Developer Security Challenge Library

Practice real-world secure coding scenarios through hands-on challenges and labs.

This is our public challenge library. Enterprise teams also get private, industry-specific challenges built for their stack.

high

LLM Information Disclosure

CWE-359artificial-inteligence

Sensitive information poses risks to both the LLM itself and its application context. This includes personally identifiable information (PII), financial...

medium

Infinite Token

CWE-613pythonjavascripttypescriptcsharpruby

Infinite Token (or Token Cycling) vulnerability occurs when a refresh token is designed in a way that it never expires...

low

Compression Bomb

CWE-400pythongoflask

A compression bomb is a maliciously crafted compressed file designed to consume excessive resources, such as memory and processing power,...

medium

Zip Slip

CWE-22CWE-23CWE-59CWE-36CWE-73pythongojavascriptflasknode

Zip Slip is a critical vulnerability that occurs when extracting files from a compressed archive (e.g., ZIP, TAR) without proper...

critical

Insecure Supply Chain

CWE-1357artificial-inteligence

Insecure supply chain vulnerabilities occur when a machine learning (ML) model, particularly a large language model (LLM), is sourced from...

medium

Race Condition

CWE-366go

A race condition vulnerability occurs in concurrent operations when the behaviour of a program depends on the timing or sequence...

high

Privilege Escalation

CWE-639CWE-266pythontypescriptfastapi

Privilege Escalation occurs when an attacker gains elevated access to resources that are normally protected, beyond what they are originally...

medium

Unrestricted File Upload

CWE-434pythonphpdjangolaravel

Unrestricted file upload in a web application refers to a security vulnerability where the application allows users to upload files...

high

JWT Insufficient Session Expiration

CWE-613pythonjavajavascriptrubygo

A JWT token must expire after a period of time. Otherwise an adversary has higher chance of reusing an old...

Enterprise

Need something specific?

We build custom, private challenges modelled on your codebase and threat model for enterprise teams.

No matching labs found

Try adjusting your search keywords or selected topic.