Lab Hub
← All projects

OWASP Lab: Vulnerable and Fixed

planned

A deliberately flawed training app and its fixed twin. Runs on localhost only.

Stack

  • Express
  • EJS
  • SQLite
  • GitHub Actions
  • OWASP ZAP

Links

Local only. This project is never deployed publicly.GitHub repo

Architecture notes

Goal

Learn to find and fix common web flaws on an app I own, on my own laptop.

Architecture

  • VulnNotes: Express + EJS + SQLite, bound to 127.0.0.1, with a red warning banner.
  • VulnNotes-Fixed: the same app with each flaw fixed and covered by tests.
  • GitHub Actions runs CodeQL, npm audit and an OWASP ZAP baseline scan against the fixed app only.

Key decisions

  • Never deployed. This project stays on localhost by design, so it has no public address.
  • Every flaw is tagged with a // VULN-n comment and listed in the README.