okongomathews/PhishSimAfrica

Localised Social Engineering Simulation for East African Financial Institutions # PhishSimAfrica Localised social-engineering simulation platform for East African financial institutions — campaign management, click/submission tracking, contextual micro-training, and reporting. Built for the Ongoza CyberHub Innovation Challenge. ## What this repo is, precisely This is the **platform**: consent-gated campaign management, delivery infrastructure, event tracking, training delivery, and reporting. It does **not** ship with any brand-impersonating lure content (no M-Pesa/bank/CBK SMS or email copy, no cloned login-page HTML). See `docs/CONTENT_POLICY.md` for exactly what's gated, why, and what you need to add under your own legal review before a live campaign. This split is enforced in code, not just documented — `simtemplates. Template.is_usable_in_live_campaign()` and `campaigns/delivery.py` both hard-refuse to send anything that hasn't cleared the approval gate. ## Quickstart ```bash python -m venv venv && source venv/bin/activate pip install -r requirements.txt cp .env.example .env # fill in DB creds, AT sandbox key, email creds python manage.py migrate python manage.py createsuperuser python manage.py loaddata initial_training_content # generic protective training content, EN + SW python manage.py seed_demo # demo org + consented cohort + placeholder template python manage.py runserver ``` Visit `/admin/` to manage organisations, recipients, templates, and campaigns. Visit `/reports/` (login required) for the results dashboard. Run the test suite: ```bash python manage.py test ``` Tests cover (see `*/tests.py` in each app): - Kenya DPA consent gating (org can't activate without both DPA gates; cohort recipients can't be added without individual consent) - The no-credential-storage guarantee, proven end-to-end by POSTing credential-shaped data to the submission endpoint and asserting none of it appears anywhere in the resulting database rows - Template legal-approval gate (unapproved/empty templates can't b …