through a non-intrusive review of a public demo API.
Making email threats easier to recognise through side-by-side examples and practical prevention guidance.
An approachable training module that turns phishing red flags into everyday security habits.
Follow what I’m building next.
Explore my GitHub ↗02 / A LITTLE ABOUT ME
I’m Keerit. I’m exploring how systems work, where they break, and how to make them safer. My work brings together hands-on security analysis, Python code reviews and clear explanations of technical risks.
I like turning complex questions into something practical: an evidence-backed assessment, a safer implementation, or a guide someone can actually use.
Building my next projects and deepening my understanding of network and application security.
03 / THE JOURNEY SO FAR
Learning, applying, documenting.
Then doing it all again.
Applied security concepts through practical projects, technical documentation and a secure Python code review.
Delivered projects in web vulnerability assessment, phishing detection and API security risk analysis.
Sharjah, United Arab Emirates.
GOOD THINGS START WITH A CONVERSATION
A project, an opportunity, or a shared curiosity.
I’d love to connect.