CS 499 ePortfolio — SNHU
Computer Science graduate from Southern New Hampshire University, specializing in full stack web development with the MEAN stack — building secure, scalable applications from database to UI.
Introduction
My name is Khem Raj Khatiwada, and I am completing my Bachelor of Science in Computer Science at Southern New Hampshire University, with a specialization in full-stack web development. This self-assessment reflects on my growth across the Computer Science program, describes the specific technical accomplishments I have produced in CS 499, and explains how my work addresses the four program learning outcomes. The artifact at the center of my ePortfolio is the Travlr Getaways full-stack web application, originally built during CS 465 using the MEAN stack — MongoDB, Express.js, Angular 18, and Node.js — and substantially enhanced across three categories in this capstone course: software engineering and design, algorithms and data structures, and databases. Taken together, these enhancements demonstrate that I can design and build secure, efficient, and maintainable web applications that meet professional standards.
Throughout the Computer Science program, I developed collaborative skills through a variety of structured team and peer-engagement activities. In CS 250 (Software Development Lifecycle), I practiced Agile ceremonies, including sprint planning, daily standups, and retrospectives, and learned to clearly communicate progress and blockers to teammates with different roles and backgrounds. In CS 320 (Software Testing, Automation, and Quality Assurance), peer review of test cases and code quality reports taught me how to give and receive constructive feedback without personal friction — a skill that has direct parallels in the professional code review process. In CS 499, the iterative dialogue with my instructor across six modules of milestone submissions, feedback, and revisions modeled the kind of ongoing collaborative communication that characterizes professional software teams. When my Milestone Three submission was graded as not meeting expectations, I analyzed the specific feedback, implemented four targeted corrections, documented what had changed and why in a revised narrative, and resubmitted with a clear explanation — demonstrating the ability to collaborate productively even when receiving critical feedback. The code review video I produced in Milestone One was also an exercise in professional communication directed at a diverse audience: I narrated technical findings clearly enough for both technical reviewers and non-specialist observers to follow the analysis and understand the planned improvements.
Designing, developing, and delivering professional-quality communications has been a consistent theme across the program. In CS 305 (Software Security), I produced a formal vulnerability assessment report for a simulated client, Artemis Financial, adapting technical findings about dependency vulnerabilities, SSL configuration, and SHA-256 checksum verification into language appropriate for a business audience. In CS 465 (Full Stack Development I), I produced API documentation and design diagrams explaining the MEAN stack architecture to a mixed audience of developers and course reviewers. In CS 499, I produced a code review video, three milestone narratives, multiple journal entries, and this self-assessment, each requiring a different register and level of technical detail. The Milestone Three narrative had to explain MongoDB index internals — B-tree structure, field-order constraints, regex scan behavior — precisely enough for a technical reviewer to verify the correctness of my claims, while remaining readable to someone without deep database expertise. The revised Milestone Three narrative was also an exercise in intellectual honesty: I had made an incorrect claim about O(log n) performance for regex-based queries, and the revised narrative corrected that claim with a precise explanation of why unanchored regular expressions cause collection scans regardless of index presence. Communicating technical corrections clearly and without defensiveness is a professional skill that this program has helped me develop.
The algorithms and data structures category of my ePortfolio directly demonstrates this outcome through the Milestone Three enhancement. The original Travlr Getaways application retrieved all trip documents from MongoDB on every request using Trip.find({}) with no filter arguments, performing an O(n) full collection scan and then filtering results client-side in JavaScript — an approach that would become increasingly slow as the trip collection grew and that transferred unnecessary data over the network on every request. My enhancement introduced three MongoDB indexes: a compound index on resort and start date fields, a single-field index on name, and a single-field index on perPerson. The compound index on resort and start is the most significant: it allows MongoDB to satisfy both the filter and the sort for the most common query pattern — finding trips at a specific resort in chronological order — in a single B-tree traversal rather than a full scan followed by an in-memory sort. The design required careful attention to field order: a compound index on { resort: 1, start: 1 } only benefits queries that sort in that exact order, and my initial submission had the sort reversed, which prevented the index from being used for sorting. The revision also replaced unanchored case-insensitive regular expressions with exact string matching, because regex patterns cannot be evaluated using B-tree index entries and force a collection scan regardless of index presence. Server-side pagination was added to cap response sizes at 50 documents per request, and the Angular frontend was updated to consume the new paginated response structure. This full-stack change demonstrates the ability to analyze algorithmic complexity, select appropriate data structures, implement them correctly, and evaluate the trade-offs involved — in this case, the trade-off between search flexibility (regex) and index utilization (exact match).
The software engineering and databases enhancements together demonstrate this outcome most directly. For Milestone Two, I implemented role-based access control across the full MEAN stack application. The enhancement added a role field to the Mongoose User schema with enumerated values (admin, editor, viewer) and a default of viewer, updated the JWT generation method to embed the user's role in the token payload, and created an Express checkRole middleware that implements a role hierarchy — admins can perform all operations, editors can create and update trips, viewers have read-only access. The middleware returns HTTP 401 for missing tokens and HTTP 403 for insufficient role, which are the correct and industry-standard status codes for these conditions. On the Angular frontend, the AuthenticationService was extended with getUserRole() and hasRole() methods that decode the JWT payload, and the AuthGuard was updated to read role requirements from Angular route data and redirect unauthorized users. I also identified and corrected a race condition in the original JWT authentication middleware: the code called next() synchronously after initiating jwt.verify(), which is asynchronous, allowing requests to proceed to route handlers before token verification completed. For Milestone Four, I strengthened the Mongoose Trip schema with custom validation error messages, a minlength constraint on the name field, trim on the code field, and a pre-save hook enforcing that end dates are after start dates. I then built three MongoDB aggregation pipelines — top resorts by trip count and average price, trips grouped by month, and price statistics across the collection — all running concurrently with Promise.all() for efficiency, exposed through a protected /api/reports/summary endpoint restricted to admin-role users. These enhancements collectively demonstrate proficiency in security architecture, API design, schema engineering, and database analytics — the core technical disciplines of full-stack web development.
Security has been a thread running through my entire Computer Science program and is the area in which I believe I have grown the most as a developer. CS 305 (Software Security) introduced me to formal vulnerability assessment, dependency scanning with OWASP, and the principle that security must be designed in from the start rather than added as an afterthought. CS 499 gave me the opportunity to apply that principle in practice by identifying and mitigating real security flaws in an application I had previously built. The most significant security finding in the Travlr Getaways code review was the absence of role differentiation: any authenticated user could create, update, or delete any trip, which means a viewer-level account or a compromised credential could cause irreversible data loss. The RBAC implementation in Milestone Two addresses this through defense in depth: the Express checkRole middleware enforces role requirements on the server — the authoritative enforcement point — while the Angular route guards provide a user experience layer that prevents unauthorized navigation. I was deliberate about not relying solely on client-side guards, because Angular route guards can be bypassed by making direct API calls with a valid token, and the backend must be the final gatekeeper regardless of what the frontend does. The schema validation in Milestone Four adds another security layer: enforcing required fields, minlength constraints, and business rule validation at the schema level prevents malformed or malicious data from entering the database even if the application layer fails to catch it. The authentication middleware race condition I identified and corrected is perhaps the most technically subtle security contribution of the capstone: it was a latent vulnerability that would not appear in normal testing but could be exploited under specific timing conditions.
The three enhancements in my ePortfolio, viewed together, tell a coherent story about the kind of developer I have become: one who thinks about security at every layer of the stack, who designs data access patterns with algorithmic efficiency in mind, and who enforces data integrity at the database layer rather than relying on any single component to be the sole gatekeeper. The Travlr Getaways application that I submitted in CS 465 was functional but had meaningful gaps in authorization, query performance, and data validation. The version hosted in this ePortfolio is significantly more secure, more scalable, and more maintainable — and the process of getting from one to the other, including the revisions required by instructor feedback, has been one of the most valuable learning experiences of my academic career. I graduate from the Computer Science program prepared to contribute to professional software development teams as a full-stack web developer with a security-first mindset, a working knowledge of production database design, and the professional habits of iterative improvement, clear technical communication, and honest self-evaluation that this capstone course has helped me develop.
Milestone One
A ~30 minute screencast walkthrough of the original Travlr Getaways MEAN stack codebase, covering existing functionality, code analysis across all three enhancement categories (software engineering, algorithms, databases), and planned enhancements aligned to the five CS program outcomes.
Watch Code ReviewCS 499 Capstone
All three enhancements apply to the Travlr Getaways MEAN stack application from CS 465, elevating it from a functional academic project to a production-ready standard.
Software Engineering & Design
Added a multi-role system (admin, editor, viewer) with Express checkRole middleware, JWT role payloads, and Angular route guards — eliminating privilege escalation vulnerabilities and correcting an authentication middleware race condition in the original codebase.
Algorithms & Data Structures
Replaced O(n) full collection scans with MongoDB compound indexes and server-side pagination. Corrected sort order to match index field order, replaced regex with exact string matching for index utilization, capped page size at 50, and updated Angular TripDataService and TripListingComponent to handle the paginated response structure.
Databases
Strengthened the Mongoose Trip schema with custom validation error messages, minlength constraints, and a pre-save hook enforcing end > start date. Built three MongoDB aggregation pipelines for top resorts, trips by month, and price statistics — exposed through a protected /api/reports/summary endpoint requiring admin role.
Coursework
CS 465 · Full Stack
A travel booking platform built with the MEAN stack, featuring a Handlebars public site, Angular 18 admin SPA, RESTful API, and JWT authentication.
CS 305 · Security
Vulnerability assessment and secure coding for a Spring Boot REST application — SSL/TLS, OWASP dependency scanning, and SHA-256 checksums.
CS 360 · Mobile
Android mobile application demonstrating mobile UI design, local data persistence, and event-driven programming.
Get In Touch
Interested in my work or want to connect? Find me on GitHub or reach out via email.