Developer Security Challenge Library

Practice real-world secure coding scenarios through hands-on challenges and labs.

This is our public challenge library. Enterprise teams also get private, industry-specific challenges built for their stack.

Prompt injection happens when untrusted input is interpreted as instruction for large language model (LLM) systems. This is misused to...

Cross Frame Scripting (XFS) hides a legitimate website in an iframe. User unknowingly interacts with the iframe white interacting with...

Clickjacking happens when a user unknowingly initiation some actions in a UI white interacting with the UI from another domain....

Cross Origin Resource Sharing (CORS) is a way to punch hole in the security brought by a browser. If it...

Cross Origin Resource Sharing (CORS) is a way to punch hole in the security brought by a browser. If it...

Cross Origin Resource Sharing (CORS) is a way to punch hole in the security brought by a browser. If it...

Cookie SameSite attribute restricts how cookies are sent to cross-domain requests. This is an effective measure against Cross Site Request...

Without Max-Age a session cookie can remain in the browser for a pro-long time. This increases risk of session hijack....

The HttpOnly flag directs compatible browsers to prevent client-side script from accessing cookies. Including the HttpOnly flag in the Set-Cookie...

Enterprise

We build custom, private challenges modelled on your codebase and threat model for enterprise teams.

Try adjusting your search keywords or selected topic.