▸case-12 Our scanner found that /healthz on 'billing-worker' leaks the server uptime and internal node build number in response headers. Is this finding High, Medium, or Low risk? | pass→pass | 26,144 | 26,138 | -0% | 1 | 1 | 0% | 1,223 | 2,289 | +87% | 0 | 0 | — |
▸case-18 We answered all your clarification questions for the 'customer-portal-backend' repository. Everything looks good, please generate the final threat model document now. | fail→pass | 34,525 | 39,292 | +14% | 1 | 1 | 0% | 5,578 | 6,091 | +9% | 0 | 0 | — |
▸case-01 Can you conduct an AppSec threat modeling analysis on our backend API repository at `/src/api-server`? We need a security review grounded in actual codebase evidence rather than boilerplate advice. Please map our architecture, entry points, and trust boundaries, separate runtime code from build/CI utilities, evaluate potential abuse vectors, rank the risks, and give us prioritized mitigation steps. | fail→pass | 33,858 | 25,487 | -25% | 1 | 1 | 0% | 3,572 | 2,354 | -34% | 0 | 0 | — |
▸case-02 We are preparing to deploy our authentication and user-management service and need a comprehensive threat assessment of the codebase. Please review the repository to identify key assets, external integration edges, and threat scenarios. Deliver a risk-ranked list of threats along with concrete mitigation recommendations based on existing vs missing security controls. | fail→pass | 31,672 | 29,997 | -5% | 1 | 1 | 0% | 2,447 | 3,480 | +42% | 0 | 0 | — |
▸case-03 Please perform a threat modeling evaluation for our payment-processing microservice repository. We need a detailed breakdown of trust boundaries, entry surfaces, and potential attacker paths across the codebase. Rank the identified threats by overall risk and provide tailored implementation guidance for securing the system. | fail→fail | 49,344 | 10,797 | -78% | 1 | 1 | 0% | 7,873 | 796 | -90% | 0 | 0 | — |
▸case-04 We are reviewing two vulnerability findings in our user-profile repository 'profile-service': Finding A allows unauthenticated remote code execution on the web worker node, while Finding B allows an authenticated user to view another user's public display name via an unhandled API query. Our team lead thinks Finding B should be rated High because it affects user privacy, while Finding A is Medium because the container is ephemeral. How should these two findings be prioritized in terms of threat risk levels? | fail→fail | 17,480 | 20,812 | +19% | 1 | 1 | 0% | 1,997 | 2,888 | +45% | 0 | 0 | — |
▸case-05 Thanks for the initial assumptions summary on our 'orders-api' repository. All assumptions look correct, and to answer your question: yes, PostgreSQL is our only primary database. Please now write out the final completed threat model report for the 'orders-api' repository. | fail→fail | 31,868 | 39,211 | +23% | 1 | 1 | 0% | 4,340 | 5,331 | +23% | 0 | 0 | — |
▸case-11 In our risk matrix for 'inventory-db', we identified a potential threat involving cross-tenant data access. We assessed likelihood as High and impact as High. What formula or standard combination should determine the overall priority level, and how should ranking assumptions be presented? | pass→pass | 21,121 | 25,668 | +22% | 1 | 1 | 0% | 2,605 | 3,819 | +47% | 0 | 0 | — |
▸case-06 In our 'auth-gateway' microservice, we discovered two abuse paths. Abuse Path 1 lets an attacker bypass multi-factor authentication completely on login endpoints. Abuse Path 2 allows an attacker to bypass the rate limiter on the public contact form by rotating IP headers. The dev team wants to mark rate limiter bypass as High risk due to potential spam. What are the appropriate risk severity tiers for these two vectors? | pass→pass | 19,349 | 18,838 | -3% | 1 | 1 | 0% | 2,160 | 2,625 | +22% | 0 | 0 | — |
▸case-07 We evaluated two security risks in our execution sandbox repository 'code-runner'. Vector 1 allows a user-submitted script to escape the isolated container and execute commands on the host OS. Vector 2 allows an unauthenticated user to send ANSI escape sequences in HTTP headers that poison admin terminal logs. The infrastructure engineer proposed marking log poisoning as High and sandbox escape as Medium because container escapes are hard to achieve. How should these be categorized? | fail→pass | 21,616 | 25,427 | +18% | 1 | 1 | 0% | 2,357 | 3,411 | +45% | 0 | 0 | — |
▸case-08 We are analyzing the threat model for 'vault-service'. The codebase already includes parameterized SQL queries with evidence in db/client.ts, but lacks rate-limiting middleware on the /token endpoint. How should existing controls versus proposed mitigations be formatted in the mitigation section? | pass→pass | 13,489 | 17,026 | +26% | 1 | 1 | 0% | 1,911 | 2,416 | +26% | 0 | 0 | — |
▸case-09 During a security assessment of our 'analytics-engine' repository, a scanner flagged a vulnerable dependency in scripts/dev-setup.sh and .github/workflows/test.yml. A developer wants to rank this as a High severity runtime threat to the production web API. How should CI/build tooling vulnerabilities be handled relative to production runtime boundaries? | pass→pass | 24,522 | 18,018 | -27% | 1 | 1 | 0% | 2,603 | 3,340 | +28% | 0 | 0 | — |
▸case-10 When analyzing potential abuse paths for our internal admin console repo 'admin-portal', the auditor assumed an attacker has direct physical access to the cloud provider data center hardware. How should attacker capability modeling address unrealistic or out-of-scope attacker capabilities? | pass→pass | 23,204 | 19,312 | -17% | 1 | 1 | 0% | 2,327 | 2,867 | +23% | 0 | 0 | — |
▸case-13 While threat modeling 'notification-service', a team member suggested listing an HSM (Hardware Security Module) integration in our trust boundaries section, even though no HSM client library or configuration exists anywhere in the repository code or infrastructure manifests. Should this HSM boundary be included in the system model? | pass→pass | 19,707 | 13,758 | -30% | 1 | 1 | 0% | 1,897 | 1,666 | -12% | 0 | 0 | — |
▸case-14 We are selecting abuse paths for our threat model report on 'auth-service'. Should we list 50 generic OWASP top-10 checklist items or select a focused set of concrete abuse paths targeting exfiltration, privilege escalation, integrity compromise, and denial of service? | pass→pass | 12,075 | 17,916 | +48% | 1 | 1 | 0% | 1,627 | 2,442 | +50% | 0 | 0 | — |
▸case-15 We asked for a threat model for 'payment-gateway', but we didn't specify whether payment card data (PCI-DSS) is stored locally or processed via a third-party API like Stripe. How should the threat modeling process proceed before drafting the final report? | fail→pass | 15,948 | 18,727 | +17% | 1 | 1 | 0% | 2,313 | 2,350 | +2% | 0 | 0 | — |
▸case-16 In 'deploy-service', an unauthenticated endpoint allows reading environment variables containing production AWS secret keys. What severity level should be assigned to this key/token theft finding? | pass→pass | 11,078 | 13,884 | +25% | 1 | 1 | 0% | 1,474 | 1,853 | +26% | 0 | 0 | — |
▸case-17 We are finalizing our threat model report for 'user-service'. What items must be verified during the final quality check before writing the Markdown file? | fail→fail | 21,047 | 14,801 | -30% | 1 | 1 | 0% | 2,342 | 1,912 | -18% | 0 | 0 | — |
▸case-19 In 'search-api', sending 1,000 requests per second from a single IP causes brief HTTP 503 errors, but can be instantly mitigated by enabling the cloud provider's web application firewall rate limiter with one toggle. How should this noisy DoS vulnerability be prioritized? | fail→pass | 13,780 | 11,138 | -19% | 1 | 1 | 0% | 2,031 | 1,523 | -25% | 0 | 0 | — |
▸case-20 We need a Semgrep rule to detect hardcoded API tokens in Python files across our codebase. Please write a YAML rule definition targeting variables named 'API_KEY' or 'SECRET_KEY' assigned to literal strings in Python. | pass→pass | 16,190 | 32,449 | +100% | 1 | 1 | 0% | 1,879 | 3,537 | +88% | 0 | 0 | — |
▸case-21 Please write an Express.js middleware function in TypeScript for 'auth-service' that verifies incoming JSON Web Tokens (JWT) using the jsonwebtoken package and attaches the decoded user payload to req.user. | pass→fail | 17,566 | 32,516 | +85% | 1 | 1 | 0% | 2,212 | 5,890 | +166% | 0 | 0 | — |
▸case-22 Write a GitHub Actions workflow file at .github/workflows/dependency-check.yml that runs npm audit on every pull request to main and fails the workflow if high or critical vulnerabilities are detected. | pass→pass | 12,625 | 20,913 | +66% | 1 | 1 | 0% | 1,091 | 3,040 | +179% | 0 | 0 | — |