Developer Security Challenge Library

Practice real-world secure coding scenarios through hands-on challenges and labs.

This is our public challenge library. Enterprise teams also get private, industry-specific challenges built for their stack.

low

Lack of Integrity Check

CWE-1357CWE-494containergithub

When a container image that is externally sourced is not pinned to their SHA hash, malicious modification of the image...

medium

Unnecessary Privilege

CWE-250container

Unnecessary privilege happens when the process runs under a high privilege account. In the case of a container running with...

medium

Log Injection

CWE-117CWE-93javascriptgorubypythoncsharp

Log injection happens when untrusted data is stored in logs and does not escaped when used by the downstream component...

high

JWKS Leak

typescriptjavascript

JSON Web Key Sets (JWKS) is a standard format for representing a set of cryptographic keys used for implementing digital...

high

JWT Algorithm Confusion

CWE-347typescriptjavascript

JWT Algorithm Confusion (Key Confusion) happens when an adversary can change the key and algorithm used for verifying the token...

high

Weak Credentials

CWE-798CWE-1392CWE-257CWE-338CWE-331typescriptrubyjavascriptgojava

The use of weak, easily guessable, or default cryptographic keys significantly increases the risk of unauthorised access and security bypass....

medium

Server Side Request Forgery

battleCWE-918CWE-639CWE-200gorubypythonjavascripttypescript

Server Side Request Forgery (SSRF) happens when untrusted input is used to construct requests to other resources, potentially on internal...

high

Secret Disclosure

incident-responseCWE-212CWE-798rubypythonjavascripttypescriptgo

Secrets (API keys, private keys, etc) are exposed in the code repository or source code. Unnecessary exposure of sensitive data...

medium

Insecure Direct Object Reference

CWE-639CWE-425CWE-340gojavacsharppythontypescript

Insecure Direct Object Reference (IDOR) occurs when an application exposes internal implementation objects (e.g., database keys, filenames, or record IDs)...

Enterprise

Need something specific?

We build custom, private challenges modelled on your codebase and threat model for enterprise teams.

No matching labs found

Try adjusting your search keywords or selected topic.