Solution #3: Dice

The official solution to Challenge #3: Dice.

Covers the correct answer, why the (absent) auth model is a red herring, the full application code flow, the threat model with mitigation review, complete exploitation steps (fullwidth ＜img onerror＞ reviving a stripped tag), the fix, CWE grounding (CWE-79 XSS via CWE-180 "Validate Before Canonicalize", rooted in CWE-176 Unicode handling), and real-world grounding (DOMPurify's own "do not modify the output" rule + Unicode normalization security guidance).

• Read it in the repo: solutions/003-dice/SOLUTION.md
• Also attached below as a standalone file.

No spoilers were posted anywhere before this release — thanks to everyone who worked through it privately. Discussion is welcome now that it's out.

Challenge #4: File Converter

The fourth drop in The Secure Code Review Challenge: File Converter, a document-conversion service (Express.js / Node, MongoDB, session auth) that converts uploaded documents with Pandoc as asynchronous background jobs. It exposes both a JSON API and a server-rendered web UI over the same data.

It contains one deliberately planted, real-world-grounded vulnerability. Threat-model it, find the flaw, exploit it, and propose a fix.

• Challenge brief + how to run it: challenges/004-file-converter/README.md
• Solution template: SOLUTION_TEMPLATE.md

The solution for this challenge will be published separately as a solution-004-file-converter release.

Solution #2: Professional

The official solution to Challenge #2: Professional.

Covers the correct answer, why the plausible alternatives don't fit, the full application code flow, the threat model with mitigation review, complete exploitation steps, the fix, CWE grounding (CWE-94 / CWE-95), the CVE (CVE-2023-33733 — remote code execution in ReportLab reached through unescaped user text in a PDF markup sink), and a real-world example (Equifax 2017).

• Read it in the repo: solutions/002-professional/SOLUTION.md
• Also attached below as a standalone file.

No spoilers were posted anywhere before this release — thanks to everyone who worked through it privately. Discussion is welcome now that it's out.

Challenge #3: Dice

The third drop in The Secure Code Review Challenge: Dice, a small dice-roller and random-word-selector web app (Express.js / Node, a JSON API plus a static browser UI).

It contains one deliberately planted, real-world-grounded vulnerability. Threat-model it, find the flaw, exploit it, and propose a fix.

• Challenge brief + how to run it: challenges/003-dice/README.md
• Solution template: SOLUTION_TEMPLATE.md

The solution for this challenge will be published separately as a solution-003-dice release.

Solution #1: Schooled

The official solution to Challenge #1: Schooled.

Covers the correct answer, why the plausible alternatives don't fit, the "why it looks safe" analysis, full exploitation steps, the fix, CWE grounding (CWE-179, plus related CWE-1289 / CWE-184), and a real-world example (HashiCorp Vault).

• Read it in the repo: solutions/001-schooled/SOLUTION.md
• Also attached below as a standalone file.

No spoilers were posted anywhere before this release — thanks to everyone who worked through it privately. Discussion is welcome now that it's out.

Challenge #2: Professional

The second drop in The Secure Code Review Challenge: Professional, a profile-management and résumé-generation API (Flask + MongoDB + JWT, JSON API + a static browser UI).

It contains one deliberately planted, real-world-grounded vulnerability. Threat-model it, find the flaw, exploit it, and propose a fix.

• Challenge brief + how to run it: challenges/002-professional/README.md
• Solution template: SOLUTION_TEMPLATE.md

The solution for this challenge will be published separately as a solution-002-professional release.

Challenge #1: Schooled

The first drop in The Secure Code Review Challenge: Schooled, a course-management API (Express + PostgreSQL + JWT, server-rendered UI + JSON API).

It contains one deliberately planted, real-world-grounded vulnerability. Threat-model it, find the flaw, exploit it, and propose a fix.

• Challenge brief + how to run it: challenges/001-schooled/README.md
• Solution template: SOLUTION_TEMPLATE.md

The solution for this challenge is published separately — see the solution-001-schooled release.