Security Labs

Built to understand.
Documented to share.

Hands-on security experiments in isolated environments. Public code, documented decisions and evidence you can explore.

✦ Application security lab

Três Portões

Three security gates. One working pipeline.

A hands-on lab with Gitleaks, SonarCloud and OWASP ZAP in GitHub Actions. Built against OWASP Juice Shop, with documented failures, fixes and evidence from real pipeline runs.

Explore the lab View on GitHub

PUBLIC LAB / OWASP JUICE SHOPFrom pull request to runtime

01
GitleaksSecrets in commits
Gate
02
SonarCloudCode & quality checks
Gate
03
OWASP ZAPRuntime baseline scan
Gate

GitHub Actions → Isolated lab → Published evidence

CI/CD
GitHub Actions
Gitleaks
SonarCloud
OWASP ZAP
Docker

Defensive security lab

Posto de Observação

An isolated Cowrie honeypot and Suricata IDS lab, with Alloy, Loki and Grafana for log collection and analysis.

Cowrie
Suricata
Grafana

Mobile security lab

Android ContentProvider Exposure

An educational InsecureShop lab exploring ContentProvider permissions, APK analysis with JADX and a separate Kotlin app to demonstrate unintended data access in a controlled Android emulator.

Android
Kotlin
JADX
InsecureShop

3 published labs · Independent, isolated environments.

Built to understand.Documented to share.

Três Portões

Posto de Observação

Android ContentProvider Exposure

Built to understand.
Documented to share.