BadgeTap Relay is a Go API that collects NFC badge swipes from office turnstiles and returns a signed unlock decision to each reader. A recent performance change replaced normal string parsing with unsafe zero-copy conversion in the binary packet decoder. Review the packet parser used by `POST /api/readers/:id/swipes`, especially how untrusted length fields from reader firmware are handled.

DeskZen is a Spring Boot help desk where the public submits support tickets through an open form and internal agents and admins triage them from a Thymeleaf dashboard. A recent UI refresh added rich inline ticket details so agents no longer have to click through to read a full message. Trace how the ticket body travels from the anonymous submit endpoint to the authenticated agent view and decide whether the dashboard is safe to load.

PennyWise is an Express budgeting app where users link a bank account and pick the destination account their savings are withdrawn to. Login is a session cookie, and the 'update withdrawal account' form submits a normal POST to /account/payout. Review how that state-changing endpoint is protected against requests triggered from other websites.

Whisper is a private messaging app that lets you forward photos and voice notes to other apps using Android's share sheet. Attachments are exposed through a ContentProvider so apps like Gmail or Photos can read them over a content:// URI. Review how the provider resolves the requested file before handing back a descriptor.

TreasureBox is an on-chain "crack the code" mini-game that went viral on crypto Twitter. The deployer locks up some ETH and sets a secret passphrase; the first player to submit the correct passphrase walks away with the entire pot. The team prides itself on keeping the answer hidden until someone is smart enough to guess it. Review the contracts and figure out whether the prize is really safe until someone guesses correctly.

PaperForge is a document-conversion SaaS where users upload a .zip of files to batch-convert to PDF. Anonymous users can submit jobs from the landing page. The upload endpoint stores the archive and a background worker unpacks it to a temp directory before rendering each file. Review the pipeline that turns an uploaded archive into individual documents on disk. Is the worker really safe trusting that it is just a zip?

ShopChain is a crypto e-commerce dApp where customers pay for orders in USDT. The `PayWith` checkout contract pulls funds from the buyer to the merchant and then marks the order as fulfilled so the warehouse can ship. The team integrated several ERC-20 tokens as accepted payment. Somewhere in the payment flow, an order can be marked paid even when no money actually moved. Review the contracts and find the flaw that lets a buyer check out for free.

QuickJot is a minimalist Android notes app. To power its home-screen widget, the app exposes notes through a ContentProvider that a small companion widget process reads from. The team wanted the widget to support flexible filtering and column selection so the UI could be customised. Review the provider that backs content://com.quickjot.provider/notes and decide whether sharing notes this way is safe.

MediSync is an Android health app that syncs login credentials, lab results, and prescriptions with its backend over HTTPS. After users on certain networks reported connection failures, a developer pushed a quick networking change to "stop the SSL errors" before a release deadline. The build went straight to production. Review the network layer and decide whether patient data is actually protected in transit.