Scenario : Crosswind has run since 2019 on member dues and three volunteer mods — no ads, no premium tier, no syncing your heart-rate to a hedge fund. The stack is whatever ran fine on a Linode in...

Scenario : Traverse is a four-person developer-tools startup out of Berlin that launched their API product in 2023 and rewrote the docs portal last month after a Show-HN thread complained the old ...

Scenario : Calliope was founded in 2021 by two former MFA students who couldn’t get a toehold on the New York gallery circuit and decided to build their own. Three years on, the roster is about ei...

Scenario : Fermata connects clients with piano tuners. An old debug line left over from development drops the booking reference into an HTML comment so ops can scan View Source for bad IDs. It nev...

Scenario : After a phishing near-miss, Sprocket Line’s owner hired someone to “add security.” He got one line of PHP that strips Solution : We first start by navigating the application just l...

Scenario : Two founders, eighteen months in, no marketing budget, no AI features. They built their own session layer one weekend “because we don’t need a whole library for this.” A junior contract...

Scenario : CliniCore shipped a GraphQL API to power their new timeline feature. A viewerRole variable was added during development to allow the admin panel to preview how different roles see pati...

Summary : Gatekeeper Corp presents a web application with a login portal vulnerable to SQL Injection Authentication Bypass. The login form fails to properly sanitize user input, allowing an attac...

Summary : In this challenge we are presented with a web application that we first enumerate as a normal user, mapping out its endpoints and functionality. During enumeration we identify two inte...

Scenario : Rivet & Tack is a two-generation leather shop out of Millerton — belts and dog collars from $48, custom saddle work by appointment, founded 1986. The order-lookup page was bolted on...