I find the bugs that let strangers into your app.
Then I fix them.

The analyze endpoint fetched any URL a visitor supplied, including internal services behind the firewall. Added domain validation.

User-submitted project tags were injected into a dropdown as raw HTML. One malicious tag could run script in every visitor's browser.

Markdown link URLs could break out of their HTML attribute and inject script into rendered pages.

Any logged-in user could mark any other user's inventory as sold just by guessing IDs. Added an ownership check.

Note downloads weren't scoped to the owner: anyone with an ID could download other students' private notes.

OAuth logins didn't validate the state parameter, leaving the login flow open to CSRF.

The frontend never attached the JWT to outgoing API requests, so authentication silently failed across the app.

Token hashing called a function that was never defined, so the flow crashed at runtime. Replaced with real bcrypt hashing.

Private .pem key files were committed to the public repository. Removed them from tracking before they could be abused.

The contact form had no rate limit, an open relay for spam floods. Added per-IP rate limiting.

One user could click upvote five times and self-verify their own report, defeating community verification entirely.

Malformed string escapes crashed the language's lexer with a raw stack trace instead of a proper error.

Weekly simulations intermittently failed with a MongoDB VersionError: documents were read outside the transaction session, causing concurrency conflicts.

A scroll handler referenced an element that exists on 7 of 17 pages, so JavaScript crashed on the other 10.

The VS Code extension's "Run Project" command was a silent no-op from the Command Palette. Wired it to the actual runner.

Driver bids called the wrong API path and always came back empty. Fixed the repository path.

The backend never called load_dotenv(), so its .env configuration was silently ignored in every environment.