Defensive Practice
Security Labs
Hands-on security practice as part of my backend and DevSecOps learning journey.
I study application security through labs and project work — authentication, access control, vulnerability scanning, and container security. This page documents what I have practiced, not claims of professional specialization.
Introduction
I approach security as part of responsible software development: understanding risks, practicing safer defaults, and documenting what I learn through projects. This page complements my full-stack and learning work by showing how I apply security thinking to the applications and systems I build as my practice expands into backend, infrastructure, and DevSecOps work.
Learning Roadmap
My focus is moving from application work into backend-oriented systems, infrastructure, and security practice. This roadmap separates what I have already practiced, what I am actively refining, and what I plan to study next.
Application Security (Completed Basics)
Core web application security concepts I have practiced through labs and implementation work.
DevOps & Infrastructure Foundations (Completed Basics)
A practical foundation in Linux, Git, and Docker that supports my backend and DevSecOps learning.
Currently Practicing
My current focus is on applying the foundations I have built in containers, automation, and deployment workflows to more complete security and DevSecOps practice.
Planned Topics
Upcoming areas I want to study more deliberately as my practical experience grows.
Current Focus Areas
I am building practical familiarity with the tools and workflows that connect development, deployment, and security operations, especially around containers, automation, and runtime protection.
Practice Areas
Security topics I practice as part of my backend and DevSecOps learning path.
Identity & Access
Authentication and authorization are where users, roles, and trust boundaries meet. I practice these topics so my full-stack projects handle access decisions more intentionally.
Web Application Security
Most security issues I encounter as a developer start in everyday web flows: forms, sessions, headers, validation, and route protection.
Database Security
Database safety is part of application design. I practice query boundaries and validation so user input does not become unsafe data access.
Network Defense
Network defense is a planned learning area to understand what happens below the application layer, especially how firewalls and IDS/IPS tools observe traffic.
DevSecOps
I am learning how security checks fit into build, deployment, and maintenance workflows instead of being treated as a final step.
Cloud Security
Cloud security is a planned learning area focused on configuration, least privilege, logging, and safer deployment habits.
Hands-on Labs
Each lab is written as practice evidence: what was practiced, why it mattered, what was learned, and where supporting notes belong. They are meant to show growth and validation, not polished claims.
JWT + RBAC Practice
Identity & Access
- Demo implementation in SafeTrip Explorer PH repository
- Role-based route restrictions on backend endpoints
- Hashed password handling in user authentication
- Session validation and token expiration logic
- Tokens need expiration to limit exposure windows.
- Role checks should protect both UI routes and server actions.
- JWT structure and claims affect security posture.
CSRF Protection and Validation Practice
Web Application Security
- Token checks in form submissions
- Validated form input handling
- Security header configuration notes
- Before-and-after request review documentation
- CSRF is about trusted browser sessions being reused unintentionally.
- Validation should happen before data reaches storage.
- Security headers reduce risk but do not replace secure code.
OWASP ZAP Testing Practice
Web Application Security
- Generated scan results and reports
- Reviewed alerts with risk prioritization
- Documented fixes and configuration changes
- Remediation notes for identified issues
- Not every alert has the same risk level.
- Reports become useful when mapped to concrete fixes.
- Automated tools complement but do not replace manual review.
CI Security Scanning Practice
DevSecOps
- CodeQL workflow in .github/workflows/codeql.yaml
- Trivy scan step in the Node CI workflow
- SAST checkpoint in DevSecOps-Learning-Lab
- CodeQL, Trivy, and container security checkpoint notes
- A passing scan is evidence of a configured check, not proof that software is secure.
- Findings need review rules before they can safely block deployment.
- Security automation is more credible when linked to workflow files and checkpoints.
OPNsense / Suricata NIDPS Lab
Network Defense
- OPNsense firewall configuration and rule management
- Suricata IDS/IPS setup and alert generation
- Network traffic analysis and alert interpretation
- Virtual lab environment setup and isolation
- Set up a virtual network with OPNsense firewall between segments
- Configure Suricata rules and test alert generation with simulated traffic
- Practice alert triage and determine which alerts require action
- Document firewall rule changes and their impact on network behavior
SQL Injection Detection / Restriction Lab
Database Security
- Unsafe input test cases and results
- Restricted risky query patterns
- Safer query examples with parameterization
- Documented database access patterns
- Escaping alone is easy to misuse and error-prone.
- Parameterized queries keep user input separate from SQL structure.
- Input validation adds defense-in-depth but does not replace secure queries.
Engineering Journal
Notes from building and reviewing the labs. These are intentionally written as engineering observations, not marketing claims.
Certificates & Badges
Verified records are separated from current and planned learning.
Verified Certificates
Completed certificates of completion or formal course records.
Introduction to Critical Infrastructure Protection
OPSWAT Academy
"Covered fundamentals of protecting critical infrastructure, IT vs. OT environments, and specific industrial cyber threats."
Verified Digital Badges
Verified badges are listed separately so they are not confused with certificates.
ISC2 Candidate
ISC2 via Credly
"Demonstrates commitment to the cybersecurity profession and adherence to the ISC2 Code of Ethics."
Current Learning
In-progress learning items only.
Planned Learning
Future learning goals that are not presented as completed credentials.
Cyber Threat Intelligence Certificate
Monash University / OpenLearning
"Future objective to deepen understanding of threat actor behaviors and intelligence gathering."
Introduction to Cybersecurity
Cisco Networking Academy
FCF Cybersecurity
Fortinet
Philosophy
I believe secure software is built through consistent practice, curiosity, and continuous improvement. These labs document concepts I have practiced while learning secure software engineering. They represent my engineering journey rather than claims of professional security specialization.