DEV Community: Ananya

The weeks of Intentinal Building: My GSoC Midterm with OWASP Foundation

Ananya — Mon, 06 Jul 2026 05:00:00 +0000

Towards the Google Summer of Code midterm evaluation marks a quiet, reflective milestone in my journey with OWASP® Foundation and OWASP BLT. Over the past weeks, the daily rhythm of development has been about transforming a conceptual proposal into a living, working application. Moving from initial repository curiosity to managing a core project architecture has felt less like a sprint and more like a deliberate, step-by-step documentary of software crafting.

| |
| vanish.owaspblt.org

|

The Blueprint: What I Set Out to Build

My proposal focused on evolving BLT-Vanish into a proactive personal cybersecurity ecosystem by developing the Universal AI Identity Shield. The core philosophy centers on an explainable, local-first risk scoring platform designed to protect personal data in real time.

The technical challenge lies in maintaining a strict data boundary. Sensitive user information stays entirely on the user's device inside a Flutter application, while Cloudflare Python Workers are restricted to processing non-sensitive threat intelligence metadata. Preserving absolute data sovereignty on cross-platform systems sounds seamless in planning, but building it out end-to-end requires deep architectural precision.

The Craft So Far: Where the Code Stands

The project began visually, building a design system in Figma for the BLT-Vanish web page and application interfaces to set a clean, minimal user experience. From there, the core components fell into place:

Data Contracts: Established versioned schemas for Security Alerts, Risk Assessments, and Remediation Actions to keep the client architecture and edge logic locked and compatible.
Local Processing: Utilized Flutter to run an on-device testing ecosystem where URL extraction, expansion, and heuristic risk scoring run successfully.

A Lesson in Pacing and Resilience

Engineering is a deeply human process, and development does not always follow a linear path. During the third week, an unexpected health issue forced a hard pause on my remote repository contributions.

While the public commit graph remained quiet, I utilized my recovery windows to work offline on my local machine, mapping out URL expansion mechanics and refining the internal risk-builder logic. That phase taught me a vital lesson: meaningful progress is not always measured by public green squares, but by the clarity you bring to the architecture when solving problems on localhost.

Shared Horizons: The Community Behind the Code

I am incredibly grateful to Donnie for cultivating a supportive open-source ecosystem that simultaneously mentors GSoC contributors, social internship students, and new community members alike.

I am equally thankful to my mentor Ramansh Saxena. His precise code reviews, feedback on contract stability, and structural guidance have significantly elevated the engineering quality of this project.

The Next Chapter

The second half of the summer shifts from building foundational frameworks to reactive systems and external intelligence integration.

Right now, my focus is on completing the remediation platform to translate vulnerability data into actionable task checklists with automated reminders. From there, the roadmap points toward integrating data breach lookups via the Have I Been Pwned API using a privacy-preserving k-anonymity framework, deploying login anomaly tracking rules on Cloudflare Workers, and running full regression passes to ensure production readiness.

The structural groundwork is solid, the boundaries are drawn, and I am excited to bring the remainder of this digital guardian to life.

GSoC 2026 Weekly Update: Week 6 - Structuring Remediation and Preparing for the Midterm

Ananya — Mon, 06 Jul 2026 04:30:00 +0000

With the application now fully up and running, Week 6 has been about completing the foundational logic for user remediation and organizing the codebase as we head into midterm evaluations. The focus has shifted from single-feature implementations to designing how these systems interact, ensuring the work built so far translates into a cohesive user experience.

Completing the Remediation Architecture

The primary milestone for this week was finalizing the remediation orchestration system. This framework turns security risks into a structured lifecycle of tasks, converting vulnerabilities into actionable checklists that users can easily follow. Along with this task state machine, I integrated basic escalation logic. This applies clear priority statuses and reminders for unresolved issues, helping users stay proactive about their digital security posture.

To measure the overall health and accuracy of the application, I also implemented an internal metrics tracker. This component safely aggregates performance indicators, such as scan latencies and resolution success rates, providing a clear data baseline ahead of the midterm review.

Organizing the Code for Production

With the core features of the past few weeks built, the final task remaining for this week is the clean categorization and structuring of the repository. I am currently organizing the code blocks, directories, and configuration files so that the entire development history reflects cleanly and runs live as a singular ecosystem. Ensuring proper separation of concerns between our local frontend logic and serverless edge components is essential for maintaining long-term repository health.

Mapping Out the Triage for the App

As the project moves into the midterm evaluation window, I am already looking ahead to the upcoming week’s goals. The next major step is defining how these fragmented tools converge inside the user interface.

I am currently mapping out the design and state handling for a unified triage experience directly on the application's home screen. The objective for the coming days is to merge individual link scans and credential alerts into a single, cohesive timeline. This involves establishing clear priority routing and sorting logic so that the home screen becomes a functional, real-time command center for the user's digital footprint.

The foundational logic is locked, the app is stable, and I am looking forward to bringing the main dashboard experience to life next week.

GSoC 2026 Weekly Update: Week 5 - Credential Security & Midterm Horizon

Ananya — Mon, 29 Jun 2026 04:30:00 +0000

This week marks a major transition point as we fully finalized our Phase 1 calibration criteria and successfully kicked off the first leg of Phase 2, focusing strictly on local credential security.

Here is a simple look at what was built this week and how we are steering towards the upcoming Midterm Evaluation.

Week 5 Accomplishments

The core focus of this week was establishing secure local storage blueprints and expanding our in-app screens for user data protection.

Credential Screen & UI Progress: Built out the dedicated credential interface screen along with the majority of the supporting user experience layouts. This interface lets users easily track and input local credentials with visibility toggles.
Credential Storage Model Documentation: Successfully drafted the architectural documentation for our local vault storage model. This outlines exactly how user data stays entirely zero-knowledge, encrypted, and client-side using device-backed hardware security without plaintext exposure.
Phase 1 Calibration Closure: Formally wrapped up the threshold calibration documentation. This locks down the foundational baseline benchmarks, false-positive control criteria, and precision metrics evaluated during our initial risk engine tests.

Turning to Week 6 & The Midterm Evaluation

With the credential entry screens and documentation baselines established, the immediate next step is executing our Week 6 roadmap milestones to prepare for the formal GSoC Midterm Checkpoint.

Before the evaluation evaluation window closes, my focus will be centered on:

Remediation Orchestration: Implementing task state machines to convert identified vulnerabilities into prioritized account-hardening checklists.
Escalation Logic: Setting up priority status levels and overdue task reminders to guide users through risk resolution.
Midterm Metrics Aggregator: Gathering end-to-end data on scan latencies, precision baselines, and remediation completion rates to deliver a transparent, stable package for mentor walkthroughs.

We are officially reaching the halfway mark of the summer, and the project footprint is coming together exactly as planned. Looking forward to knocking out the Week 6 scaffolding and showcasing a rock-solid mid-point review!

GSoC 2026 Weekly Update: Week 4 - Security Center UX & Phase 1 Closure

Ananya — Mon, 22 Jun 2026 04:30:00 +0000

Marking the wrap-up of Phase 1! This week was all about bringing our system logic into the user interface and ensuring everything is thoroughly tested for our first major project milestone.

Here is a simple look at what was accomplished during this final stretch of Phase 1.

Security Center UX & In-App Testing

The primary focus in this week shifted toward user experience and establishing a robust environment to test our features in real-time.

Security Center Interface: Finalized the baseline user experience layout for the main Security Center screen, giving users a clear view of their data privacy status.
In-App Feature Validation: Set up the application infrastructure to allow seamless testing of core behaviors directly inside the app.
Local-First Verification: Ran active tests on our local-first data layer to verify that sensitive user info remains strictly on the device and operates properly offline (in-progress).
Alert Mechanics: Integrated and tested the visual security alert components to ensure that risk severity and context render clearly on the screen.

Preparing for Phase 1 Closure

With the core building blocks of the risk engine, schemas, and initial UI screens running locally, the remainder of the week was dedicated to consolidation.

Packaging Deliverables: Prepared all necessary documentation, test scripts, and scaffolding required to formally wrap up Phase 1.
Review Readiness: Aligned the current codebase with the initial roadmap goals to guarantee a stable, verifiable package for mentor review and evaluation.

What's Next?

With Phase 1 officially closed, the foundational visual and architectural blocks are locked in. Moving into next week, I will be starting Phase 2, which dives straight into credential hygiene, secure local storage vaults, and guided remediation workflows.

A huge thank you to my mentors for their continuous feedback throughout this first month! Let's keep the momentum going into the next phase. 💻🛡️

GSoC 2026 Weekly Update: Week 3 - Navigating Roadblocks

Ananya — Mon, 15 Jun 2026 04:30:00 +0000

This week brought an unexpected challenge, as a health issue forced me to step back, rest, and prioritize recovery.

Because of this, my remote repository didn't see active commits this week. However, health setbacks don't mean total zero-days. During the moments I felt better, I shifted my focus to offline development and local architecture design to keep the momentum going.

Here is a look at what I managed to build locally and how I am preparing for the next phase.

💻 Local Development: Refining the Service Models

Instead of pushing code, I spent my available energy working locally on the core logic and algorithmic foundations of the BLT-Vanish application.

URL Extraction & Expansion: Worked on refining the local mechanics that parse incoming links and handle redirect chains cleanly, ensuring that malicious shorteners can be evaluated without exposing user data to the web.
Risk Builder Engine: Developed the offline service model that acts as the fabric of our scoring system. This model combines local telemetry and feature signals into a structured, explainable risk profile. Focusing on these architectural blocks locally gave me a great chance to think through edge cases and code structure without the pressure of immediate deployment.

🛡️ Looking Ahead: Preparing for the Security Center

As I get back to 100% health, I used the end of the week to map out and prepare for our next major milestone: the Security Center integration.

The upcoming week will be all about bringing our local backend logic to life visually. I’ve prepared the foundation to start working on:

Integrating the manual paste workflows into the user interface.
Building the state management to handle loading, timeout, and offline fallback scenarios gracefully.
Creating the color-coded alert cards to make risk factors clear and actionable for the user.

Sometimes open-source means writing hundreds of lines of public code, and sometimes it means listening to your body, resting, and refactoring on localhost. Huge thanks to my mentors for the supportive environment. I'm excited to get back to the repository and start merging these core features in the upcoming week! 🚀

GSoC 2026 Weekly Update: Week 2 - Establishing Contracts & System Design

Ananya — Mon, 08 Jun 2026 18:29:48 +0000

Another productive week of Google Summer of Code with OWASP BLT is in the books! Building on the visual blueprints from last week, this week was focused on locking down our structural foundations and diving deeper into the system architecture.

Here is a simple breakdown of the progress made and what lies ahead.

Milestones

The primary goal for this phase was setting up the structural guardrails for how data travels through our app.

Finalized Security Contract Structures: Successfully established the foundational security contract structures. This ensures that our application components have a uniform, strict schema to communicate safely and predictably. trying to figureout some missing point on the security_alerts with the help of my mentor.
Merge request updates: Glad to share that the initial setup has been done across our repository through these milestones:
🔗 Merge Request #3
🔗 Merge Request #4
🔗 Merge Request #5
🔗 Merge Request #6

🧠 Current Focus: System Design & UI Polish

With the basic structures merged, my day-to-day focus has shifted toward high-level engineering and refining the user experience.

Architecture & System Designing: Spending time mapping out the data flows to ensure our local-first storage design works seamlessly with minimal, encrypted web updates.
Ongoing UI Revamp: Continuing to polish the user interface layouts based on our initial feedback, ensuring the experience feels clean, intuitive, and highly minimal.

⚡ The Next Step: Building the Workers

Now that the structural blueprints are active in the project, it is time to make them functional.

⚙️ Contract Workers: Moving forward, the next step is to start creating the edge contract workers. These workers will handle the actual validation and processing logic for the security contracts we just established.

The structural groundwork is officially laid, and the architecture is shaping up beautifully. Excited to bring the core backend logic to life next week! 💻🛡️

GSoC 2026 Weekly Update: Week 1 - BLT Vanish UI Design & Architecture

Ananya — Thu, 04 Jun 2026 16:36:41 +0000

Week 1 of Google Summer of Code is officially complete! This week, the major focus was translating our core project concepts into a visual reality, centering our efforts on creating a comprehensive Figma UI design for the BLT Vanish web page alongside deep-dive architecture discussions.

Here is a breakdown of the major work completed this week and the blueprint for what comes next.

🎨 Major Focus: Visualizing BLT Vanish

A significant portion of this week was dedicated to designing the homepage UI and strategically mapping out how to represent the core features of the app to the user. The goal was to build a clean, intuitive, and modern layout that clearly communicates our privacy-first tools.

🔗 Check out the initial design work here: BLT Vanish Figma UI Design

📋 Architectural & Core Feature Alignment

In parallel with the UI design, we finalized the foundational system architecture to support these features seamlessly across platforms.

📱 Cross-Platform Delivery: We aligned on using Flutter to build a cross-platform application capable of deploying smoothly across iOS, Android, and Windows.
🔒 Privacy-First Architecture: Data sovereignty is a core pillar of the project. The app will store data locally on the user's device. The absolute minimum amount of data will ever be sent to the web, and it will be handled strictly via secure, encrypted JSON files.

👥 Mapping the Core User Workflows

The homepage UI and backend architecture were optimized around two distinct user personas:

🔍 The Proactive Tracker: A user who actively keeps track of malicious websites, reports threats, and wants to secure their personal data and information from external exploits.
🔄 The Remediation Seeker: A user focused on data reclamation—specifically looking to request the removal of specific information from third-party sites and reporting platforms for breaching their data.

🛠️ Core Tech Stack

💻 Client Application: Flutter (iOS, Android, Windows)
⚡ Serverless/Edge Logic: Cloudflare Python Workers
📁 Data Transport: Encrypted JSON files for web-based interactions

⚡ The Next Step: Contracts & Scaffolding

With the UI foundation laid and the high-level architecture agreed upon, the next phase is all about turning these concepts into structured data contracts and initial application scaffolding:

📄 Security Blueprints: Drafting comprehensive security contract specifications to outline the formal structures for Security Alerts, Risk Assessments, and Remediation Actions.
⚙️ Validator Engines: Building worker contract validators and writing cross-language contract tests to ensure seamless data integrity between the edge and the application.
📊 Scoring Infrastructure: Setting up the foundational scoring service skeleton to handle core risk-assessment logic within the application.
🎯 Target Deliverable: A frozen Version 1 contract specification integrated with automated Continuous Integration (CI) contract tests.

The visual momentum is shifting into code. Looking forward to sharing next week's development milestones! 💻🛡️

GSoC2026 #OWASP #OpenSource #UIUX #Figma #Flutter #Cloudflare #SoftwareEngineering

📢 Calling all Content Writers & Community Builders!

Ananya — Sun, 03 May 2026 20:21:06 +0000

Hey everyone! We are opening up opportunities for everyone to contribute to our official social media channels. If you enjoy writing, sharing tech insights, or highlighting community wins, we want you on the BLT Newsroom team! 🗞️✨

Here is how the process works:

Topics & Deadlines: We will regularly share specific writing topics based on our current requirements, along with a submission deadline.
Submit Your Draft: Write your post based on the given topic and share your draft right here in the group before the deadline hits.
Review & Feedback: The lead project maintainer and social media maintainers will review all the submitted drafts.
Final Selection: The draft that gets the top reviews will be selected and published on the official OWASP BLT social media pages!

This is a fantastic way to build your portfolio, practice your technical writing, and get your work seen by a much wider audience. Keep an eye out for our first topic announcement soon! 🎨💻

Apply here: https://jobs.owaspblt.org/job.html?id=owasp-blt-content-writer
Join our slack community today!👉https://join.slack.com/t/owaspblt/shared_invite/zt-3rstz26wj-WtlZFo5RXqT_9UwNYJeycw
Then join the newsroom channel.

See you all with your first drafts here!

Accepted into GSoC 2026: From First PR to Official Selection

Ananya — Thu, 30 Apr 2026 18:17:01 +0000

If some had told me in my first year of university that I would be writing this post, I wouldn't have believed.

Today, I finally achieved a dream I have held onto for years: I’ve officially cracked Google Summer of Code 2026! with @owasp_foundation under OWASP BLT✨ It might seem like just another program to some, but for me, this is a dream coming true-a journey of collecting broken pieces, holding them together, and building something completely new.

🍂 The Beginning

Coming from a computer science background in high school to an unexpected core engineering major in university was a drastic shift. My first year was spent just trying to heal my lost confidence and survive the transition. I heard about GSoC back then, but since I wasn't involved in the tech community, it felt like a distant, impossible mountain.

The real struggle hit in my second year. The syllabus was exhausting. By the time my second year rolled around, I started peeking outside my core curriculum. I heard whispers of hackathons, open-source contributions, and got more involved in exploring this "famous" program called GSoC. I made my first attempt at GSoC by looking into organizations. I failed. I didn't have the knowledge of any tech stack, Git, or the skills to write those hundreds of lines of codes.

☕ The Turning Point

That failure was my wake-up call. During the summer break, I made a choice. I grounded myself, cut out the outside world, and sat at my desk for three months straight. I began participating in hackathons, doing LeetCode, and my open-source journey truly took off with GirlScript Summer of Code (GSSoC) 2025. That experience gave me the momentum and belief I needed to aim higher.

💻 The GSoC Grind

In October, I changed my strategy, dug through past archives, and found an organization that perfectly matched my new skills: OWASP BLT.

The struggle didn't end there. For the first few months, I had to work incredibly hard just to understand how a single line of code contributed to the final service on their homepage. But I stayed consistent. I opened my first PR, fixed bugs, and slowly became a constant contributor from October all the way through March, balancing my contributions with my core curriculum.

🤍 The Gratitude

This win is not mine alone. It belongs to the incredible people who believed in me:

To my Father and Mother: You are my strength. Your faith in me when I had none is why I am here.
My Circle: To the few friends who stood by me and fueled this journey.

I met incredible people in this organization. To our Lead Project Maintainer, @donnieblt : Thank you. Every single step I have taken in this organization was only possible because of your support. If you hadn't been there, I wouldn't have reached this level of excellence.

I am endlessly humbled and grateful to every energy out there that helped make this dream a reality.

Here is to new beginnings. 🥂

🎉First PR? Get paid for it

Ananya — Wed, 01 Apr 2026 18:55:05 +0000

Introducing Dollar Deletions — a special campaign only for first-time contributors.

We know large codebases can be intimidating, so we are paying you $1 for your first accepted Pull Request where you safely delete unused or legacy code.

👉 Why are we doing this?

We are preparing for a major migration! To do this safely, we need to thoroughly clear out the existing repository. Your deletions will help us sweep away all the old files so we can seamlessly move our brand-new system into the clean repo.

🧹 Clean up real production code
🧠 Learn how large codebases work
🚀 Make your first open-source contribution
💵 Earn your first dollar online

How it works

Find dead or unnecessary code in our repository.
Submit your first-ever PR to remove it.
Pass the code review (your changes must not break existing functionality).
Get $1 via GitHub Sponsors!

📌 The Rules

This campaign is only for first-time contributors to this repo.
Your PR must include a clear explanation of what you removed and why.
The code must remain fully functional after your deletion.
Limited to one reward per contributor.

🏆 Bonus: Referral Leaderboard!

Spread the word and climb the ranks! You can refer others to this initiative. Just have the PR mentioning that you are referring a contributor as @user1 refers @user2 and link that PR to our mega issue. This will track the mention and boost @user1's rank on our referral leaderboard.

💡Not sure where to start? Look for issues labeled good-first-deletion to get your bearings.

👉Start here: OWASP-BLT/BLT

Your first PR shouldn’t be scary—it should be rewarding. We can't wait to review your code!

The Architecture of Ideas: My GSoC 2026 Proposal Journey

Ananya — Wed, 01 Apr 2026 18:29:37 +0000

The Google Summer of Code 2026 application window has officially closed, and after a month of intense drafting, reviewing, and refining, I have finally hit "submit" on my three proposals.

The last 30 days have been a blur of markdown files, system architecture diagrams, and deep dives into codebases. Moving from an active contributor to a prospective GSoC student was a significant leap. It wasn't just about proposing new features; it was about thoroughly understanding the underlying architecture of the projects, aligning my ideas with the maintainers' long-term goals, and proving that I had the technical agility to execute the vision.

From Commits to Comprehensive Plans📝

Earlier, I wrote about the "momentum of the merge"—that rewarding shift from planning to actively living within the repositories. This past month put that momentum to the test. Writing distinct proposals meant compartmentalizing different problem spaces. It required me to step back from fixing immediate bugs and start thinking about the software lifecycle over a 12-week timeline.

I had to map out weekly deliverables, anticipate potential technical roadblocks, and clearly communicate my logic. It forced me to be objective about my skills and realistic about my timelines.

The Real Win 🏆

There is a unique kind of exhaustion that comes from writing a technical proposal, but it is heavily outweighed by the clarity it brings. Regardless of the final selection results, the growth over this past month has been invaluable. The gap between having a good idea and writing a resilient project plan is where the real engineering growth happens.

A huge thank you to the mentors who patiently reviewed my drafts and the communities that welcomed my initial pull requests. Now, the waiting period begins, but the daily rhythm of open-source contribution doesn't pause here.

Let’s keep building. 🚀

Let's have a deep dive on my idea that gave our OWASP BLT community a dashboard for navigation and detailed insight.

Ananya — Mon, 23 Mar 2026 17:27:34 +0000

Ananya

Mar 23

Visualizing the OWASP BLT Ecosystem: From Idea to the live Navigation 📊✨

#opensource #gsoc2026 #summerofcode #owaspblt

2 min read