v2.15.1

What's New

• Migrated OWASP Top 10 references from the 2021 edition to the 2025 edition across the platform. @kOaDT #89
• Added CWE and OWASP identifiers to flags, and linked CVE/CWE/OWASP badges to their external reference pages. @kOaDT #89
• Flag values on the /flags page are now masked until they have been found by the user, preserving the challenge experience. @kOaDT
• In-app vulnerability pages now link directly to the corresponding walkthrough site for easier navigation. @kOaDT
• Added a dev.to social link to the site footer. @kOaDT

Bug Fixes

• Made the AES-CBC padding oracle tamper test deterministic, eliminating intermittent failures. @kOaDT
• Fixed a pre-existing gap where the INSECURE_DESIGN category was missing from the FlagCategory type. @kOaDT

Improvements

• Moved @types/canvas-confetti and @types/jsonwebtoken from dependencies to devDependencies, since they are only needed at build time @TrivCodez #79
• Reframed the CSRF challenge alert from the victim's perspective for clearer storytelling. @kOaDT #60
• Clarified the role split between content/ and docs/ in the contribution guides, rewrote the documentation, added a CSRF admin order update writeup, added the missing Insecure Randomness challenge to EDUCATORS.md, and removed a dead Flag retrieval TOC entry from the product-search writeup. @kOaDT

Maintenance / Chore

• Bumped actions/setup-node from 4.4.0 to 6.4.0 in CI workflows.