Minimal and modern developer portfolio template built with Next.js - intentionally vulnerable for educational purposes.

THIS REPOSITORY CONTAINS INTENTIONAL SECURITY VULNERABILITIES

This is a demonstration repository for teaching GitHub Advanced Security features. It includes:

• Exposed secrets and API keys
• Vulnerable dependencies
• Insecure code patterns

DO NOT USE THIS CODE IN PRODUCTION

Files to review:

• .env - Environment variables with exposed secrets
• config.js - Hardcoded API keys and credentials

What will be detected:

• Stripe API keys
• AWS credentials
• Azure connection strings
• GitHub tokens
• Database passwords

Expected behavior: GitHub Secret Scanning will automatically detect these patterns and create alerts in the Security tab.

Files to review:

• package.json

Vulnerable dependencies included:

• axios@0.21.1 - Known CVE for Server-Side Request Forgery
• lodash@4.17.19 - Multiple security vulnerabilities
• express@4.17.1 - Potential security issues
• next@12.0.0 - Outdated version
• react@17.0.2 - Outdated version

Expected behavior: Dependabot will:

1. Scan dependencies on push
2. Create alerts for known vulnerabilities
3. Automatically open pull requests with suggested updates

Vulnerable API endpoints:

• File: pages/api/user-search.js
• Vulnerability: User input directly concatenated into shell command
• Attack example: username=admin; rm -rf /

• File: lib/db.js
• Vulnerability: Unsanitized user input in SQL queries
• Attack example: username=admin' OR '1'='1

• File: pages/api/download.js
• Vulnerability: Unrestricted file path access
• Attack example: filename=../../../../etc/passwd

• File: pages/api/display-message.js
• Vulnerability: Unsanitized user input rendered in HTML
• Attack example: message=<script>alert('XSS')</script>

Expected behavior: CodeQL will trace data flow from user inputs to dangerous sinks and create security alerts.

• Node.js 14+ installed
• GitHub account with Advanced Security enabled
• Git configured locally

1. Push code to GitHub:

git add .
git commit -m "Add security demo scenarios"
git push origin security-for-beginners

2. Enable Advanced Security features:

   • Go to repository Settings → Security & analysis
   • Enable Dependency graph
   • Enable Dependabot alerts
   • Enable Dependabot security updates
   • Enable Secret scanning
   • Enable Code scanning (CodeQL analysis)

3. View security alerts:

   • Navigate to Security tab
   • Check "Code scanning" for CodeQL alerts
   • Check "Secret scanning" for exposed credentials
   • Check "Dependabot" for vulnerable dependencies

1. Remove hardcoded secrets from code
2. Use environment variables properly
3. Add .env to .gitignore
4. Rotate exposed credentials
5. Use GitHub Secrets for CI/CD

1. Review Dependabot PRs
2. Test updated dependencies
3. Merge security updates
4. Configure Dependabot settings

1. Command Injection: Use parameterized commands or allowlists
2. SQL Injection: Use prepared statements/parameterized queries
3. Path Traversal: Validate and sanitize file paths
4. XSS: Sanitize user input, use React's built-in escaping

• GitHub Advanced Security Documentation
• CodeQL Documentation
• Secret Scanning Patterns
• Dependabot Documentation

After working through this demo, you should understand:

1. How GitHub automatically detects security vulnerabilities
2. The difference between Secret Scanning, Dependabot, and CodeQL
3. How to interpret and remediate security alerts
4. Best practices for secure coding
5. How to configure security policies for your repositories

Remember: This repository is for educational purposes only. Never deploy vulnerable code to production!