Hands-on secure code review
Code review is a skill.
Practice it.
Build the instinct that catches vulnerabilities in review.
Loading the weekly featured challenge…
Build the instinct that catches vulnerabilities in review.
Build the instinct that catches vulnerabilities before they ship. Review realistic production code, choose the vulnerable line, and learn from the explanation.
NoteNest is a self-hosted, multi-tenant note-taking SaaS (think a lightweight Notion clone). Power users can export their notes as a compressed backup and later restore them, or migrate them between accounts, using the "Import Workspace" feature. The server accepts an uploaded `.tar.gz` or `.zip` backup and unpacks it into the signed-in user's private storage folder. Each tenant is isolated by directory, and the app runs as a service account that also owns its own source files and a cron drop-in directory. Review the import pipeline and find the critical flaw that lets a crafted backup do far more than restore notes.
“We dropped Code Review Lab into our security training rotation. Two weeks later our engineers were catching things in PR review we'd historically missed.”
This week's featured challenge takes about 15 minutes.