Project Roulette / Projects

Mobile and Security projects

5 of 30 projects. Each has a stack, five features to ship, a difficulty, a time estimate, and a bonus challenge.

Mobile · Intermediate · 2–3 weeks

Offline-first Field Inspection App

A mobile app for technicians who inspect equipment on site: checklists, photos, and signatures that work with no signal and sync later.

  • React Native (Expo)
  • TypeScript
  • SQLite
  • Supabase

Features

  1. Dynamic checklist templates loaded from the server
  2. Photo capture with on-image annotation
  3. Local-first storage with background sync and conflict handling
  4. Signature capture and PDF report export
  5. GPS-tagged inspections

Bonus: A small web admin dashboard where managers create templates and review submitted inspections.

Mobile · Intermediate · 2 weeks

Bluetooth LE Sensor Companion App

A phone app that discovers a Bluetooth Low Energy sensor, streams live readings, keeps a history, and sends settings back to the device.

  • Flutter (Dart)
  • flutter_blue_plus
  • SQLite
  • ESP32 or nRF52 as the peripheral

Features

  1. Scan, connect, and auto-reconnect to the device
  2. A custom GATT service and characteristics that you define
  3. Live charts of incoming readings
  4. Local history with CSV export
  5. Write settings like sample rate and thresholds back to the device

Bonus: Firmware updates delivered over Bluetooth straight from the app.

Security · Intermediate · 1–2 weeks

Git Secrets Scanner & GitHub Action

A CLI and GitHub Action that scans repositories, including full commit history, for leaked API keys, passwords, and private keys.

  • Go
  • Regex + entropy analysis
  • GitHub Actions
  • SARIF

Features

  1. Pattern and entropy-based secret detection
  2. Fast scanning of the full Git history
  3. Allowlist file to suppress false positives
  4. SARIF output that shows up in GitHub code scanning
  5. Pre-commit hook mode that blocks leaks before they happen

Bonus: A seeded test corpus that reports precision and recall, compared against an existing open-source scanner.

Security · Intermediate · 1–2 weeks

SSH Honeypot with Attack Dashboard

A fake SSH server on a cheap cloud VM that records the logins and commands real attackers try, shown on a live dashboard.

  • Python (asyncssh) or Go
  • Docker
  • PostgreSQL
  • Grafana
  • GeoLite2

Features

  1. Fake shell that imitates a Linux machine and logs every command
  2. Analytics on the most common passwords and commands
  3. World map of where attempts come from
  4. Strong isolation: its own VM, a container, and no outbound network
  5. Automatically generated weekly threat summary

Bonus: A write-up analyzing one week of real attack data, published alongside the repo.

Security · Advanced · 2 weeks

End-to-End Encrypted File Sharing

Share files by link, with encryption done in the browser so the server never sees file contents or keys.

  • TypeScript
  • Web Crypto API
  • Node.js or Go
  • S3-compatible storage

Features

  1. AES-GCM encryption in the browser, with the key kept only in the URL fragment
  2. Chunked streaming encryption for large files
  3. Links that expire or stop after a set number of downloads
  4. Optional password protection with proper key derivation
  5. A written threat model in the README

Bonus: A verification page that shows the stored ciphertext is unreadable without the link.