DY.SECURITY FIELDWORK LET'S TALK
CASE FILE / WEB PLATFORM

WEB PLATFORM / IN DEVELOPMENT

Secure Portfolio Platform

A Flask portfolio and content-management application with database fallbacks, contact protections, response headers, and public-page contract tests.

CASE STUDY6 TECHNOLOGIES
Technical systems artwork for Secure Portfolio Platform

SYSTEM QUESTION

Treat portfolio content, contact submission, administration, and deployment adapters as distinct boundaries with explicit controls and tests.

A public site combines untrusted form input, authenticated administration, mutable content, database variability, and multiple runtime entry points.

DIRECT ANSWER

What does Secure Portfolio Platform do?

A Flask portfolio and content-management application with database fallbacks, contact protections, response headers, and public-page contract tests. It addresses a public site combines untrusted form input, authenticated administration, mutable content, database variability, and multiple runtime entry points.

ROLE & SCOPE

ROLE EVIDENCE

The inspected repository establishes implementation and test artifacts but does not establish an individual contributor role.

AUDITED SCOPE

The audited slice covers Flask routes, contact CSRF and throttling, response headers, project persistence, database-manager selection, runtime entry points, and public-page tests.

CONSTRAINTS

The contact limiter is process-local, and deployment configuration does not by itself prove a live production deployment.

ARCHITECTURE

  1. 01

    boundary

    Flask routes and templates

    serve public, blog, contact, project, and administrative views

    app.py
  2. 02

    internal

    Unified models

    select database-manager implementations and normalize project records

    models/project_model.py
  3. 03

    data

    MySQL or Supabase

    persist managed content through selected database adapters

    database_manager.py
  4. 04

    external

    Runtime entry points

    run the Flask application as a Gunicorn web service on Render

    render.yaml

TRUST BOUNDARIES

  1. BOUNDARY 01

    Browser to contact handler

    Names, addresses, subjects, and message text enter validation, persistence, and mail paths.

    app.py
  2. BOUNDARY 02

    Application to database provider

    Content records cross either a MySQL connection or Supabase client and REST paths.

    database_manager.py

SECURITY DECISIONS

RISKCONTROLSOURCE

Cross-site or automated contact submissions.

The contact POST validates a session token, applies a per-client process-local limit, and bounds input lengths.

app.py

Browser interpretation and framing of public responses.

An after-request hook sets content-type, frame, referrer, content-security, and conditional transport headers.

app.py

IMPLEMENTATION EVIDENCE

  1. sourceapp.py

    Public and security controls

    The Flask application implements route handling, CSRF checks, throttling, validation, and response headers.

  2. sourcemodels/project_model.py

    Content persistence

    Project records retain integer route compatibility and select provider-specific database managers.

  3. testtests/test_public_pages.py

    Public-page contracts

    The pytest suite exercises public pages, contact markup, project details, blog views, and shared not-found rendering.

  4. sourcerender.yaml

    Render deployment definition

    The Render Blueprint runs the Flask app with Gunicorn, selects Supabase, and configures the health check.

VERIFIED OUTCOMES

  1. The public route and sparse project-detail contracts are executable in pytest.

    tests/test_public_pages.py

  2. The project model supports MySQL and Supabase-oriented persistence paths without changing its public methods.

    models/project_model.py

OPEN HARDENING

  1. 01

    Move contact throttling to shared storage before relying on it across multiple processes.

    app.py