The journey of Google Summer of Code has come to an end.
It is hard to believe how quickly the past few months have gone. When I first started contributing to OWASP BLT, I was simply trying to understand an unfamiliar open-source project and find a way to make my first meaningful contributions. I did not expect that journey to eventually lead me to GSoC and to working on BLT University.
My journey with OWASP BLT started before GSoC, when I took my first steps into open source and began learning how to contribute to an existing project. I gradually became more comfortable with the codebase, the contribution process, and working through reviews and feedback. I documented those early experiences in my earlier post about getting started with open source.
Over the course of the program, BLT University evolved significantly. What started as a small collection of interactive security labs grew into a broader security learning platform with interactive labs, courses, learning tracks, vulnerability insights, saved progress, recommendations, and automated browser testing.
I shared the first half of my work in my midterm post. This final report brings together everything I built during GSoC, from the first interactive labs to learning tracks, vulnerability insights, saved progress, and browser tests.
BLT University is now a static, interactive learning platform with 13 labs, five courses, two tracks, and a dashboard built from recent public vulnerability records. Progress is stored locally. You can explore the live website, try the SQL injection lab, or explore the Security Trends dashboard.
Demo video
What I built
Over the course of GSoC, the project grew from a small set of interactive security labs into a broader learning platform.
- Built the first interactive SQL injection, XSS, and CSRF simulations using the Identify, Explain, Fix flow. MR 1
- Added the lab structure, validation script, contributor guide, reusable template, and automatic validation. MR 2
- Updated the main site pages and layouts to improve navigation, responsiveness, and consistency. MR 3
- Added tests for validators, state changes, hints, saved progress, and lab simulation flows. MR 4
- Added the IDOR lab and its guided simulation. MR 5
- Added six more security labs, expanding the initial lab collection. MR 6
- Added the complete Identify, Explain, Fix simulations and reorganised the lab engine into focused files. MR 8
- Built the NVD and CISA vulnerability pipeline, CWE-to-OWASP lab mappings, schema validation, pipeline tests, and the generated 90-day dataset. MR 10
- Hardened the lab engine, improved saved-progress handling, reorganised validation code, and documented the engine behaviour. MR 11
- Added AST validation for JavaScript lab answers, tests that reject unrelated code containing expected security keywords. MR 12
- Built the Security Trends dashboard with charts, search, filters, a CVE explorer, text fallbacks, and progress-aware lab recommendations. MR 13
- Added Cyber Hygiene and Professional Security tracks, three Cyber Hygiene labs, track filters, course-to-lab navigation, and adaptive recommendations. MR 14
- Expanded five courses with interactive activities and related labs, then added saved progress, streaks, badges, next-course suggestions, and cross-browser tests. MR 15
Future enhancements
- Automate regular vulnerability-data updates while keeping validation and review checks.
- Add more courses and labs across both learning tracks.
- Improve lab-authoring tools so contributors can create exercises more easily.
- Expand accessibility and browser testing across complete learning journeys.
- Add Python-based exercises and more adaptive hints.
Acknowledgements
I would like to thank Google Summer of Code, OWASP, and the entire OWASP BLT community for giving me this opportunity and supporting me throughout my journey. A special thank you to Donnie Brown for his guidance, feedback, and support throughout the project. I am grateful to have worked with and contributed to this community.
Top comments (1)
Great work! 🎉