Secure Coding Labs

Practice real-world secure coding scenarios through hands-on challenges and labs.

Use of a Broken or Risky Cryptographic Algorithm

This vulnerability arises when a system uses cryptographic algorithms that are known to be weak, deprecated, or implemented in a...

medium

Business logic vulnerability

medium CWE-682 move

Logic errors, also known as business logic vulnerabilities, are subtle flaws in smart contracts. They occur when the contract’s code...

high

Flash Loan Attacks

high CWE-345 CWE-20 move

Flash loan attacks exploit the ability to borrow large sums of funds without collateral within a single transaction. These attacks...

medium

Insecure AES-GCM Token Tampering and Truncation

medium CWE-327 CWE-347 ruby

AES-GCM (Galois/Counter Mode) is an authenticated encryption algorithm that provides both confidentiality and integrity. However, when implemented insecurely — for...

high

Improper JWT Audience Validation

high CWE-345 CWE-285 CWE-287 python flask fastapi

Improper JWT Audience Validation Improper JWT Audience Validation occurs when an application accepts a JSON Web Token (JWT) without verifying...

low

Insufficient Flow Control Mechanisms

low CWE-284 github

Insufficient flow control mechanisms occur when CI/CD pipelines lack restrictions on how data, artefacts, and jobs flow between stages or...

low

Poisoned Pipeline Execution

low CWE-494 CWE-829 github

Poisoned Pipeline Execution (PPE) occurs when untrusted code is injected into a CI/CD pipeline and executed with the privileges of...

medium

Insufficient Credential Hygiene

medium CWE-497 CWE-200 github

CI/CD pipelines often rely on credentials such as API keys, SSH keys, cloud tokens, or service account secrets to fetch...

high

Insufficient PBAC

high CWE-367 github

This risk arises when individual steps in a CI/CD pipeline lack granular access controls, or when access checks are not...

No matching labs found

Try adjusting your search keywords or language filter.