Security engineers and reviewers who support development teams
Application security engineer
Review-first: learn to spot defects in pull requests, confirm them by fixing the code, and trace real incidents back to the bug that caused them.
- 10/3
Code review fundamentals
Find authorization and data-exposure defects in ordinary-looking PRs.
- Review a pull request: orders APICRV-03Secure Code ReviewFoundationalNot solved
A PR adds order detail, address change and item removal routes. The list route is scoped to the user — are the new ones?
- Review a pull request: customer APICRV-01Secure Code ReviewPractitionerNot solved
A backend PR adds customer search, bulk export and support password resets. Find every security defect before it merges.
- Review a pull request: React profile pageCRV-02Secure Code ReviewFoundationalNot solved
A frontend PR renders user bios, stores a token and redirects after saving. Find the client-side defects.
- 20/4
Harder review findings
Catch the defects that need you to reason about timing, regexes and file handling.
- Review a pull request: coupons and withdrawalsCRV-04Secure Code ReviewAdvancedNot solved
Money-moving code that is correct one request at a time. Find what breaks when requests arrive together.
- Review a pull request: validation helpersCRV-05Secure Code ReviewPractitionerNot solved
New validators for sign-up and search. Some regexes take exponential time on the right input. Find them.
- Review a pull request: ticket attachmentsCRV-06Secure Code ReviewPractitionerNot solved
Customers can now attach files to support tickets. Upload handling is one of the riskiest features to get wrong — review it.
- Review a pull request: login endpointCRV-07Secure Code ReviewFoundationalNot solved
A rewrite of the login route adds logging and a remember-me cookie. The password check is fine — almost nothing else is.
- 30/3
Prove it with a fix
Turn findings into fixes that pass a security test suite.
- Stop SSRF in a link-preview fetcherSCD-08Secure CodingPractitionerNot solved
The server fetches any URL a user pastes. Its allow-list is a substring check. Make it impossible to reach internal hosts.
- Verify JSON Web Tokens correctlySCD-06Secure CodingAdvancedNot solved
An API reads claims from a JWT without checking the signature. Verify it properly and pin the algorithm.
- Stop prototype pollution in a settings mergeSCD-10Secure CodingAdvancedNot solved
A deep merge applies user JSON to stored settings. One key reaches every object in the process. Make the merge safe.
- 40/2
From incident to root cause
Follow an attack through logs to the vulnerable code behind it.
- Investigate a web shell on the helpdeskINV-05Detection & ResponsePractitionerNot solved
A PHP helpdesk server called out to an unknown host. Find the uploaded shell, what the attacker ran and whose account they used.
- Investigate an account takeover via password resetINV-06Detection & ResponseAdvancedNot solved
A customer lost her account after clicking a genuine reset email. Work out how the attacker got the token and what they did with it.