Website
CybESphere
Non-profit platform bringing Spain's cybersecurity conferences and events together in one place, with a map, filters and alerts. I owned project security from the design stage: threat modelling before any code, two continuous integration pipelines with static and dependency analysis, and dynamic testing against the deployment. Five vulnerabilities came out, two critical, and all were fixed before production.
Why the code is not here
The code sits in private repositories while the platform is still in beta.
Why it exists
Spain has dozens of cybersecurity conferences and meetups a year, and finding out about them depends on who you follow on social media. People outside the circuit miss the one happening next door, and whoever organises a small one competes for attention with the four big names.
CybESphere brings them together in one place, with a map, filters and alerts. It is non-profit and the project has several hands on it, so the idea is not only mine.
My part
I handled security, and from the design stage rather than at the end. Before there was any code we ran a threat model to decide what needed protecting and from what, which is when that conversation is cheap.
Then I set up two separate pipelines: one for static analysis of the code and one for dependencies. Separate because they fail for different reasons and at different rates. If an alert about a transitive dependency with no patch available also blocks the analysis of your own code, somebody switches off the whole pipeline.
Plus dynamic analysis against the running deployment, which is where the things that depend on how the server is configured show up rather than how the code is written.
Outcome
Five vulnerabilities, two of them critical, found and fixed before anything reached production. The number that matters to me is not the five, it is the before.
The infrastructure runs on a virtual server with the network locked down, inside a private network, with an agent shipping logs to the monitoring centre in my lab. That gives the project real monitoring without paying for it.
Two controls withdrawn
I put in two controls the team was working around by the second week, and I removed them myself. One was a fifteen-minute pipeline, which in practice gets skipped. The other threw twenty alerts of which two mattered, and an analysis like that gets ignored wholesale.
On a small project the hard part is not configuring the control, it is keeping it out of the way. Tuning them so the team would actually use them took me longer than setting them up.
Status
In beta and reachable. The code sits in private repositories while the platform settles.