Zhendong Wang
Small research teams may need to review structured image records without transferring operational files to a third-party service.This study redesigns and reproducibly evaluates a lightweight Flask platform backed by local JSON files.An isolated copy of a legacy prototype was hardened with hashed passwords, controlled registration, CSRF and role checks, structured validation, atomic replacement, validated restore, safer export and paths, login throttling, security headers, and failure-closed parsing.Evaluation used generated metadata and no operational images or accounts.All 12 functional tests passed, including an injected atomic-replacement failure that preserved the previous repository.The hardened copy satisfied all 15 audit-derived controls, versus none in the baseline; this trace is not a security certification.Across three sequential sessions, all 360 clean-start, in-process concurrency scenarios passed, allocating 32,400 synthetic records with zero duplicate identifiers.At 20 clients, median session-level P95 was 760.2 ms for batch allocation and 157.1 ms for saving one record.A separate 120-scenario loopback-HTTP run produced request-level P95 values of 913.8 and 202.7 ms.Three scale sessions yielded 900 observations from 100 to 10,000 records.A negative boundary experiment then started two or four independent processes against the same generated repository.None of 20 clean starts met the integrity criterion; 18 produced duplicate identifiers and assignment-to-master ownership mismatches, and nine also contained a write error.The evidence supports only the tested single-host, single-process configuration and empirically rejects treating its process-local lock as a multi-process transaction.Usability, review quality, production-network performance, certification, and legal compliance remain untested.