# 🔒 Defensive Web Security — Supporting Skill for Web

> Docs: [README](../README.md) • [Full-Stack](full-stack.md) • [Stack](tech-stack.md) • [AI](ai-integrations.md) • [Security](defensive-security.md) • [Linux](linux-systems.md) • [Other](other-skills.md) • [Contributions](../CONTRIBUTIONS.md) • [Q&A](qa.md)

> **Document control** — Owner: Islam El-Nashar • Last verified: 18 Oct 2026 • Scope: defensive hardening I apply to my own sites.
> Main profile stays web. This file holds security details so the README does not mix roles.
> Position: web developer who hardens his own sites, not a pentester for hire.

---

## 1. What I do in web projects

- **Auth:** JWT HttpOnly cookies, bcrypt hashing, middleware-protected routes
- **Hardening:** XSS escaping, CSRF SameSite, Zod validation, rate-limit, secure headers
- **Applied as patterns** in current web work (see `islam-elite-portfolio` and `TurboQuant` for live code)

## 2. Research (defensive only)

- Guide: [AndroidReverseEngineering-Guide](https://github.com/aslamalkarywk7/AndroidReverseEngineering-Guide) (6 stars, most-starred among my repos — small scale, educational)
- Removed: Bitbucket workspace link (returns 404) — skill text kept, link deleted.

## 3. Honest scope

- No pentest client work, no CTF rank, no security certificate to claim.
- For hiring: hire me to build a hardened website, not for a Security Engineer role.