← All selected workPERSONAL PROJECT / ARCHITECTURE, RISK AND SECURITY

MassTracker

Fitness-tracking application: security architecture, risk assessment and treatment, audit, remediation, retesting and improvement.

Period
2026
Project type
PERSONAL PROJECT / ARCHITECTURE, RISK AND SECURITY
Role
Security architecture and a cross-functional security workflow covering risk, data protection, assessment, treatment, remediation and correction validation.

Context and challenge

A personal fitness-tracking application used to connect architecture, business risk, data protection and technical controls. The case follows findings through treatment and correction retesting.

Demonstration

Demonstration captures to follow

Project screenshots and videos will be added after review for public release.

  • Security architecture
  • Application assessment
  • Findings and risks
  • Correction validation

Key decisions

  • Separate application zones and control their flows.
  • Combine code, dependency, secret, running-application and configuration assessment.
  • Connect findings to risk scenarios and treatment decisions.
  • Verify corrections through retesting.

Contribution: from assessment to improvement

  1. Scope and baseline

    Define scope, assets, data, dependencies and the application attack surface.

  2. Analysis and evaluation

    Analyse and evaluate risk scenarios with ISO/IEC 27005 and EBIOS RM; contextualise vulnerabilities and prioritise treatment.

  3. Treatment decisions

    Document treatment choices, security requirements, data protection and continuity/recovery needs.

  4. Remediation and implementation

    Combine SCA, SAST, secret scanning, DAST and container/configuration review; link each finding to a remediation action.

  5. Checks, retests and evidence

    Repeat checks after correction and retain validation evidence and remaining findings.

  6. Residual risk and improvement

    Compare baseline and retest results on a consistent scope; reassess residual risk and feed lessons into the next cycle.

Outcomes and deliverables

A dossier connecting architecture, technical findings, risk scenarios, treatment decisions, remediation and retests. Data protection requirements, security policy and continuity complement the application work.

Deliverables

  • Security architecture dossierAvailability to be agreed
  • Assessment and remediation reportsAvailability to be agreed
  • Risk and treatment registerAvailability to be agreed
  • Continuity and recovery strategyAvailability to be agreed
  • Security policy and data protection requirementsAvailability to be agreed

Frameworks and tools

  • OWASP
  • SAST / SCA / DAST
  • Semgrep
  • Gitleaks
  • OWASP ZAP
  • Trivy
  • ISO/IEC 27001 / 27005
  • EBIOS RM

Public scope

Personal project covering architecture, risk assessment and treatment, remediation, validation and improvement. Aggregate outcome indicators can be presented while protecting secrets, internal parameters and personal data.

Last reviewed: 25 October 2026

Discuss this work