The journey of GSoC has come to an end. Time flew by. It feels like I was accepted only yesterday, and now it is already time to write my final report.
I shared the first half of my work in my midterm post. This final report brings together everything I built during GSoC, from the first interactive labs to learning tracks, vulnerability insights, saved progress, and browser tests.
BLT University is now a static, interactive learning platform with 13 labs, five courses, two tracks, and a dashboard built from recent public vulnerability records. Progress is stored locally. You can explore the live website, try the SQL injection lab, or explore the Security Trends dashboard.
Demo video
What I built
Over the course of GSoC, the project grew from a small set of interactive security labs into a broader learning platform.
- Built the first interactive SQL injection, XSS, and CSRF simulations using the Identify, Explain, Fix flow. MR 1
- Added the lab structure, validation script, contributor guide, reusable template, and automatic validation. MR 2
- Updated the main site pages and layouts to improve navigation, responsiveness, and consistency. MR 3
- Added tests for validators, state changes, hints, saved progress, and lab simulation flows. MR 4
- Added the IDOR lab and its guided simulation. MR 5
- Added six more security labs, expanding the initial lab collection. MR 6
- Added the complete Identify, Explain, Fix simulations and reorganised the lab engine into focused files. MR 8
- Built the NVD and CISA vulnerability pipeline, CWE-to-OWASP lab mappings, schema validation, pipeline tests, and the generated 90-day dataset. MR 10
- Hardened the lab engine, improved saved-progress handling, reorganised validation code, and documented the engine behaviour. MR 11
- Added AST validation for JavaScript lab answers, tests that reject unrelated code containing expected security keywords. MR 12
- Built the Security Trends dashboard with charts, search, filters, a CVE explorer, text fallbacks, and progress-aware lab recommendations. MR 13
- Added Cyber Hygiene and Professional Security tracks, three Cyber Hygiene labs, track filters, course-to-lab navigation, and adaptive recommendations. MR 14
- Expanded five courses with interactive activities and related labs, then added saved progress, streaks, badges, next-course suggestions, and cross-browser tests. MR 15
Future enhancements
- Automate regular vulnerability-data updates while keeping validation and review checks.
- Add more courses and labs across both learning tracks.
- Improve lab-authoring tools so contributors can create exercises more easily.
- Expand accessibility and browser testing across complete learning journeys.
- Add Python-based exercises and more adaptive hints.
Acknowledgements
I would like to thank Google Summer of Code, OWASP, and the entire OWASP BLT community for giving me this opportunity and supporting me throughout my journey. A special thank you to Donnie Brown for his guidance, feedback, and support throughout the project. I am grateful to have worked with and contributed to this community.
