Project 03

BinsuredHere

Secure invitation lifecycle

I implemented the private invitation workflow, including random token generation, HMAC storage, expiry and validation, resend rotation, secure cookies, consent auditing, and atomic database consumption.

Visit live website

Selected work

What I built

Stored HMAC verifiers instead of raw invitation tokens.
Rotated invitations on resend and enforced expiration.
Used constant-time validation and secure cookie attributes.
Made single-use consumption atomic with a conditional MySQL update.