Developer Security Challenges

Hands-on challenges across secure coding, AI security, DevSecOps, cloud security, attack & defence, exploitation, incident response, and web3 security — every one a real repository you clone, hack, and fix.

This is our public challenge library. Enterprise teams also get private, industry-specific challenges built for their stack.

low

Logging of Excessive Data

CWE-779gcp

The application generates an excessive volume of log data, resulting in oversized log files and reduced visibility into security-relevant events....

medium

Improper Handling of Expired Resources

CWE-672gcp

The application does not implement adequate lifecycle management for generated artifacts, temporary resources, or expired assets. Resources that have exceeded...

high

Missing Vulnerability Scanning for Container Images

CWE-693CWE-1269gcp

Container images are not configured to be scanned for known vulnerabilities before deployment. Without image vulnerability scanning, insecure base images,...

medium

Missing Encryption Key for GCP Instance

CWE-311gcpGCP

The GCP instance is not configured to use a customer-managed encryption key. The relevant Terraform resource does not set encryption_key_name,...

high

Cleartext Transmission of Sensitive Information

CWE-319gcp

The application transmits sensitive or security-critical data over an unencrypted communication channel. Because the data is sent in cleartext, an...

high

Use of Hard-coded Password

CWE-259CWE-798gcp

The application contains a hard-coded password within its source code, binary, configuration, or authentication logic. Hard-coded passwords create a serious...

high

Missing Encryption at Rest for Azure Data Explorer Cluster

CWE-311azureAzure

The Azure Data Explorer cluster is not configured to enforce disk encryption at rest. The azurerm_kusto_cluster resource in iac/main.tf does...

high

Permissive Cross-Domain Security Policy

CWE-942azure

The application defines an overly permissive cross-domain security policy that allows communication with untrusted or broadly matched domains. This weakens...

medium

Missing Customer-Managed Key Encryption on Azure Cosmos DB

CWE-922azureAzure

The Azure Cosmos DB account does not configure a customer-managed encryption key because key_vault_key_id is omitted from the azurerm_cosmosdb_account resource....

Enterprise

Need something specific?

We build custom, private challenges modelled on your codebase and threat model for enterprise teams.

No matching labs found

Try adjusting your search keywords or selected topic.