Scenario : Rill is a creek-conservation volunteer network. Their sign-up search has a 24-character cap because the dev heard “shorter queries are safer.” There’s no other filter. Solution : As...

Scenario : Aerotrust’s catalog backend dates back to a 1999 migration off a homegrown FoxPro setup. The PHP front-end was wrapped around it the same year. The underlying storage was quietly swappe...

Scenario : Porchlight lends power tools to 300 neighborhood members. Their developer knows you’re supposed to html-escape user input before putting it in a page. She did. The reflection happens to...

Scenario : Chorus is an indie music review site. The dev added a personal “Hi, !" greeting using an inline script that calls htmlspecialchars — but without ENT_QUOTES. Angles are escaped. Quotes a...

Scenario : Salt Brook Pilates is a founder-led studio in the Hudson Valley running reformer classes out of two storefronts. Drop-ins are $32, monthly unlimited is $260, and the booking site was re...

Scenario : Headcount’s engineering team added an include_raw parameter to the aggregation endpoint for debugging during the compensation review sprint. A TODO comment in the org chart template rem...

Scenario : Canal Cove Books is a neighborhood used-book shop with a search over 40,000 titles. The owner added “security” — strip script, strip on*= handlers. He reads Hacker News now. The one thi...

Scenario : Banyan coordinates community-garden plots. The search endpoint strips any space-prefixed on* attribute. The developer assumed all attribute boundaries are whitespace. HTML does not agre...

Scenario : Overrun’s contract change-order module shipped two sprints ago. The endpoint that opens a single change order is mounted under a project route — and the middleware on that route only ch...

Scenario : Kismet is a small-town matchmaking service that still sends real letters. The online bio editor allows a short whitelist of tags for formatting — including details, for collapsible sect...