DormKey Express is a campus Android app that lets students unlock dorm and lab doors from a home screen widget and notification action. The app keeps a session token after login and routes quick actions through BroadcastReceivers. Review whether another installed app can trigger an unlock API call using the signed-in student's session.

KeyTurn is a Go net/http incident-response console used by contractors to request temporary production access and by on-call leads to approve or deny it. The SSO login flow is outside this snippet, but authenticated lead sessions are represented by the session store. The approval dashboard uses html/template, lead-only routing, CSRF tokens, and a route-specific CSP for a timeline chart. Review the middleware and the approval handler for a header interaction that could let a contractor-hosted page turn a lead's click into a real break-glass approval.

RefundGenie is the customer-support chatbot for VoltMart, an online electronics retailer. Shoppers chat with it to track packages and request refunds, and the bot is wired to the OpenAI function-calling API with two tools: lookup_order and issue_refund. The backend runs an agent loop that executes whatever tool the model decides to call. Refunds move real money, so take a careful look at how tool calls are trusted and executed before a transfer leaves the building.