▸case-09 We are configuring security headers for an Express REST API serving web clients. A team member suggested setting `X-Frame-Options: ALLOWALL` and omitting `Content-Security-Policy` to fix iframe embedding issues. How should security headers be configured for modern API protection? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 In our Node.js service using Sequelize ORM, we wrote a raw query `sequelize.query(`SELECT * FROM users WHERE role = '${req.query.role}'`)` to fetch filtered users. How should this query be refactored to eliminate SQL injection risks? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 Our Node.js service converts uploaded images by executing a system command: `exec('ffmpeg -i ' + req.body.filepath + ' output.mp4')`. How should this route be refactored to eliminate command injection risks? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 We have a Node.js web application using cookie-based authentication. The team wants to prevent Cross-Site Request Forgery (CSRF) on POST requests by simply inspecting the HTTP Referer header. How should we implement effective CSRF protection for these state-changing routes? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 Please draft a penetration testing plan and scope document for our upcoming third-party security assessment. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 We are setting up password storage in a Python backend service. An engineer suggested using SHA-256 with a hardcoded application salt string. How should password hashing be safely implemented for user credentials? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 We are building a Python FastAPI backend for user registration and login. Can you write the login authentication service function that validates credentials against stored password hashes, issues session tokens via cookies with proper security attributes, and handles failed login attempts gracefully without leaking internal error details? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 We are deploying a Spring Boot microservice to cloud infrastructure. Currently, database credentials and API keys are stored as static strings in `application.properties` checked into Git. How should secrets management be refactored? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 Our Java backend allows users to configure a custom webhook callback URL. When an event fires, our server issues an HTTP POST request directly to the user-provided URL string using `HttpClient`. How do we prevent Server-Side Request Forgery (SSRF) vulnerabilities in this integration? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 Can you perform a high-level security compliance assessment of our cloud architecture against HIPAA security rule requirements? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-25 In an Express route `GET /api/v1/orders/:id`, our code checks if `req.user` is authenticated and then fetches `Order.findById(req.params.id)`. How should this endpoint be updated to prevent Broken Object Level Authorization (BOLA/IDOR) vulnerabilities? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 Our backend generates HTML templates containing user-submitted profile bio text using standard string concatenation `html += '<div>' + user.bio + '</div>'`. How do we update this output rendering code to prevent Cross-Site Scripting (XSS)? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 We are designing JWT authentication for a Go microservices architecture. A developer suggests disabling signature verification on internal microservices to reduce CPU latency. How should JWT handling and token lifecycle be securely implemented? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 In our Node.js file server endpoint (`GET /download`), users pass a file name query parameter like `?filename=report.pdf`. We currently use `path.join('/var/www/uploads', req.query.filename)` to resolve the file path. Is this vulnerable, and how should we secure it? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-23 Our web application's logout endpoint `POST /api/v1/auth/logout` currently returns HTTP 200 OK without performing any server-side actions, relying on the client to delete its local cookie. How should server-side logout and session destruction be implemented? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 We are implementing Time-based One-Time Password (TOTP) two-factor authentication in a Python backend. How should the TOTP token verification function be written to handle clock skew and prevent token reuse attacks? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-24 Our Python backend connects to PostgreSQL using the `postgres` administrative superuser account in production to simplify table creation and query permissions. How should database connection user privileges be configured? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-04 We need a threat modeling review and STRIDE analysis for our microservices deployment architecture. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 We are building an OAuth 2.0 authorization backend for mobile and single-page application clients. The client uses authorization code grant without a code verifier or state parameter. What security enhancements are required? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 Our Java backend receives XML reports from client applications using standard `DocumentBuilderFactory`. How should we configure the XML parser to protect against XML External Entity (XXE) processing attacks? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 Our backend API endpoint `POST /api/v1/auth/login` is vulnerable to brute-force credential stuffing. The frontend team added a JavaScript delay button timer to prevent rapid clicking. How should rate limiting be implemented on the backend? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 I need to fix a Node.js Express endpoint handling user profile updates (`PATCH /api/v1/users/profile`). It currently accepts raw JSON and builds SQL strings directly. Please refactor this route to safely parse incoming payload fields and perform database operations without query injection risks, returning the updated backend handler code along with a brief explanation of how safety is ensured. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 To debug intermittent authentication bugs in production, our Python backend logs the complete database exception stack trace along with `request.body` which contains plaintext passwords and raw connection strings. How should error handling and logging be refactored? | pass→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 Our Express backend needs to allow cross-origin requests from `https://app.example.com`. To quickly resolve CORS errors, a developer set `res.header('Access-Control-Allow-Origin', '*')` and `res.header('Access-Control-Allow-Credentials', 'true')`. Is this valid and safe, and how should it be fixed? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 In our Express application using MongoDB and Mongoose, we authenticate users using `User.findOne({ username: req.body.username, password: req.body.password })`. An attacker sent `{"username": {"$gt": ""}}`. How do we prevent NoSQL injection? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |