▸case-11 We load external third-party JavaScript utilities from a public CDN script tag (<script src="https://cdn.example.com/lib.js"></script>). What HTML attributes should be added to the script tag to ensure the client browser verifies the remote file has not been altered or compromised? Provide the updated script element. | pass→pass | 6,331 | 7,089 | +12% | 1 | 1 | 0% | 1,067 | 3,415 | +220% | 0 | 0 | — |
▸case-01 I am building a dashboard where dynamic chat comments from unverified backend feeds are rendered onto the page. Please refactor my front-end rendering logic to prevent client-side script injection vulnerabilities. Output the complete updated JavaScript code along with a short explanation of the code changes. | fail→fail | 13,079 | 25,354 | +94% | 1 | 1 | 0% | 2,501 | 6,401 | +156% | 0 | 0 | — |
▸case-02 Our team is releasing a sensitive web portal and needs to safeguard user actions against framing and UI overlay attacks. Please provide a client-side script that handles frame detection for critical operations across different deployment environments, formatted as a reusable JavaScript module with an accompanying technical summary. | fail→fail | 18,295 | 19,484 | +6% | 1 | 1 | 0% | 3,349 | 5,855 | +75% | 0 | 0 | — |
▸case-03 We are implementing a web login flow that accepts a target query parameter to forward users after authenticating. Please supply a TypeScript helper module that safely processes dynamic navigation links to prevent open redirect exploits, returning the full code implementation and a brief breakdown of the structural safeguards. | fail→fail | 23,802 | 18,773 | -21% | 1 | 1 | 0% | 4,407 | 5,514 | +25% | 0 | 0 | — |
▸case-04 We are designing a microservices architecture for an e-commerce platform handling payments. Please conduct a high-level threat model using the STRIDE framework and provide a risk matrix for the backend service boundaries. | fail→fail | 20,935 | 18,081 | -14% | 1 | 1 | 0% | 3,615 | 5,021 | +39% | 0 | 0 | — |
▸case-17 When a user clicks 'Log Out' in one browser tab, other open tabs of the same web application currently remain active until refreshed. How can a client-side web application detect and propagate session termination across multiple open browser tabs in real time without continuous server polling? Provide a JavaScript code example using standard browser APIs. | pass→pass | 15,862 | 16,093 | +1% | 1 | 1 | 0% | 2,931 | 5,009 | +71% | 0 | 0 | — |
▸case-05 Our DevOps team wants to configure a GitHub Actions CI/CD pipeline to automatically scan backend Docker containers for CVEs using Trivy and enforce pull request gating rules. Please provide the workflow YAML and pipeline architecture guidance. | fail→pass | 18,923 | 16,518 | -13% | 1 | 1 | 0% | 3,292 | 4,952 | +50% | 0 | 0 | — |
▸case-06 Our SaaS company is preparing for an upcoming SOC 2 Type II audit regarding data retention and access control compliance policies across database infrastructure. Please provide a compliance checklist and audit evidence gathering plan. | fail→pass | 27,669 | 14,062 | -49% | 1 | 1 | 0% | 4,243 | 4,368 | +3% | 0 | 0 | — |
▸case-07 We are building a blog comment section in React where users can submit rich HTML markup formatted via a WYSIWYG editor. A junior developer suggested using a custom regular expression replace function to strip out <script> tags before rendering the HTML via dangerouslySetInnerHTML. How should dynamic rich text HTML be sanitized on the client side before rendering? Output your recommended approach and code. | pass→pass | 13,049 | 15,597 | +20% | 1 | 1 | 0% | 2,214 | 4,936 | +123% | 0 | 0 | — |
▸case-08 We have a user profile page displaying user-provided social media links. The developer written HTML is <a href="userUrl" target="_blank">Profile</a>. What security vulnerability does this pattern introduce when opening external links in new tabs, and how should the anchor attributes be updated in frontend code? Provide the complete anchor tag implementation and explanation. | pass→pass | 9,893 | 11,836 | +20% | 1 | 1 | 0% | 1,734 | 4,320 | +149% | 0 | 0 | — |
▸case-09 In a live ticker component, dynamic notifications arrive as plain string messages from a websocket. A developer used containerElement.innerHTML = message text to display them. What is the safer native DOM property to set when rendering unformatted text content, and why? Provide the refactored DOM update function. | pass→pass | 7,312 | 7,917 | +8% | 1 | 1 | 0% | 1,271 | 3,398 | +167% | 0 | 0 | — |
▸case-10 We are implementing client-side user authentication for a Single Page Application using OAuth 2.0. A team member suggested storing an OAuth client_secret in the frontend environment file and using the standard Authorization Code grant. What authentication mechanism should a frontend SPA use to handle OAuth 2.0 authorization securely without storing client secrets? | pass→pass | 11,837 | 17,638 | +49% | 1 | 1 | 0% | 2,071 | 4,992 | +141% | 0 | 0 | — |
▸case-12 Our enterprise web app needs to enforce browser-level defense-in-depth against DOM-based XSS vulnerabilities by locking down dangerous JavaScript injection sinks like innerHTML and eval(). What modern web browser API standard enables creating policies to sanitize dynamic values before they reach DOM sinks? | pass→pass | 9,399 | 11,060 | +18% | 1 | 1 | 0% | 1,539 | 4,060 | +164% | 0 | 0 | — |
▸case-13 In a customizable dashboard, users can pick a custom hex color code or CSS property value to theme their widget. A developer implements this using element.setAttribute('style', userCssString). How should user-supplied dynamic CSS values be safely handled to prevent CSS injection attacks? Provide the secure implementation. | pass→pass | 15,966 | 19,890 | +25% | 1 | 1 | 0% | 2,838 | 5,698 | +101% | 0 | 0 | — |
▸case-14 We are building a form input field for a promo code that accepts alphanumeric standard format codes (e.g., PROMO2026). A teammate proposed using a regex blocklist that checks for specific dangerous characters like <, >, ', and ". What client-side input validation strategy should be used instead of a blocklist? Provide the JavaScript validation function. | pass→pass | 9,894 | 16,286 | +65% | 1 | 1 | 0% | 1,642 | 4,504 | +174% | 0 | 0 | — |
▸case-15 Our frontend application receives a JWT access token upon user login. A developer wants to save this token in localStorage so it persists across page reloads. What is the primary security risk of storing sensitive authentication tokens in localStorage, and what is the recommended browser cookie configuration for token storage? | pass→pass | 10,383 | 9,028 | -13% | 1 | 1 | 0% | 1,809 | 3,608 | +99% | 0 | 0 | — |
▸case-16 We are configuring a Content Security Policy header for a Single Page Application. A team member suggested setting script-src 'self' 'unsafe-inline' to allow inline startup scripts. How should inline scripts be handled securely in the Content Security Policy without using unsafe-inline? Provide the CSP header directive example. | pass→pass | 12,510 | 13,280 | +6% | 1 | 1 | 0% | 2,236 | 4,550 | +103% | 0 | 0 | — |
▸case-18 In a profile avatar upload component, the frontend checks if (file.name.endsWith('.png')) before uploading. What client-side checks should be performed on uploaded files before sending them to the backend? Provide the updated JavaScript validation function. | pass→pass | 16,545 | 19,424 | +17% | 1 | 1 | 0% | 3,337 | 6,035 | +81% | 0 | 0 | — |
▸case-19 We embed an interactive partner widget inside an iframe. The parent window listens for messages using window.addEventListener('message', (event) => { handleData(event.data); }). What critical security check is missing from this event listener implementation? Provide the refactored listener. | pass→pass | 8,484 | 9,165 | +8% | 1 | 1 | 0% | 1,451 | 3,798 | +162% | 0 | 0 | — |
▸case-20 We are building a Progressive Web App (PWA) and configuring a Service Worker caching policy. A developer wants to use a Cache-First strategy for all network requests, including dynamic API endpoints returning sensitive user profile and transaction data (/api/user/profile). What caching strategy should be applied to dynamic authenticated user data? | pass→pass | 12,018 | 15,126 | +26% | 1 | 1 | 0% | 2,037 | 4,648 | +128% | 0 | 0 | — |
▸case-21 We need to protect a web application from clickjacking framing attacks at the HTTP response header level. What Content Security Policy directive replaces the legacy X-Frame-Options SAMEORIGIN header, and how is it formatted? Provide both headers. | pass→pass | 3,948 | 4,597 | +16% | 1 | 1 | 0% | 724 | 3,008 | +315% | 0 | 0 | — |
▸case-22 To use high-resolution timers and SharedArrayBuffer in the browser safely, our frontend needs to be cross-origin isolated. Which two HTTP response headers must be configured on the web server to enable cross-origin isolation? | pass→pass | 3,167 | 4,334 | +37% | 1 | 1 | 0% | 616 | 2,899 | +371% | 0 | 0 | — |