Developers who build APIs and server-side code
Secure backend development
The vulnerabilities that most often reach production in web backends, in the order you are likely to meet them: injection first, then access control, authentication and the server’s own outbound requests.
- 10/3
Injection
Keep user input out of queries, shell commands and file paths.
- Fix SQL injection in a user lookupSCD-01Secure CodingFoundationalNot solved
A support tool builds SQL by concatenating a name from the URL. Parameterise it without breaking lookups.
- Run a system command without a shellSCD-05Secure CodingPractitionerNot solved
A connectivity check passes a user-supplied host to a shell. Remove the shell and validate the input.
- Contain file downloads to one directorySCD-04Secure CodingPractitionerNot solved
A download endpoint joins user input onto a base path. Make sure no input can resolve outside it.
- 20/3
Access control
Check who may act on which record, and which fields a request may set.
- Add object-level authorisationSCD-03Secure CodingPractitionerNot solved
Any signed-in customer can read any invoice by changing the ID. Enforce ownership without locking out admins.
- Fix mass assignment in a profile updateSCD-09Secure CodingFoundationalNot solved
PATCH /me copies the whole request body onto the user. Let users edit their profile without promoting themselves.
- Review a pull request: orders APICRV-03Secure Code ReviewFoundationalNot solved
A PR adds order detail, address change and item removal routes. The list route is scoped to the user — are the new ones?
- 30/3
Authentication and secrets
Store passwords properly and issue tokens that cannot be guessed or forged.
- Fix password storageSCD-11Secure CodingPractitionerNot solved
Passwords are stored as unsalted MD5. Replace it with a salted, slow key-derivation function and a constant-time check.
- Fix predictable password-reset tokensSCD-13Secure CodingFoundationalNot solved
Reset tokens come from Math.random() and the clock, and stay valid for a week. Make them unguessable and short-lived.
- Verify JSON Web Tokens correctlySCD-06Secure CodingAdvancedNot solved
An API reads claims from a JWT without checking the signature. Verify it properly and pin the algorithm.
- 40/3
Server-side requests and runtime
Control what the server fetches and avoid bugs that only show under attack traffic.
- Stop SSRF in a link-preview fetcherSCD-08Secure CodingPractitionerNot solved
The server fetches any URL a user pastes. Its allow-list is a substring check. Make it impossible to reach internal hosts.
- Stop prototype pollution in a settings mergeSCD-10Secure CodingAdvancedNot solved
A deep merge applies user JSON to stored settings. One key reaches every object in the process. Make the merge safe.
- Review a pull request: coupons and withdrawalsCRV-04Secure Code ReviewAdvancedNot solved
Money-moving code that is correct one request at a time. Find what breaks when requests arrive together.