Security final year project ideas
Security final year project ideas from the free Sefism library, each scoped for a single semester with a suggested stack and deliverables.
- 300 project ideas
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
73 ideas · page 1 of 4
Tamper-Resistant Dynamic Payment QR Display with Voice Confirmation for Small Shops
Printed payment QR stickers at small shops can be covered with a fraudster's sticker, and fake payment screenshots fool busy shopkeepers. Build a small counter device with a screen that shows a fresh, signed QR for each sale, and a speaker that announces confirmed payments only after the shop's own account receives them. Threat-model the attacks, build the device, and test it against sticker swaps and fake confirmations.
Privacy-First Legal Aid Intake and Case Routing for NGO Legal Clinics
NGO legal clinics and university law clinics in Pakistan, India, Nigeria and Kenya take requests by phone, walk-in and WhatsApp, and sensitive details about domestic abuse, labour disputes or police cases end up in personal phones and spreadsheets. Build a secure intake system with a guided form, issue classification into a standard legal taxonomy, routing to the right volunteer lawyer, and strict access control, encryption and audit logs. Threat-model it before writing code.
EU AI Act Risk Classification Questionnaire for Software Exporters
Software houses in Pakistan, India and Bangladesh build AI features for European clients, and the EU AI Act can apply to them even though they sit outside the EU. Build a guided questionnaire that walks a developer through the Act's structure (prohibited practices, high-risk categories, transparency duties, general-purpose AI), cites the exact article for every step, and produces a plain-language summary of likely obligations to discuss with a lawyer.
PII and Secret Leak Audit for LLM Chat Logs and Traces with Retention Rules
LLM apps log everything: prompts, retrieved chunks, tool results and answers. Those logs quietly fill up with phone numbers, CNIC numbers, addresses, API keys and other users' data. Build an auditor that scans existing LLM traces, finds personal data and secrets in English, Urdu and Roman Urdu, shows where each leak entered the pipeline, and enforces retention and masking rules going forward.
AI System Inventory and Risk-Tier Register for Software Companies
Most companies cannot answer a simple question: where are we using AI? Build an inventory and risk register that discovers AI use (features in the product, AI tools staff sign into, AI APIs in code and cloud bills), records an owner and purpose for each, assigns a risk tier from a clear rubric mapped to the NIST AI RMF and the EU AI Act, and schedules reviews. Designed for software houses that sell to clients abroad.
Roman Urdu Jailbreak and Policy Drift Red Team for Customer Service Chatbots
Customer service chatbots are tested in English, then deployed to users who write in Urdu, Roman Urdu and a mix of all three. Build a red-team harness that checks whether a bot stays inside its own written rules (no promises it cannot keep, no advice outside its remit, no leaking its instructions) when attacked in local languages and code-switched text, and produces a scorecard the business can act on.
Hallucinated Package Guard for AI Coding Assistants (Slopsquatting Defence)
AI coding assistants sometimes suggest packages that do not exist. Attackers can register those names and wait. Build a guard that checks every new dependency added to a project, by a person or an AI, against the real registry: does it exist, how old is it, who maintains it, does it look like a typo of a popular package, and was it suggested by an AI? It runs in the editor, as a pre-commit hook and in CI.
Raast Merchant Payments Integration Kit with Dynamic QR, Request to Pay and Reconciliation
Pakistan's Raast instant payment system supports merchant payments by QR code, alias and request to pay, but small businesses and developers struggle to connect it to their shops and invoices. Build an open integration kit: a simulated payment service provider API modelled on Raast's person-to-merchant flows, a merchant dashboard, dynamic QR generation per order, request-to-pay links and automatic reconciliation of payments to orders. Design it so a real provider's API could replace the simulator later.
Hidden Instruction Scanner for Documents Before They Enter a RAG Knowledge Base
Build an ingestion-time scanner that inspects PDFs, Word files, web pages and spreadsheets before they are chunked into a RAG knowledge base, and finds text a human cannot see but a model will read: white or tiny text, invisible Unicode, instructions hidden in metadata, alt text and comments. Suspicious files are quarantined with a highlighted preview so a person decides. It closes the door that indirect prompt injection walks through.
Buy Now Pay Later Stacking Tracker and Affordability Check Across Providers
Young shoppers in the Gulf, India and the UK often have several buy now pay later plans with different providers at once, and no single place shows the total due each month. Build a privacy-first mobile app that collects instalments from order emails, SMS or manual entry, shows a combined calendar of what is due, and runs an affordability check against the user's income and fixed costs before they take on another plan.
Content Credentials Checker for AI-Generated Images in Newsrooms
Newsrooms and fact-checkers receive images every day over WhatsApp and social media and must decide quickly whether they are real, edited or AI-generated. Build a desk tool that reads C2PA Content Credentials, checks for known AI watermarks and metadata, explains in plain language what can and cannot be concluded, and keeps a verification log for each image.
Student Mental Health Check-In App with Human Counsellor Escalation
Build a private weekly check-in app for university students that uses short, validated questionnaires, shows students their own trends and routes anyone who reports serious distress to a real person at the counselling service, fast. The software never diagnoses or gives therapy. The project is about the escalation path: who gets alerted, how quickly, what happens if nobody responds, and how student privacy is protected throughout.
Team-Wide MCP Configuration Inventory and Least-Privilege Auditor
Developers now plug MCP servers into Claude, Cursor, VS Code and other AI tools with a few lines of config, often with a full-access GitHub token, a whole home folder as the filesystem root, and an unpinned package run with npx. Build an auditor that collects MCP configurations across a team's machines, inventories every server and credential, scores each against least-privilege rules, and proposes a tighter config.
Signed Web Page Archiving for Journalists and Fact-Checkers with Verifiable Captures
Build a self-hostable tool that captures a web page or social post exactly as it appeared, packages it in an open archive format, signs it and timestamps it, so anyone can later verify who captured it and when. Posts and pages are deleted or edited within hours, and screenshots are easy to fake. This gives newsrooms and fact-checkers evidence that holds up.
In-Browser Document Redaction for ID Cards, Bank Statements and Medical Reports
Build a web app that finds and removes personal details such as CNIC numbers, account numbers, phone numbers, addresses and names from PDFs and photos entirely inside the browser, using on-device OCR and small models, so the file never leaves the phone. People share copies of ID cards and bank statements with landlords, employers and agents every day, usually unredacted. The hard part is true redaction that removes hidden text, not black boxes drawn on top.
Mule Account Detection with Graph Machine Learning for Mobile Wallets
Build a simulator of a mobile wallet payment network with realistic scam and mule account patterns, then train and compare graph machine learning models that flag accounts used to collect and move stolen money. Scam proceeds in Pakistan often pass through chains of wallet accounts opened with borrowed or bought identities. Rules catch known patterns; the project tests whether learning from the shape of the money flow catches more, and explains each flag to an analyst.
Signed Build Provenance Gate for a Company's Internal Packages and Container Images
Build a gate that lets a small company prove every internal package and container image was built by its own CI from a reviewed commit, and blocks anything that was not. It uses keyless signing from the Sigstore project and SLSA-style provenance, wrapped into a setup a team can adopt in an afternoon. Deployments and installs check the signature and the build record before they proceed.
Power-Cut-Resilient Programming Lab Exam Server That Runs on the Local Network
Build a self-hosted exam system for university programming labs that runs on a single server inside the lab, saves every keystroke-level change so no student loses work when power or Wi-Fi drops, runs code in sandboxes for automatic test results, and gives invigilators a live view of the room. Load-shedding, unstable internet and shared lab machines make online exam platforms fragile in Pakistani universities. The hard parts are crash-safe saving, fair resumption and safe code execution.
Synthetic Patient Records Generator with a Privacy Attack Report for Hospital Data Sharing
Build a tool that takes a hospital table, generates synthetic records with several methods, and then attacks its own output to measure how much real patient information leaks. Hospitals want to share data with students and researchers, and synthetic data is often sold as automatically private. This project produces a report that shows both the usefulness and the privacy risk of each synthetic dataset before anyone shares it.
Video-Observed TB Treatment App with Offline Upload for Patients and Treatment Supporters
Build an Android app that lets a tuberculosis patient record a short video of taking each day's medicine, stores it encrypted, uploads it when there is signal and lets a treatment supporter review doses and follow up on missed ones. Daily in-person observation is hard for patients who work, live far from a clinic or have to travel. The project follows the model of a published randomised trial and focuses on making it work on cheap phones and poor connections.
Home and Small Office Network Device Audit on a Raspberry Pi
Build a Raspberry Pi box that a family or small office plugs into their router to find every device on the network and check it for the common problems: default passwords, open remote access, outdated firmware and unencrypted traffic. Results come as a short plain-language report with fixes for each device. It is aimed at cheap cameras, routers and smart plugs that nobody ever updates.
Kubernetes Network Policy Generator With Pre-Apply Connectivity Tests to Stop Lateral Movement
Build a tool that watches which services in a Kubernetes cluster actually talk to each other, generates least-connection network policies from that traffic, and tests them in CI against the expected connectivity before they are applied, so nothing legitimate breaks. Most clusters run with no network policies at all, which lets an attacker who breaks into one pod reach every database and internal API. This makes locking them down safe enough to actually do.
Signed, Staged OTA Updates with Automatic Rollback for ESP32 Device Fleets
Build a self-hostable update system for small fleets of ESP32 devices that signs every firmware image, rolls updates out in stages, checks device health after each update and rolls back automatically when something goes wrong. Small IoT companies in Pakistan and elsewhere ship devices with no safe way to fix bugs in the field, or with update schemes that a single bad build can brick. The project applies the security ideas behind automotive update frameworks at a scale a startup can run.
Phone Spyware Check Kit for Domestic Abuse Support Workers, in English and Urdu
Build a laptop-based kit that a trained support worker uses to check a survivor's Android phone for stalkerware, risky dual-use apps, unknown device admins and account access the survivor did not set up. It runs over a USB cable without installing anything on the phone, and explains results in plain English and Urdu. It follows the clinical computer security approach developed by researchers at Cornell Tech.
Browse project ideas by domain and difficulty
Each of these is its own page, so you can send someone straight to the AI ideas or the beginner ones.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com
Follow along
New writing, resources and project ideas land here first.