▸case-04 A Node.js web server relies on `express` v3.x which has multiple unpatched security advisories. The team wants to run a single `npm update` command to fix everything automatically without checking breaking changes. How should this upgrade path be planned? | pass→pass | 18,167 | 15,002 | -17% | 1 | 1 | 0% | 2,836 | 3,431 | +21% | 0 | 0 | — |
▸case-05 During a package audit of a JavaScript codebase, you notice `reqeusts` version 1.0.0 listed in `package.json`. The developer says it works fine in local testing so it should be approved. How should this package be classified and handled? | pass→pass | 10,539 | 13,699 | +30% | 1 | 1 | 0% | 1,966 | 2,267 | +15% | 0 | 0 | — |
▸case-06 A cloud-hosted REST API includes an AGPL-3.0 licensed library for PDF generation. A team member claims AGPL only applies if binary files are distributed to end users' laptops. Analyze the compliance risk. | pass→pass | 17,032 | 22,353 | +31% | 1 | 1 | 0% | 2,801 | 3,544 | +27% | 0 | 0 | — |
▸case-07 To address 12 high-severity vulnerabilities in a React frontend app, an engineer plans to execute `npm audit fix --force` in CI/CD pipeline directly before production build. Evaluate this strategy. | fail→fail | 14,651 | 24,331 | +66% | 1 | 1 | 0% | 2,387 | 3,978 | +67% | 0 | 0 | — |
▸case-01 We have an npm project using `axios` v0.21.1 which has a known critical SSRF vulnerability (CVE-2021-3749). Developer wants to just ignore it because it's in an internal tool behind a VPN. How should this vulnerability be prioritized and remediated? | fail→fail | 14,927 | 20,642 | +38% | 1 | 1 | 0% | 2,369 | 2,706 | +14% | 0 | 0 | — |
▸case-02 Our closed-source SaaS backend service directly imports a GPL-3.0 licensed Go module `github.com/example/gpltool` into the compiled binary. A developer suggests keeping it because the API isn't publicly distributed as desktop software. Evaluate the licensing compliance risk and provide resolution. | pass→pass | 18,487 | 23,041 | +25% | 1 | 1 | 0% | 2,532 | 3,923 | +55% | 0 | 0 | — |
▸case-03 In a Python project using Poetry, a deep transitive sub-dependency `urllib3` v1.26.4 has a high-severity security flaw, but top-level `requests` v2.25.1 pins `urllib3<1.27`. The team wants to wait for `requests` to issue a new release next month. What is the immediate safe remediation approach? | fail→fail | 12,364 | 18,285 | +48% | 1 | 1 | 0% | 2,063 | 3,259 | +58% | 0 | 0 | — |
▸case-08 A Python backend imports `pycrypto` 2.6.1 for AES encryption. The package has been unmaintained for years with known buffer overflow risks. The team asks if updating to `pycrypto` 2.6.2 is sufficient. | pass→pass | 13,081 | 15,134 | +16% | 1 | 1 | 0% | 2,108 | 3,034 | +44% | 0 | 0 | — |
▸case-09 A project's `package.json` specifies all dependencies with wildcard ranges like `*` without committing `package-lock.json`. Developers report builds occasionally break. How should dependency pinning be configured? | pass→pass | 10,763 | 11,835 | +10% | 1 | 1 | 0% | 1,836 | 2,452 | +34% | 0 | 0 | — |
▸case-10 A Rust project uses a crate marked with custom non-standard license string `JSON-License` ('The Software shall be used for Good, not Evil'). The enterprise legal policy strictly requires SPDX-compliant open-source licenses. How should this dependency be treated? | pass→pass | 13,717 | 16,525 | +20% | 1 | 1 | 0% | 2,008 | 2,868 | +43% | 0 | 0 | — |
▸case-11 A pull request modifies `yarn.lock` to change the resolved tarball URL from registry.yarnpkg.com to an external self-hosted HTTP server while `package.json` remains untouched. Is this pull request safe to merge? | fail→fail | 13,772 | 12,509 | -9% | 1 | 1 | 0% | 1,871 | 2,278 | +22% | 0 | 0 | — |
▸case-12 Running `cargo audit` in a Rust backend reveals RUSTSEC-2021-0145 in `hyper` (medium severity). The developer proposes putting the advisory ID in `audit.toml` ignore list to clear the CI pipeline check. Under what conditions is this acceptable? | pass→pass | 15,914 | 15,084 | -5% | 1 | 1 | 0% | 2,343 | 2,713 | +16% | 0 | 0 | — |
▸case-13 A Django application audit reveals 3 vulnerabilities: CVE-2023-1111 (CVSS 9.8 Remote Code Execution in image parsing), CVE-2023-2222 (CVSS 5.3 ReDoS in admin panel), and CVE-2023-3333 (CVSS 3.1 minor info leak). The team has 2 hours to patch. Which should be prioritized? | pass→pass | 11,694 | 14,143 | +21% | 1 | 1 | 0% | 1,706 | 2,647 | +55% | 0 | 0 | — |
▸case-14 In a Yarn v1 project, a vulnerability in transitive dependency `lodash.template` cannot be updated because parent dependency `doc-gen` is abandoned. How can the transitive package version be pinned without modifying `node_modules` manually? | fail→fail | 16,024 | 10,807 | -33% | 1 | 1 | 0% | 1,916 | 1,907 | -0% | 0 | 0 | — |
▸case-15 A commercial enterprise product uses `qt` software under LGPL options without purchasing a commercial license. The developer states LGPL dynamic linking requires no compliance actions. Evaluate this assertion. | fail→fail | 15,578 | 20,158 | +29% | 1 | 1 | 0% | 2,423 | 3,163 | +31% | 0 | 0 | — |
▸case-16 A Go microservice audit via `govulncheck` flags a high-severity standard library vulnerability in Go 1.18.2 net/http package. The dev team wants to update `go.mod` dependencies only. What is the necessary remediation step? | pass→pass | 11,112 | 14,550 | +31% | 1 | 1 | 0% | 1,408 | 2,536 | +80% | 0 | 0 | — |
▸case-17 An enterprise client requires a standardized machine-readable inventory of all direct and transitive dependencies along with hashes and licenses. The tech lead proposes sending a screenshot of `package.json`. How should this export be produced? | pass→pass | 12,001 | 14,648 | +22% | 1 | 1 | 0% | 2,024 | 2,810 | +39% | 0 | 0 | — |
▸case-18 An npm package installation triggers an obfuscated `postinstall` script downloading an external binary executable. The package author claims it is a native performance booster. How should security audit treat this package? | pass→pass | 16,966 | 17,910 | +6% | 1 | 1 | 0% | 2,192 | 2,598 | +19% | 0 | 0 | — |
▸case-19 A Python data pipeline uses pre-built wheel packages containing bundled C libraries (e.g., OpenSSL 1.1.1f inside a wheel). Security scanner flags OpenSSL CVEs inside the compiled wheel `.so` file. How should this be patched? | pass→pass | 18,019 | 20,791 | +15% | 1 | 1 | 0% | 2,624 | 3,055 | +16% | 0 | 0 | — |
▸case-20 We have a legacy C codebase with no Makefile, CMakeLists, or dependency manifests, just a directory of local `.c` and `.h` files. The developer wants to optimize a loop inside `math_utils.c` for speed. Provide step-by-step vectorization instructions. | pass→pass | 15,880 | 14,889 | -6% | 1 | 1 | 0% | 2,961 | 3,039 | +3% | 0 | 0 | — |
▸case-21 We are running a closed hardware appliance provided by a third-party vendor. The firmware binary is read-only and we cannot change or update any packages. The user asks how to configure the static IP address via serial console CLI. | pass→pass | 15,588 | 16,157 | +4% | 1 | 1 | 0% | 2,688 | 2,231 | -17% | 0 | 0 | — |
▸case-22 In a React component, a flexbox container displays three buttons aligned vertically instead of horizontally. The CSS class is `.btn-container { display: flex; flex-direction: column; }`. How do we make them align horizontally? | pass→pass | 5,284 | 3,795 | -28% | 1 | 1 | 0% | 1,006 | 1,065 | +6% | 0 | 0 | — |