Student Management System

The Problem

Schools and small institutions often manage student records in spreadsheets or ageing desktop software — no live access, no analytics, no way to search or export data without opening a specific machine. My own 2024 Java Swing + Oracle project had exactly this problem: a single-window desktop app with a hardcoded database password and no path to the web.

Architecture & Approach

Rebuilt the entire system as a layered Spring Boot service — Controller → Service → Repository → Entity, with DTOs isolating the persistence model from the API. Roll numbers are now generated from a database sequence in a @PrePersist hook instead of random strings, eliminating collisions entirely. The frontend is a zero-build vanilla JS dashboard with server-side pagination, sortable columns, bulk delete, live search, one-click CSV export, and an analytics view with course/branch distribution charts and a top-performer spotlight. Shipped with a full MockMvc integration suite, GitHub Actions CI, hardened security headers (CSP, X-Frame-Options, nosniff), and a Dockerized deploy to Render backed by Neon PostgreSQL.

Engineering Challenges & Solutions

• Migrating off a hardcoded Oracle password and random roll-number generation to environment-driven config and sequence-based, collision-free roll numbers
• Keeping a single codebase deployable on both a zero-setup local H2 database and a production Neon Postgres instance via Spring profiles, without duplicating logic
• Composing pagination, sorting, and search against the same repository layer safely — whitelisting sortable fields so no raw client string ever reaches a query
• Disabling the destructive bulk-delete endpoint specifically in production via a feature flag, so the public demo can't be wiped by a stranger

Outcome & Results

A fully deployed, publicly testable Spring Boot application with 11 REST endpoints, an integration test suite running in CI on every push, interactive Swagger docs, and a live analytics dashboard — a complete rewrite of a 2-year-old desktop project into a portfolio-grade, cloud-native service.

Lessons Learned

Rewriting old code is often more revealing than writing new code — every shortcut in the original (hardcoded secrets, unvalidated input, random IDs) became a concrete lesson in what production-ready actually means, and fixing each one mapped directly onto the AppSec instincts I want to carry into every project after this.