Security
45 practice items · needed by 11 roles
Easy 10Medium 14Hard 21
Practice questions
- Stopping SQL injectioneasy
- How to store passwordseasy
- Keeping secrets out of codeeasy
- Database user for the appeasy
- Logging out with JWTsmedium
- Risk of "import image from URL"medium
- Any user can read any invoicemedium
- Saving req.body directlymedium
- CDN serves one user's profile to anothermedium
- JWT verified with an attacker-chosen algorithmhard
- Comparing secrets with ===hard
- Sorting by a user-chosen columnhard
- Deep merge of untrusted JSONhard
- Where to keep a secret keyeasy
- Preventing SQL injectioneasy
- Storing user passwordseasy
- The .env file and Giteasy
- JWT in localStoragemedium
- CSRF with cookie sessionsmedium
- Refresh token rotationhard
- Client reports its own damagehard
- Free gems from fake purchaseshard
- Spot the reentrancy bugmedium
- Using tx.origin for authmedium
- Upgrading a proxy safelymedium
- Overflow in Solidity 0.8medium
- Lending protocol price oraclehard
- Replaying a signed messagehard
- First depositor in a vaulthard
- Reentrancy through a view functionhard
- Paying everyone in a loophard
- delegatecall to user inputhard
- Bricked devices after an updatehard
- NetworkPolicy has no effectmedium
- Emergency access to productionhard
- Keeping tenants apart in RAGmedium
- Running SQL that an LLM wrotemedium
- Injected instructions in a web pagehard
- Data leaking through image linkshard
- A suspicious third-party MCP serverhard
- Where API keys belongeasy
- Loading a model from a public hubhard
- Hashing emails is not anonymisinghard
- Passwords in test codeeasy
- Copying production data for testshard