Security Practice
Investigate symptoms, inspect boundary evidence, identify the root cause, contain impact and preserve a regression test. Incident exercises make response ordering matter.
beginner
Broken authorization · password storage · cookie flags · validation · DB privilege
intermediate
OAuth/OIDC · CSRF · XSS · webhooks · tenant isolation · secrets
advanced
SSRF · cloud IAM · segmentation · supply chain · secure CI/CD
expert
Complex threat models · incidents · agent security · payment integrity · platform security
Debug a security failure
The Invoice That Belonged to Someone Elsebeginner
A customer reports seeing a different company’s invoice.
Production Key in a Public Commitintermediate
Secret scanning reports a production API key in git history.
The Payment Event That Was Never Signedintermediate
Orders become paid without matching provider records.
Agent Deletes the Wrong Projectexpert
A support agent deleted files after reading an untrusted ticket attachment.
Incident exercises
Choose containment and recovery steps; attractive but harmful actions are included.