▸case-22 Write a NodeJS function using the `jsonwebtoken` library to sign a JWT payload `{ userId: 123 }` using algorithm RS256 and a private key string. | pass→pass | 6,427 | 7,199 | +12% | 1 | 1 | 0% | 1,133 | 1,529 | +35% | 0 | 0 | — |
▸case-01 We are launching a new user authentication microservice that handles JWT tokens and user profile data. Please perform a threat modeling session on this architecture using STRIDE principles and deliver a structured security report detailing identified risks, recommended counter-measures, and verification steps. | pass→pass | 48,487 | 28,972 | -40% | 1 | 1 | 0% | 7,261 | 4,050 | -44% | 0 | 0 | — |
▸case-02 Our team is preparing for a security audit on our e-commerce payment API endpoint. Can you conduct a systematic STRIDE threat evaluation of the system design and produce an actionable security assessment document covering potential attack vectors and concrete fix steps? | pass→pass | 35,546 | 29,980 | -16% | 1 | 1 | 0% | 4,359 | 4,764 | +9% | 0 | 0 | — |
▸case-03 We are migrating our legacy backend services to a cloud-native Kubernetes environment. Please generate a comprehensive threat analysis breakdown following the STRIDE framework for this deployment model, formatted as a clear action plan with verification checkpoints. | pass→pass | 40,153 | 22,436 | -44% | 1 | 1 | 0% | 6,722 | 3,648 | -46% | 0 | 0 | — |
▸case-04 We are conducting a STRIDE threat model on a public REST API endpoint. A developer suggests that enforcing OAuth 2.0 with Bearer tokens mitigates all Spoofing and Information Disclosure threats without needing TLS. How should these threats be accurately categorized and mitigated? | fail→pass | 15,284 | 15,988 | +5% | 1 | 1 | 0% | 2,635 | 2,976 | +13% | 0 | 0 | — |
▸case-05 We are performing a STRIDE analysis on a PostgreSQL database cluster where unauthorized SQL write access could modify historical records. Which STRIDE category applies to unauthorized record modifications? | pass→pass | 9,861 | 12,594 | +28% | 1 | 1 | 0% | 759 | 1,147 | +51% | 0 | 0 | — |
▸case-06 In our payment processing system, a user claims they never initiated a specific money transfer, but our application logs only record `user_id` and timestamp without digital signatures or append-only guarantees. Under STRIDE, what threat category does this fall under? | pass→pass | 11,358 | 12,443 | +10% | 1 | 1 | 0% | 1,095 | 1,463 | +34% | 0 | 0 | — |
▸case-07 An AWS S3 bucket containing customer PII is accessible over HTTP and has public read permissions. Which STRIDE threat category directly applies to exposing sensitive PII to unauthorized viewers? | pass→pass | 3,305 | 3,045 | -8% | 1 | 1 | 0% | 552 | 683 | +24% | 0 | 0 | — |
▸case-08 An attacker is flooding an authentication endpoint with thousands of requests per second, exhausting server CPU and memory. Which STRIDE threat category describes this resource exhaustion attack? | pass→pass | 7,386 | 2,689 | -64% | 1 | 1 | 0% | 405 | 632 | +56% | 0 | 0 | — |
▸case-09 A developer assigned the `AdministratorAccess` policy to an AWS Lambda function that only needs read access to a single DynamoDB table. Which STRIDE threat category does this excessive permission assignment expose? | pass→pass | 5,580 | 8,400 | +51% | 1 | 1 | 0% | 872 | 1,304 | +50% | 0 | 0 | — |
▸case-10 During a STRIDE review of a microservice architecture, a team member proposes using unencrypted HTTP for internal service-to-service calls. Which STRIDE threat category applies to eavesdropping on internal service traffic? | pass→pass | 9,412 | 9,069 | -4% | 1 | 1 | 0% | 742 | 751 | +1% | 0 | 0 | — |
▸case-11 When performing a STRIDE evaluation on a web application session management system, under which threat category does session cookie hijacking belong? | pass→pass | 13,157 | 12,158 | -8% | 1 | 1 | 0% | 1,234 | 1,342 | +9% | 0 | 0 | — |
▸case-12 In a threat modeling exercise for a web application file upload endpoint, an attacker uploads an executable shell file disguised as an image. Which STRIDE threat category applies to executing arbitrary uploaded scripts on the server? | pass→pass | 12,039 | 12,269 | +2% | 1 | 1 | 0% | 980 | 1,285 | +31% | 0 | 0 | — |
▸case-13 We are analyzing a PCI-DSS compliant credit card processing pipeline using STRIDE. Storing raw Primary Account Numbers (PAN) in plain text log files presents what primary STRIDE risk? | pass→pass | 11,152 | 10,782 | -3% | 1 | 1 | 0% | 922 | 997 | +8% | 0 | 0 | — |
▸case-14 An internal REST API uses sequential auto-incrementing IDs (`/api/orders/1`, `/api/orders/2`) without checking if the requesting user owns the order. Which STRIDE category covers this insecure direct object reference vulnerability? | pass→pass | 12,895 | 11,565 | -10% | 1 | 1 | 0% | 1,324 | 1,196 | -10% | 0 | 0 | — |
▸case-15 A distributed system uses unauthenticated UDP packets for node discovery across host networks. Which STRIDE threat category applies to an attacker sending forged discovery packets from a fake node? | pass→pass | 11,711 | 12,481 | +7% | 1 | 1 | 0% | 1,082 | 1,170 | +8% | 0 | 0 | — |
▸case-16 A messaging system uses RabbitMQ without authorization controls, allowing any connected client to read messages from all queues. Which STRIDE threat category applies to unauthorized reading of queue messages? | pass→pass | 10,572 | 9,706 | -8% | 1 | 1 | 0% | 771 | 872 | +13% | 0 | 0 | — |
▸case-17 A GraphQL API endpoint allows deeply nested recursive queries that exhaust database connection pools and crash the service. Which STRIDE threat category applies to this resource exhaustion technique? | pass→pass | 3,195 | 11,322 | +254% | 1 | 1 | 0% | 487 | 773 | +59% | 0 | 0 | — |
▸case-18 A web application accepts user input directly into an XML parser with external entity resolution enabled. Which STRIDE threat category applies to extracting local server files via XML External Entity (XXE) attacks? | pass→pass | 4,616 | 4,315 | -7% | 1 | 1 | 0% | 782 | 943 | +21% | 0 | 0 | — |
▸case-19 An internal administrative portal relies solely on client-side JavaScript to hide restricted UI buttons from non-admin users. Which STRIDE threat category applies when a non-admin user invokes restricted API endpoints directly? | pass→pass | 11,030 | 5,735 | -48% | 1 | 1 | 0% | 964 | 1,124 | +17% | 0 | 0 | — |
▸case-20 Here is a Python function with a SQL injection bug: `cursor.execute('SELECT * FROM users WHERE id = ' + user_id)`. Please rewrite this function using parameterized queries. | pass→pass | 10,069 | 20,084 | +99% | 1 | 1 | 0% | 925 | 1,134 | +23% | 0 | 0 | — |
▸case-21 We need to configure `iptables` on Linux to block incoming TCP traffic on port 8080 from IP range 192.168.1.0/24. Please provide the exact Linux terminal command. | pass→pass | 9,323 | 10,070 | +8% | 1 | 1 | 0% | 789 | 974 | +23% | 0 | 0 | — |