▸case-01 I am writing a new authentication module for a Python backend. I need to hash user passwords securely. Provide the code to hash a new password and verify it. Many tutorials suggest using bcrypt or hashlib's PBKDF2, but I want the most secure modern standard recommended for new applications. | pass→pass | 11,176 | 8,497 | -24% | 1 | 1 | 0% | 2,129 | 1,557 | -27% | 0 | 0 | — |
▸case-02 I need to encrypt sensitive PII fields before storing them in a PostgreSQL database using a Node.js backend. Provide the encryption and decryption functions. I usually use the built-in crypto module with AES-256-CBC, but I need a modern authenticated encryption approach. | pass→pass | 19,087 | 14,118 | -26% | 1 | 1 | 0% | 3,124 | 2,903 | -7% | 0 | 0 | — |
▸case-03 I am configuring an Express.js application that uses cookie-based sessions. Provide the cookie configuration object. I already know to set secure: true and httpOnly: true, but I need the maximum possible protection against CSRF and cookie tossing attacks. | pass→pass | 9,838 | 8,940 | -9% | 1 | 1 | 0% | 1,791 | 1,559 | -13% | 0 | 0 | — |
▸case-04 I am building a microservices architecture and need a stateless token format for authenticating API requests between services. Provide the implementation for generating and verifying these tokens. I want to avoid the common pitfalls of JWTs (like the 'none' algorithm or algorithm confusion attacks) by using a more secure-by-design alternative. | fail→fail | 21,536 | 15,761 | -27% | 1 | 1 | 0% | 3,037 | 3,122 | +3% | 0 | 0 | — |
▸case-05 I am deploying a modern React single-page application and need to configure the Content Security Policy (CSP) header. Provide the exact header string. A basic 'default-src self' breaks my dynamic imports and inline scripts, so I need a modern approach that allows dynamic scripts securely without using unsafe-inline. | pass→pass | 13,983 | 11,401 | -18% | 1 | 1 | 0% | 2,483 | 2,002 | -19% | 0 | 0 | — |
▸case-06 I am configuring CORS for a Spring Boot REST API. The API needs to be accessed by multiple subdomains (e.g., app.example.com, admin.example.com). Provide the WebMvcConfigurer implementation. I want to avoid using wildcard (*) or overly permissive regex patterns for the origins. | pass→pass | 13,853 | 10,128 | -27% | 1 | 1 | 0% | 2,119 | 1,589 | -25% | 0 | 0 | — |
▸case-13 I am implementing rate limiting for a login endpoint using Redis and Node.js. Provide the logic to track and limit requests. A simple counter with a TTL allows bursts at the boundary of the window, so I need a more precise algorithm. | pass→pass | 18,431 | 17,142 | -7% | 1 | 1 | 0% | 3,189 | 3,370 | +6% | 0 | 0 | — |
▸case-07 I am writing a SQLAlchemy query in Python where the user can select which column to sort by via a query parameter (e.g., ?sort=price). Provide the code to apply this sorting safely. I know string interpolation is bad, so I need the correct ORM-native way to handle dynamic column sorting. | pass→pass | 12,666 | 11,156 | -12% | 1 | 1 | 0% | 2,430 | 2,163 | -11% | 0 | 0 | — |
▸case-08 I need to parse an XML file uploaded by a user in a Python application using the lxml library. Provide the parsing code. I need to ensure the parser is completely immune to XML External Entity (XXE) attacks, overriding any unsafe defaults. | pass→pass | 10,331 | 7,605 | -26% | 1 | 1 | 0% | 1,924 | 1,333 | -31% | 0 | 0 | — |
▸case-09 I am building a webhook service in Go where the user provides a URL, and my server fetches it. Provide the HTTP client implementation. I need to prevent Server-Side Request Forgery (SSRF) where the user might try to access internal AWS metadata endpoints or localhost. | fail→fail | 21,747 | 21,759 | +0% | 1 | 1 | 0% | 4,395 | 4,525 | +3% | 0 | 0 | — |
▸case-10 I am implementing a profile picture upload feature in Django. Provide the view logic to validate the uploaded file. Checking the file extension and MIME type from the request is easily spoofed, so I need a robust method to verify it is actually a safe image. | pass→fail | 20,096 | 17,841 | -11% | 1 | 1 | 0% | 3,722 | 3,498 | -6% | 0 | 0 | — |
▸case-11 I need to generate a 6-digit numeric One-Time Password (OTP) for SMS verification in a Java Spring application. Provide the generation method. I know java.util.Random is predictable, so I need the cryptographically secure approach. | pass→pass | 16,584 | 6,337 | -62% | 1 | 1 | 0% | 1,772 | 1,171 | -34% | 0 | 0 | — |
▸case-12 I need to serialize and deserialize complex custom Python objects to store them in a Redis cache. Provide the serialization logic. I know the pickle module is unsafe for untrusted data, so I need a secure alternative that can still handle custom class instances. | fail→fail | 19,001 | 18,662 | -2% | 1 | 1 | 0% | 3,696 | 3,341 | -10% | 0 | 0 | — |
▸case-14 I am deploying a Node.js application via Docker Compose and need to provide it with a database password. Provide the docker-compose.yml snippet and the Node.js code to read it. I want to avoid passing the password via standard environment variables. | pass→pass | 9,276 | 6,636 | -28% | 1 | 1 | 0% | 1,745 | 1,276 | -27% | 0 | 0 | — |
▸case-15 I am configuring an Nginx reverse proxy for a highly secure financial application. Provide the SSL/TLS server block configuration. I want to drop support for older protocols and ensure maximum forward secrecy, overriding the default Nginx SSL settings. | fail→fail | 17,844 | 18,792 | +5% | 1 | 1 | 0% | 3,614 | 3,542 | -2% | 0 | 0 | — |
▸case-16 I am writing a Node.js script that serves a specific log file based on a filename provided in the query string (e.g., ?file=app.log). Provide the code to resolve the file path safely. I need to prevent directory traversal attacks (like ../../etc/passwd). | fail→fail | 14,049 | 9,548 | -32% | 1 | 1 | 0% | 2,645 | 1,740 | -34% | 0 | 0 | — |
▸case-17 I am writing a Python network diagnostic tool that takes a user-provided IP address and runs the system 'ping' command against it. Provide the execution code. I need to ensure this is completely immune to OS command injection. | pass→pass | 10,677 | 7,321 | -31% | 1 | 1 | 0% | 2,098 | 1,334 | -36% | 0 | 0 | — |
▸case-22 I am performing a network discovery scan on my local subnet 10.0.0.0/24 using nmap. Provide the exact command to perform a ping sweep without doing a port scan. | pass→pass | 3,303 | 3,078 | -7% | 1 | 1 | 0% | 514 | 448 | -13% | 0 | 0 | — |
▸case-18 I am implementing an audit logging middleware in Express.js that logs all incoming HTTP requests, including headers and body. Provide the middleware code. I need to ensure that sensitive user credentials are not accidentally written to the logs. | pass→pass | 14,874 | 11,438 | -23% | 1 | 1 | 0% | 3,148 | 2,338 | -26% | 0 | 0 | — |
▸case-19 I am building a Next.js application with custom API routes that mutate data. Provide the implementation to protect these routes from Cross-Site Request Forgery (CSRF). I cannot rely solely on SameSite cookies because some users are on older browsers. | pass→pass | 23,931 | 15,823 | -34% | 1 | 1 | 0% | 4,423 | 3,078 | -30% | 0 | 0 | — |
▸case-20 I am configuring a Cisco IOS router and need to set up OSPF routing for area 0 on the 192.168.1.0/24 network. Provide the exact CLI commands. | pass→pass | 4,860 | 3,699 | -24% | 1 | 1 | 0% | 871 | 684 | -21% | 0 | 0 | — |
▸case-21 I am configuring a Linux server using iptables. Provide the exact command to block all incoming traffic on port 23 (Telnet). | pass→pass | 4,959 | 3,200 | -35% | 1 | 1 | 0% | 558 | 549 | -2% | 0 | 0 | — |