CodingLevel 3
Security review
Easynot started
Mediumnot started
Hardnot started
StatusFormatCompany style
Easy
Invoice download endpoints for the billing pageCode review · Stripe styleStripe styleCode reviewStripe style10 minProfile update route for account settingsCode review · Salesforce styleSalesforce styleCode reviewSalesforce style10 minCoupon lookup builds SQL from the typed codeCode reviewCode review10 minLive SMS token committed in a helper moduleCode reviewCode review10 minExpense approval skips the approver checkCode reviewCode review12 minGift card codes come from the random moduleCode reviewCode review10 minAttachment delete joins a user filename onto the upload pathCode reviewCode review12 minMedium
String concatenation in SQLCode reviewCode review25 mininnerHTML with user inputCode reviewCode review20 minShell injection via filenameCode reviewCode review20 minPing endpoint command injectionCode review · Cisco styleCisco styleCode reviewCisco style20 minPassword hash reuses global saltCode review · Coinbase styleCoinbase styleCode reviewCoinbase style20 minHardcoded API keys in sourceCode review · Stripe styleStripe styleCode reviewStripe style20 minToken check middleware for the API gatewayCode review · Stripe styleStripe styleCode reviewStripe style20 minAPI key comparison timing-sensitiveCode review · Stripe styleStripe styleCode reviewStripe style25 minUnescaped HTML injectionCode review · Meta styleMeta styleCode reviewMeta style20 minSQL injection in sort columnCode reviewCode review20 minSQL injection in ORDER BYCode reviewCode review22 minSHA256 replaces password hashingCode review · Coinbase styleCoinbase styleCode reviewCoinbase style25 minHard
Table name not parameterizedCode reviewCode review30 minMarkup wraps untrusted HTMLCode reviewCode review25 minEncryption produces different outputCode review · Coinbase styleCoinbase styleCode reviewCoinbase style30 minMass assignment vulnerability in FastAPICode review · Salesforce styleSalesforce styleCode reviewSalesforce style30 minXML parser vulnerable to XXECode reviewCode review30 minCSV export unescaped delimitersCode reviewCode review30 minUnvalidated URL hrefCode review · Meta styleMeta styleCode reviewMeta style22 minAES uses static zero IVCode review · Coinbase styleCoinbase styleCode reviewCoinbase style30 minDisplay name concatenated into SQLCode reviewCode review35 minDeep merge allows prototype pollutionCode reviewCode review30 minMarkdown sanitizer allows onclickCode review · Google styleGoogle styleCode reviewGoogle style22 minSource URL javascript protocolCode review · Google styleGoogle styleCode reviewGoogle style20 min