Secure Coding Labs

Practice real-world secure coding scenarios through hands-on challenges and labs.

LLM Information Disclosure

Sensitive information poses risks to both the LLM itself and its application context. This includes personally identifiable information (PII), financial...

medium

Infinite Token

medium CWE-613 python javascript typescript csharp ruby

Infinite Token (or Token Cycling) vulnerability occurs when a refresh token is designed in a way that it never expires...

low

Compression Bomb

low CWE-400 python go flask

A compression bomb is a maliciously crafted compressed file designed to consume excessive resources, such as memory and processing power,...

medium

Zip Slip

medium CWE-22 CWE-23 CWE-59 CWE-36 CWE-73 python go javascript flask node

Zip Slip is a critical vulnerability that occurs when extracting files from a compressed archive (e.g., ZIP, TAR) without proper...

critical

Insecure Supply Chain

critical CWE-1357 artificial-inteligence

Insecure supply chain vulnerabilities occur when a machine learning (ML) model, particularly a large language model (LLM), is sourced from...

medium

Race Condition

medium CWE-366 go

A race condition vulnerability occurs in concurrent operations when the behaviour of a program depends on the timing or sequence...

high

Privilege Escalation

high CWE-639 CWE-266 python typescript fastapi

Privilege Escalation occurs when an attacker gains elevated access to resources that are normally protected, beyond what they are originally...

medium

Unrestricted File Upload

medium CWE-434 python php django laravel

Unrestricted file upload in a web application refers to a security vulnerability where the application allows users to upload files...

high

JWT Insufficient Session Expiration

high CWE-613 python java javascript ruby go

A JWT token must expire after a period of time. Otherwise an adversary has higher chance of reusing an old...

No matching labs found

Try adjusting your search keywords or language filter.