Cashy

Overview

Cashy was an academic cybersecurity project focused on evaluating the security of a personal finance application.

The work involved analyzing the application's attack surface, identifying potential vulnerabilities, evaluating their impact and proposing concrete mitigation strategies.

• ACADEMIC SECURITY PROJECT

The problem

The objective was to identify security weaknesses that could affect sensitive financial and user information and to evaluate how those risks could be reduced.

The analysis required looking beyond isolated vulnerabilities and understanding how different parts of the application could affect confidentiality, integrity and access control.

My role

I worked on the security analysis of the application, including:

• Defining the assessment scope
• Identifying potential attack surfaces
• Analyzing vulnerabilities
• Evaluating risk and impact
• Documenting findings
• Proposing remediation measures

• SECURITY ANALYSIS
• THREAT MODELLING
• VULNERABILITY ASSESSMENT
• RISK ANALYSIS
• REMEDIATION

Approach

The assessment followed a structured security-analysis process.

Potential entry points and relevant application components were reviewed, and identified weaknesses were evaluated according to their possible impact.

OWASP security principles were used as a reference when reviewing common application-security risks. Each relevant finding was documented together with its potential impact and a proposed mitigation.

Security analysis

The project required understanding how data moved through the application and identifying where security controls, validation or authorization could become relevant.

The analysis considered how different application components interacted and where weaknesses could expose sensitive information or functionality.

Challenges

One of the main challenges was distinguishing technically relevant findings from issues with limited real impact.

Security analysis required understanding not only whether a weakness existed, but also how it could realistically affect the application and how it should be prioritised.

Result

The project produced a documented set of security findings together with risk evaluations and proposed mitigation measures.

The final analysis provided a structured view of the application's main security concerns and possible improvements.

What I learned

Cashy reinforced the importance of evaluating security findings in context rather than treating every technical issue as equally critical.

It also strengthened my understanding of vulnerability analysis, risk prioritisation and the importance of communicating remediation steps clearly.