▸case-01 Our web application needs a robust Content Security Policy to mitigate cross-site scripting, but we load external assets from a few specific domains. Could you draft a tight CSP configuration suitable for modern browsers along with the HTML meta tag setup? Include a brief explanation of each policy directive and actionable steps for debugging policy violations in browser developer tools. | fail→fail | 17,698 | 21,172 | +20% | 1 | 1 | 0% | 3,166 | 4,700 | +48% | 0 | 0 | — |
▸case-02 We need a comprehensive threat modeling report and DevSecOps pipeline compliance audit for our enterprise financial portal. Provide a high-level threat landscape analysis, compliance mapping for SOC2, and a pipeline automated security scanning architecture. | fail→pass | 44,368 | 17,632 | -60% | 1 | 1 | 0% | 7,733 | 3,607 | -53% | 0 | 0 | — |
▸case-03 We are preparing for an external black-box penetration test of our web platform. Draft a formal penetration testing scope document, rules of engagement, and legal authorization agreement template for the security testing firm. | fail→fail | 21,470 | 30,205 | +41% | 1 | 1 | 0% | 3,621 | 5,622 | +55% | 0 | 0 | — |
▸case-04 Our enterprise is migrating to a zero-trust network model across multi-cloud environments. We need an architectural assessment of our IAM role hierarchies, network segmentation policies, and edge firewalls. | fail→pass | 28,190 | 5,635 | -80% | 1 | 1 | 0% | 4,065 | 1,341 | -67% | 0 | 0 | — |
▸case-05 We are rendering user-supplied comments on a blog feed in vanilla JavaScript. Developers currently set `element.innerHTML = userComment`. Someone suggested using eval() or custom regex filters to strip script tags. How should this be securely coded in the DOM? | pass→pass | 12,957 | 9,671 | -25% | 1 | 1 | 0% | 2,361 | 2,328 | -1% | 0 | 0 | — |
▸case-06 Our legacy React portal uses a JavaScript snippet `if (top != self) top.location = self.location` to prevent being embedded in an iframe on third-party phishing sites. Is this JavaScript framebusting script sufficient, or what modern HTTP header solution should be implemented? | pass→pass | 13,141 | 11,144 | -15% | 1 | 1 | 0% | 2,343 | 2,696 | +15% | 0 | 0 | — |
▸case-07 When a user logs in, our single-page application reads `?redirectUrl=` from the URL parameters and performs `window.location.href = url`. A QA tester pointed out attackers can pass `?redirectUrl=https://evil.com`. How should we safely implement URL redirection? | pass→pass | 15,470 | 15,255 | -1% | 1 | 1 | 0% | 2,918 | 3,519 | +21% | 0 | 0 | — |
▸case-08 We allow users to customize their profile page themes by submitting custom CSS strings directly into a `<style>` tag injected into the document head. Is this safe as long as we strip `<script>` tags, or what security risks exist and how do we prevent them? | pass→pass | 18,613 | 21,877 | +18% | 1 | 1 | 0% | 3,119 | 4,420 | +42% | 0 | 0 | — |
▸case-09 Our frontend stores JWT access tokens in `localStorage` so they persist across browser tabs and can be attached to fetch headers. Is `localStorage` the best choice for session token storage, or is there a safer HTTP cookie mechanism? | pass→pass | 15,398 | 16,828 | +9% | 1 | 1 | 0% | 2,624 | 3,768 | +44% | 0 | 0 | — |
▸case-10 Our web app uses cookies for session management. We set `SameSite=None` without CSRF tokens because our REST API runs on a separate subdomain `api.example.com`. How should we secure our frontend state-changing requests against cross-site request forgery? | pass→pass | 18,989 | 21,571 | +14% | 1 | 1 | 0% | 3,564 | 4,784 | +34% | 0 | 0 | — |
▸case-11 We load popular frontend libraries like Bootstrap and jQuery from external CDNs via standard `<script src="https://cdn.example.com/lib.js">` tags. If the CDN is compromised, malicious code could be served to our users. What HTML attribute mechanism prevents compromised CDN scripts from executing? | pass→pass | 6,808 | 7,881 | +16% | 1 | 1 | 0% | 1,151 | 2,020 | +75% | 0 | 0 | — |
▸case-12 Our web app dynamically displays welcome messages by reading fragment identifiers: `document.getElementById('greeting').innerHTML = decodeURIComponent(location.hash.substring(1))`. What vulnerability does this code introduce and how should it be rewritten? | pass→pass | 9,185 | 8,036 | -13% | 1 | 1 | 0% | 1,781 | 2,125 | +19% | 0 | 0 | — |
▸case-13 Our application communicates with an embedded partner widget iframe using `window.postMessage(data, '*')` and listens for responses with `window.addEventListener('message', (e) => { eval(e.data); })`. What critical security flaws exist in this communication? | pass→pass | 14,264 | 23,088 | +62% | 1 | 1 | 0% | 2,555 | 2,939 | +15% | 0 | 0 | — |
▸case-14 Our Progressive Web App (PWA) uses a Service Worker to cache all API responses including `/api/user/profile` and `/api/user/credit-card-details` in the Cache Storage API for offline support. Is caching sensitive API responses in Service Worker Cache API safe? | pass→pass | 16,330 | 16,730 | +2% | 1 | 1 | 0% | 2,684 | 3,506 | +31% | 0 | 0 | — |
▸case-15 We need to prevent our banking web application from being loaded inside `<iframe>` elements across all external websites while allowing our own subdomains under `*.ourbank.com` to embed it. Write the exact Content Security Policy header. | fail→pass | 5,668 | 6,093 | +7% | 1 | 1 | 0% | 1,032 | 1,738 | +68% | 0 | 0 | — |
▸case-16 In our Vue/React SPA, developers are rendering user-provided markdown descriptions using `v-html` or `dangerouslySetInnerHTML`. They claim client-side frameworks automatically sanitize all HTML injected through these props. Is this true? | pass→pass | 11,928 | 10,524 | -12% | 1 | 1 | 0% | 2,022 | 2,627 | +30% | 0 | 0 | — |
▸case-17 When users click on external links inside our user profile page, the user's full profile URL containing sensitive tokens in the query string `https://app.example.com/profile?token=abc123secret` is sent to third-party web servers via the Referer header. How should we configure browser Referrer-Policy to prevent this token leak? | pass→pass | 13,102 | 14,350 | +10% | 1 | 1 | 0% | 2,476 | 3,333 | +35% | 0 | 0 | — |
▸case-18 A developer on our team suggests sanitizing all user input on the client side before sending JSON payloads to the REST API, and believes this eliminates the need for output encoding when rendering data back in the UI. Explain why input sanitization on the client side is insufficient. | pass→pass | 13,244 | 15,810 | +19% | 1 | 1 | 0% | 2,094 | 3,078 | +47% | 0 | 0 | — |
▸case-19 Our team wants to store OAuth access tokens and refresh tokens in `sessionStorage` instead of `localStorage` because `sessionStorage` clears when the tab is closed. Does switching to `sessionStorage` protect tokens from XSS scripts? | pass→pass | 12,674 | 14,282 | +13% | 1 | 1 | 0% | 2,182 | 3,118 | +43% | 0 | 0 | — |
▸case-20 We want to enforce a CSP for a single-page application with inline script tags injected dynamically by third-party analytics. Static domain whitelisting in `script-src` has become unmaintainable. What modern CSP directive strategy allows dynamically created scripts while blocking unauthorized inline scripts? | pass→pass | 15,466 | 14,716 | -5% | 1 | 1 | 0% | 2,690 | 3,120 | +16% | 0 | 0 | — |
▸case-21 Our signup page posts user credentials to an external authentication service. The form uses `<form action="http://auth.external-partner.com/login" method="GET">`. What fundamental frontend security flaws exist in this HTML form setup? | pass→pass | 12,155 | 13,865 | +14% | 1 | 1 | 0% | 1,976 | 2,818 | +43% | 0 | 0 | — |
▸case-22 Our web app opens external user-submitted links using `<a href="user_url" target="_blank">Read Article</a>`. Modern browsers handle `rel="noopener"`, but older browsers might allow the opened window to access `window.opener.location`. What exact link attribute or code safeguard secures external target='_blank' links? | pass→pass | 9,837 | 10,687 | +9% | 1 | 1 | 0% | 1,845 | 2,296 | +24% | 0 | 0 | — |
▸case-23 We want to secure our client-side JavaScript file upload component against malicious file uploads like HTML or SVG files containing scripts. How should we handle client-side validation, and what details do you need to provide a complete production-ready setup? | pass→pass | 15,316 | 16,359 | +7% | 1 | 1 | 0% | 2,854 | 3,474 | +22% | 0 | 0 | — |