Santiago SantofimioSantiagoSantofimio

A web cybersecurity escape room. The player is locked inside the internal network of Kryptelia Systems, a fictional company, and escapes department by department by exploiting a real vulnerability in each one. It takes about 10 minutes to play, on a phone too, and without DevTools.

• After each room, a debrief explains the flaw with the vulnerable and the fixed Java side by side, its OWASP Top 10 category and how to catch it in a real system.
• Safe by design: the vulnerabilities are real in their logic, but they only operate on simulated resources. Nothing the player types starts a process, touches a file or makes an outgoing request.
• Tests prove the SQL injection can't read files, define functions or change data, plus 44 Playwright browser tests, including a full playthrough.

• Java 21
• Spring Boot
• H2
• JUnit 5
• React
• TypeScript
• Docker

A personal finance app for iPhone that works offline and without a server: every record stays on the phone. It installs from Safari like any other app.

• Income, expenses, monthly budgets per category and a daily spending chart.
• Encrypted backups with AES-GCM and PBKDF2, using only the Web Crypto API.
• Built to feel native on iOS: draggable sheets, its own numeric keypad and dark mode.

• React
• TypeScript
• Vite
• Vitest
• PWA
• IndexedDB

A URL shortener with click stats, custom aliases and expiring links. The interface is a split-flap departures board.

• A Spring Boot REST API that redirects with a 302 and answers 410 once a link expires.
• Every destination is validated: dangerous schemes, internal networks and disguised IP addresses are blocked.
• Per-IP rate limiting, random codes from SecureRandom and deletion protected by a token.

• Java 25
• Spring Boot
• JPA / Hibernate
• React
• TypeScript