ParcelPing is a Rails logistics platform where merchants register a webhook URL so the system can POST delivery status updates to their endpoints. To help merchants confirm setup, the dashboard has a 'Send test event' button that makes the server immediately fire an HTTP request to the saved URL. The service runs on an EC2 instance with an attached IAM role. Review how the webhook URL is validated before the test request goes out.

TeamKey is a Django identity provider used by employees to approve third-party apps for calendar, files, and payroll profile access. Review the OAuth consent flow and the nearby revoke endpoint for browser-side protections around high-trust user clicks. The authorization request values, including client_id, redirect_uri, scope, and state, can come from an attacker-registered app.

QuickLend is a permissionless money market where users supply any ERC-20 as collateral and borrow USDQ stablecoins against it. To keep the protocol fully on-chain and oracle-free, the team values collateral by reading the live exchange rate from the token's Uniswap V2 pair against USDQ. Borrowers love it because listing a new collateral type is instant — no Chainlink feed required. Review the pricing path that determines how much a borrower can withdraw.