SE4030 Secure Software Development – Vulnerability Identification & Security Fixes

*SE4030 – Secure Software Development | SLIIT* This video presents our complete security assessment and remediation work for **Harvest Lanka**, a full-stack digital marketplace designed to connect agricultural producers, commercial buyers, and transport logistics providers. As part of the SE4030 Secure Software Development assignment, our team conducted a comprehensive security audit using multiple security testing methodologies, including: 🔹 *Software Composition Analysis (SCA)* npm audit RetireJS OWASP Dependency-Check Analysis of frontend and backend dependencies 🔹 *Secret Scanning* Git history analysis Git Pickaxe (`git log -S`) Identification of exposed credentials in the repository history 🔹 *Dynamic Application Security Testing (DAST)* OWASP ZAP Identification and verification of security misconfigurations 🔹 *Static Application Security Testing (SAST) & Manual Code Review* Source-code analysis Authentication and authorization review Data-flow analysis Business-logic security assessment Our audit identified **20 distinct vulnerabilities across 8 OWASP Top 10 categories**, with selected vulnerabilities analyzed and remediated as part of the assignment. 🔐 Vulnerability Remediation The demonstration covers the vulnerabilities assigned to our team members, including issues related to: Authentication and authorization Broken access control and IDOR Mass assignment and privilege escalation Unrestricted file uploads and stored XSS Dependency vulnerabilities Cryptographic and security configuration issues Other application-level security weaknesses For each selected vulnerability, we demonstrate the original vulnerability, proof-of-concept/testing, the implemented security fix, and post-fix verification. 🛡️ Secure Software Development Lifecycle We also discuss security practices that can help prevent similar vulnerabilities during software development, including: Automated secret scanning Dependency vulnerability auditing SAST DAST Secure coding practices Principle of least privilege Secure-by-default configurations Security integration within CI/CD pipelines 🔑 OAuth 2.0 / OpenID Connect As required by the assignment, we also demonstrate the implementation architecture for: *OpenID Connect (OIDC) on top of OAuth 2.0* using the: *Authorization Code Grant Flow with PKCE* The implementation uses Google as the OpenID Connect identity provider and demonstrates the integration of authentication into the application. 👥 Project *Application:* Harvest Lanka *Module:* SE4030 – Secure Software Development *Institute:* SLIIT *Project Type:* Full-Stack Web Application Security Audit & Remediation This video demonstrates our vulnerability discovery, security testing, remediation, verification, secure development practices, and OAuth/OIDC implementation as required for the