system online ▮

Kaninnat Phuangla-or Network Security

ICT student at Mahidol University (Network Security) building real, running security systems — network intrusion monitoring, AWS threat detection with automated response, and packet-level analysis. Everything below is deployed, measured, and honest.

View projects GitHub ↗ LinkedIn ↗
Kaninnat Phuangla-or
// BKK · TH
scroll
01 / Projects

Deployed & measured.

TARGET LOCKED terraform apply output showing modules provisioning AWS resources TERRAFORM · VPC 10.0.0.0/16 VPC PUBLIC SUBNET 10.0.1.0/24 EC2 AL2023 IGW SSH 22 ← /32 0.0.0.0/0 :22 DENIED 3 MODULES · NETWORK / SG / COMPUTE VIEW CODE ↗
PRJ-004 · IACLIVE

Terraform AWS Secure Infrastructure

Infrastructure-as-Code provisioning a hardened AWS network foundation — VPC, public subnet, internet gateway and route table, with SSH ingress locked to a single /32 instead of the world. Split into network, security-group and compute modules.

0
modules
/0
ssh ingress
/0
vpc cidr
GitHub
TARGET LOCKED CIS benchmark audit output showing all checks passed CIS BENCHMARK AUDIT — LINUX ROOT LOGIN DISABLED [OK] KEY AUTH ONLY ENFORCED [OK] FIREWALL ZONE ACTIVE [OK] 5/5 CHECKS PASSED BASH · AUDIT + REMEDIATE · IDEMPOTENT VIEW CODE ↗
PRJ-005 · LINUXLIVE

Linux CIS Hardening

Bash tooling that audits a Linux server against CIS Benchmark controls and reports pass/fail per check — disabling direct root login, enforcing key-based SSH, and bringing the host firewall under an explicit zone.

0/5
checks passed
0
root logins
0
firewall zone
GitHub
TARGET LOCKED Checkov scan results showing passed and failed policy checks CHECKOV 3.3.10 — TERRAFORM SCAN BEFORE 19 PASS · 9 FAIL AFTER 24 PASS · 4 FAIL CKV_AWS_79 IMDSv2 ENFORCED FIXED CKV_AWS_8 EBS ENCRYPTED FIXED CKV_AWS_382 EGRESS 80/443 FIXED 5 FIXED · 4 DOCUMENTED AS ACCEPTED VIEW CODE ↗
PRJ-006 · DEVSECOPSLIVE

Checkov Terraform Scan

Static security analysis of the PRJ-004 Terraform code — enforced IMDSv2, encrypted the EBS root volume, scoped egress to 80/443, locked the default security group, and disabled public-IP auto-assign. The four remaining findings are documented with the reasoning for accepting each.

0
findings fixed
0/28
checks passing
0
accepted risks
GitHub
TARGET LOCKED GitHub Actions workflow running Terraform validation and Checkov scan GITHUB ACTIONS — ON PUSH / PR ↑ PUSH fmt -check STEP 1 validate STEP 2 checkov STEP 3 needs: needs: GATE: FAIL FAST ON MISFORMAT · INVALID · FINDING TERRAFORM 1.15 · CHECKOV · AUTOMATED EVERY COMMIT VIEW CODE ↗
PRJ-007 · CI/CDLIVE

CI/CD Security Pipeline

GitHub Actions workflow that runs terraform fmt -check and validate on every push and pull request, then gates a Checkov scan behind validation passing. A broken config fails fast instead of burning a full security scan — closing the loop from PRJ-004 and PRJ-006 into enforcement.

0
pipeline stages
0%
commits scanned
0
manual steps
GitHub
TARGET LOCKED Figma design of the admin product management interface FULL-STACK CRUD — ADMIN CONSOLE BROWSER HTML/CSS/JS EXPRESS REST API MYSQL STORAGE CREATE READ UPDATE DELETE CRUD reCAPTCHA v2 GATE SESSION AUTH · 2 ROLES VIEW CODE ↗
PRJ-008 · WEBTEAM

K-pop Product Management

Full-stack inventory system built by a five-person university team on Node/Express/MySQL. I owned the front end and UX — designing the layouts in Figma, building the storefront and admin pages, and wiring reCAPTCHA v2 into the login flow including token reset on validation errors.

0
team size
0
crud ops
0
auth roles
GitHub
TARGET LOCKED Before and after evidence of the stored XSS fix APPSEC REVIEW — OWASP TOP 10 npm audit 9 VULN · 1 CRIT after fix 0 VULN STORED XSS · HIGH · 3 FILES - el.innerHTML = product.name + el.innerHTML = escapeHtml(product.name) FOUND BY MANUAL REVIEW — NOT BY THE SCANNERS READ REVIEW ↗
PRJ-009 · APPSECAUDIT

Front-End Security Review

A security review of the front-end code from PRJ-008, done after submission on code I wrote myself. Found stored XSS across three product-rendering files by manual OWASP review — neither npm audit nor eslint-plugin-security caught it — and fixed it with output escaping. Cleared 9 dependency vulnerabilities, triaged 4 scanner warnings as false positives, and reported an out-of-scope back-end issue to the team.

0
dep vulns
0
xss files fixed
0
false positives
Security report GitHub
swipe / scroll
02 / About

Signal, not noise.

03 / Contact

Open channel.

kaninnat.phu@gmail.com
GitHub ↗ LinkedIn ↗
— touchdown · bangkok, earth —