Project case study · Application & cloud security
Strengthening security in Pulse
Pulse is my website health checker, built to help small businesses understand how their websites perform and what needs improving.
As I prepared it for production, I strengthened security across the scanner, report storage and deployment process.
Protecting the scanner
A key focus was how Pulse handles website addresses. A public scanner could be misused to request internal services, so I added URL validation, checks for private network addresses and validation of redirect destinations. Timeouts, download limits and rate limiting also help reduce abuse and excessive resource use.
Protecting scan reports
I improved how scan reports are protected. Reports are now stored on the server and tied to the browser session that created them, using random identifiers and protected cookies. Knowing a report’s URL alone does not grant access from another browser, and report access expires after a configurable period.
Keeping emailed reports authentic
The email flow uses those same protections. Before sending a report, the server checks ownership and expiry, then uses the stored results. This prevents someone from changing scores or recommendations in their browser and submitting them as an authentic report.
Strengthening AWS deployment
I also strengthened the AWS deployment configuration with encrypted storage, restricted permissions and GitHub OIDC authentication, avoiding long-lived AWS deployment keys. Production deployments include automated checks and health verification.
Respecting privacy
Privacy was part of the work too: product analytics record usage events without storing IP addresses, browser user agents or scanned website URLs.
A stronger foundation
These changes give Pulse a stronger foundation as it grows, while keeping the experience simple for the people using it.