WageNest is a Spring Boot payroll API used by a React employee dashboard to show payslips, tax forms, and direct-deposit details. The dashboard runs on https://app.wagenest.com and the API runs on https://api.wagenest.com, so the team added custom CORS handling during an SSO migration. Review the /api/** security configuration for credentialed browser requests. Assume an attacker can lure a logged-in employee to https://evil.example, and that the employee's API session cookie is included when the malicious page sends fetch calls with credentials: 'include' and a browser-supplied Origin header.

NoteNest is a self-hosted, multi-tenant note-taking SaaS (think a lightweight Notion clone). Power users can export their notes as a compressed backup and later restore them, or migrate them between accounts, using the "Import Workspace" feature. The server accepts an uploaded `.tar.gz` or `.zip` backup and unpacks it into the signed-in user's private storage folder. Each tenant is isolated by directory, and the app runs as a service account that also owns its own source files and a cron drop-in directory. Review the import pipeline and find the critical flaw that lets a crafted backup do far more than restore notes.

StickerForge Preview is a Spring Boot API for a custom sticker shop. Customers upload artwork, add a short caption, and a background worker renders a shareable PNG proof for their cart using ImageMagick. Review how the multipart caption field is carried into the preview rendering command.