⚠️ PUBLIC ARCHIVE — PLEASE READ BEFORE DOING ANYTHINGThis repository is submitted as part of a DevSecOps assignment for Revrag.ai. It is made public for evaluation purposes only.
- ❌ Please do not open Pull Requests
- ❌ Please do not submit Issues
- ❌ Please do not fork and re-submit
- ✅ You are welcome to read and learn from it
This project audits an insecure Docker and GitHub Actions CI/CD setup inherited from a previous engineer at a simulated startup. The Node.js application code was not modified — only the surrounding infrastructure was hardened.
| File | Changes Made |
|---|---|
Dockerfile |
Pinned base image, non-root user, no secrets, no SSH port, .dockerignore added |
.github/workflows/deploy.yml |
Secrets moved to GitHub Secrets, Trivy scan added, Cloudflare Tunnel deploy, SHA-pinned actions |
SECURITY_AUDIT.md |
Full audit report — every issue, why it's a problem, and how it was fixed |
REFLECTION.md |
Personal reflection on AI-assisted learning during this assignment |