OWASP Foundation

Mentors: Student: Abhay Bansal

OWTF's current architecture has four systemic bottlenecks: workers that sit idle between single-task fetches, a FIFO scheduler with no priority or adaptive feedback, fragile plugin execution with no retry or timeout control, and an outdated tool ecosystem missing industry-standard scanners. This project replaces the flat task queue with a priority-based adaptive scheduler using a min-heap, where tasks are scored by plugin weight, risk factor, target priority, and a real-time feedback boost that re-prioritizes the queue when vulnerabilities are discovered. The worker model is upgraded with batch fetching, async pre-fetching, dynamic scaling, and target-affinity batching to eliminate idle gaps. A resilient execution harness adds configurable timeouts, retry with exponential backoff, subprocess isolation, and structured logging to every plugin run. Five modern tools are integrated using a self-contained plugin pattern: Nuclei, httpx, Subfinder, Katana, and ffuf. Deliverables: working adaptive scheduler, optimized worker pool, resilient plugin harness, five new tool plugins, HTML reporting with CVSS severity grouping, and comprehensive benchmarks showing measurable improvements in scan time and coverage.

Mentors: Student: Sakshee suman

BLT University is an interactive security learning platform built on top of OWASP BLT that transforms existing labs into hands-on, code-driven exercises. It migrates the current Django-based labs into a static Jekyll system where content is stored and rendered as Markdown, making it more scalable and easier to maintain. Instead of static, theory-heavy content, users work directly with vulnerable code through a structured Identify → Explain → Fix workflow to understand how vulnerabilities appear and how to fix them in practice. The project also includes GitHub Actions workflows for validation and syncing, along with a security intelligence pipeline that analyzes GitHub issues, pull requests, and review comments to identify recurring vulnerability patterns. These insights power a dashboard and a recommendation system, helping connect real-world security issues with relevant labs and improve hands-on learning for contributors. It aims to help contributors build a practical security mindset while improving the quality of open-source contributions.

Mentors: Student: sawankshrma

DSOMM's Angular frontend currently runs on Angular 13, a version that reached end-of-life in 2023 and is eight major versions behind the latest release. This project migrates the application to Angular 21 through three workstreams: 1. An incremental version upgrade, 2. Adoption of Angular Signals to replace imperative state management, and 3. Packaging key views as Angular Elements for third-party embeddability. The migration follows Angular's official upgrade path, with tests and documentation updated at every step, leaving the codebase in a state that future contributors can build on rather than work around. #dsomm

Mentors: Student: samyak003

This proposal outlines modernization of Pygoat, focusing on scalability and a future-proof curriculum. The top priority is a complete structural and gamified overhaul, featuring a dynamic scoring system and a lab list updated for OWASP Top 10:2026. This is supported by a new Core API Gateway and a Dynamic Admin Control Center, which together allow for seamless, real-time monitoring of dockerized labs and centralized management of user data and security categories. A key innovation is the Plugin-Based Custom Lab Loader, allowing the community to integrate their own labs via a standardized labs.json format. To ensure long-term accessibility, the project includes a Tailwind CSS UI migration, automated CI/CD pipelines for multi-platform Docker builds, and a comprehensive MkDocs documentation hub. By bridging the gap between exploiting a vulnerability and implementing secure coding practices, these features provide a structured, professional, and engaging learning path for the new security developers.

Mentors: Student: ashike25

OWASP FinBot is a security learning tool that lets people practice attacking AI agent systems in a safe environment. Right now it only teaches how to attack. There is no way to practice defending. This project adds the defending side. I will build a system that watches what an AI agent does at key points, checks if the action looks safe or dangerous, and blocks or flags it if needed. I will also add a scoring system that gives points to defenders when they successfully stop an attack. On top of this, I will create five hands-on challenges where learners can practice both attacking and defending the same scenario. One extra challenge will cover a situation where a tool the agent uses turns out to be malicious. The final output includes the detection and blocking system, the scoring system, five paired challenges, example config files, full documentation, and a complete test suite.