▸case-07 A React app renders dynamic user comments directly into the DOM using `dangerouslySetInnerHTML` to allow custom user formatting. Analyze the security impact of rendering raw HTML strings in frontend applications and explain the required defense. | pass→pass | 16,140 | 12,397 | -23% | 1 | 1 | 0% | 2,362 | 2,942 | +25% | 0 | 0 | — |
▸case-01 I just built a new REST API endpoint in Express.js that accepts user-submitted forms and writes sensitive account information into PostgreSQL. Could you perform a security review on this backend code to check for vulnerabilities like SQL injection or credential leaks, and provide a report of your security findings along with recommended fixes? | fail→fail | 12,603 | 23,204 | +84% | 1 | 1 | 0% | 1,336 | 1,736 | +30% | 0 | 0 | — |
▸case-02 I'm developing a Solana smart contract in Rust that handles user token deposits and withdraw authorization logic. Can you inspect this code for access control flaws, program state validation issues, or other common vulnerabilities, and return a categorized breakdown of any security risks discovered? | fail→fail | 21,612 | 12,354 | -43% | 1 | 1 | 0% | 2,813 | 1,427 | -49% | 0 | 0 | — |
▸case-03 We are building a Node.js web application that connects to AWS services and database instances. We plan to commit a `.env` file with DB passwords into GitHub so that developer deployments are fast and easy. Analyze this deployment pattern and evaluate whether hardcoding secrets in version control is acceptable, detailing the recommended secret storage mechanism. | pass→pass | 19,480 | 21,211 | +9% | 1 | 1 | 0% | 3,012 | 3,608 | +20% | 0 | 0 | — |
▸case-04 Our backend service receives user phone numbers and postal codes via JSON payload. We plan to strip out invalid characters using regex string replacements on the server before storing them. Review this approach and advise on the proper input handling strategy. | fail→fail | 19,209 | 20,048 | +4% | 1 | 1 | 0% | 2,684 | 3,303 | +23% | 0 | 0 | — |
▸case-05 In our Python web backend using PostgreSQL, we concatenate user inputs directly into raw SQL string queries like `f'SELECT * FROM users WHERE email = '{user_email}''` because it avoids ORM overhead. Evaluate the security risk of string concatenation in database queries and specify how to fix it. | pass→pass | 23,949 | 11,994 | -50% | 1 | 1 | 0% | 2,452 | 2,270 | -7% | 0 | 0 | — |
▸case-06 Our user registration service hashes stored passwords using simple MD5 or SHA-1 hashes to keep login latency low. Evaluate this password storage technique and provide the industry-standard cryptographic hashing algorithm recommendation. | pass→pass | 17,107 | 26,443 | +55% | 1 | 1 | 0% | 2,480 | 2,687 | +8% | 0 | 0 | — |
▸case-08 Our traditional multi-page web application uses cookie-based sessions for user authentication on POST endpoints like `/transfer-funds`. We rely solely on checking the HTTP `Referer` header to stop cross-site requests. Evaluate this CSRF defense mechanism and detail the standard countermeasure. | pass→pass | 20,490 | 17,829 | -13% | 1 | 1 | 0% | 3,451 | 3,617 | +5% | 0 | 0 | — |
▸case-09 Our authentication API endpoint `/api/v1/login` has no rate limiting or IP throttling because we want to minimize latency for valid users trying to log in repeatedly. Evaluate the risk of unthrottled authentication endpoints and specify the protection mechanism. | pass→pass | 16,119 | 15,884 | -1% | 1 | 1 | 0% | 2,858 | 3,387 | +19% | 0 | 0 | — |
▸case-10 To simplify debugging, our backend logging middleware logs full incoming JSON payloads, including user passwords, social security numbers, and credit card CVVs, to central logging aggregators. Assess the security risks of this logging practice and specify the mitigation technique. | pass→pass | 14,075 | 13,800 | -2% | 1 | 1 | 0% | 2,203 | 2,518 | +14% | 0 | 0 | — |
▸case-11 In a Solana Rust program using Anchor, an instruction handler accepts an `AccountInfo` representing the authority account to withdraw funds, but does not check `ctx.accounts.authority.is_signer`. The developer assumes passing the account in the context guarantees authorization. Evaluate this assumption and state the security fix. | pass→pass | 9,907 | 7,542 | -24% | 1 | 1 | 0% | 1,537 | 1,681 | +9% | 0 | 0 | — |
▸case-12 Our Node.js project relies on 300 npm packages installed via `npm install`. We never run audit scans or lock package versions because we want to automatically pull the newest bug fixes on build. Evaluate this dependency management approach and state the recommended mitigation. | pass→pass | 14,396 | 11,858 | -18% | 1 | 1 | 0% | 2,407 | 2,401 | -0% | 0 | 0 | — |
▸case-13 We want to ensure security checks happen automatically in our GitHub Actions CI pipeline whenever code is pushed. We currently only run `npm test` for unit tests. What type of automated security testing tools should be added to the CI pipeline to catch code flaws and open-source vulnerabilities before deployment? | fail→fail | 15,061 | 14,223 | -6% | 1 | 1 | 0% | 2,727 | 3,057 | +12% | 0 | 0 | — |
▸case-14 Our single-page app stores JWT access tokens with a 1-year expiration inside `localStorage` so users never have to log back in. Evaluate the security implications of long-lived tokens in localStorage and recommend safer token lifecycle management. | fail→fail | 20,160 | 21,721 | +8% | 1 | 1 | 0% | 2,979 | 3,474 | +17% | 0 | 0 | — |
▸case-15 Our express server allows users to upload profile photos by saving the raw user file directly to `/public/avatars/` retaining its original file extension and filename, then serving it statically. Evaluate the risks of this file upload handler and specify necessary security controls. | pass→fail | 24,020 | 17,626 | -27% | 1 | 1 | 0% | 2,125 | 3,654 | +72% | 0 | 0 | — |
▸case-16 To fix cross-origin errors during API development, our Express backend sets `Access-Control-Allow-Origin: *` while also setting `Access-Control-Allow-Credentials: true`. Evaluate this CORS policy configuration for production APIs handling authenticated requests. | pass→pass | 17,115 | 14,952 | -13% | 1 | 1 | 0% | 2,601 | 2,852 | +10% | 0 | 0 | — |
▸case-17 Our REST API endpoint `GET /api/documents/:id` fetches and returns document records from the database using `SELECT * FROM docs WHERE id = req.params.id`. Any logged-in user can query any numeric ID. Evaluate this access control design and provide the fix. | pass→pass | 14,896 | 14,460 | -3% | 1 | 1 | 0% | 2,700 | 2,911 | +8% | 0 | 0 | — |
▸case-18 Our web application listens on port 80 HTTP and port 443 HTTPS. It allows login forms to be submitted over standard HTTP without redirection to HTTPS to support legacy clients. Evaluate the security risk of plain HTTP authentication and recommend the enforcing mechanism. | pass→pass | 16,383 | 15,274 | -7% | 1 | 1 | 0% | 2,370 | 2,953 | +25% | 0 | 0 | — |
▸case-19 In a Solana Rust smart contract, a transfer instruction credits tokens to a recipient before deducting the balance from the sender account state. Evaluate the sequence of account balance operations in smart contracts. | pass→pass | 25,534 | 19,220 | -25% | 1 | 1 | 0% | 3,688 | 3,540 | -4% | 0 | 0 | — |
▸case-20 We are creating an API key generation feature where keys are generated as static incremental integer IDs like `api_key_1001`, `api_key_1002`. Evaluate the security strength of sequential integer API keys and specify the proper key format. | pass→pass | 20,282 | 13,885 | -32% | 1 | 1 | 0% | 2,775 | 3,083 | +11% | 0 | 0 | — |
▸case-21 Our web app provides a custom link preview feature where the server receives a user-submitted URL parameter `?url=...`, sends an HTTP GET request to that target, and extracts title tags. Evaluate the security risks when users supply internal IP addresses like `http://168.63.129.16` or `http://127.0.0.1`. | pass→pass | 22,106 | 22,919 | +4% | 1 | 1 | 0% | 2,392 | 2,626 | +10% | 0 | 0 | — |
▸case-22 I am designing a responsive CSS flexbox layout for a user profile card component. The avatar image should align on the left and user description text on the right, stacking vertically on mobile screens. Provide the CSS flexbox rules and media query for this layout. | pass→fail | 11,638 | 10,265 | -12% | 1 | 1 | 0% | 2,067 | 2,157 | +4% | 0 | 0 | — |
▸case-23 Write a JavaScript function that calculates the nth Fibonacci number using dynamic programming or memoization to achieve O(n) time complexity. Return the function code and explain its space complexity. | pass→fail | 12,139 | 14,663 | +21% | 1 | 1 | 0% | 2,268 | 3,386 | +49% | 0 | 0 | — |
▸case-24 Our PostgreSQL database query `SELECT * FROM orders WHERE created_at >= '2023-01-01' ORDER BY created_at DESC` is taking 5 seconds on a table with 10 million rows. We need to optimize query performance. Recommend the appropriate B-Tree index command to speed up execution time. | pass→pass | 8,769 | 9,077 | +4% | 1 | 1 | 0% | 1,541 | 1,731 | +12% | 0 | 0 | — |