Challenges
Each challenge is one codebase with known vulnerabilities injected on its own branch.
Difficulty
Review
| Name | Codebase | Type | Difficulty | Gadgets | Status | Review | Created | |
|---|---|---|---|---|---|---|---|---|
| Clinical Records Query Laundering (retry) | - | web | critical | 6 | generated | pending | Sep 23, 2026 | |
| CI Runner Webhook Breakout (retry) | - | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Freight Manifest XXE Relay (retry) | - | web | critical | 6 | generated | pending | Sep 23, 2026 | |
| Feature Flag Prototype Drift (retry) | - | web | critical | 6 | generated | pending | Sep 23, 2026 | |
| Edge Cache Session Harvest (retry) | - | web | hard | 0 | failed | pending | Sep 23, 2026 | |
| Petclinic Boarding Ledger Dirty Write (retry) | spring-petclinic | web | hard | 0 | failed | pending | Sep 23, 2026 | |
| Flask Realworld Render Chain (retry) | flask-realworld-example-app | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Graveyard Registry Takeover (retry) | openCimetière | web | hard | 0 | failed | pending | Sep 23, 2026 | |
| Gin Article Pipeline Injection (retry) | golang-gin-realworld-example-app | web | hard | 0 | failed | pending | Sep 23, 2026 | |
| FastAPI Tenant Escape (retry) | full-stack-fastapi-template | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Clinical Records Query Laundering | - | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| CI Runner Webhook Breakout | - | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Edge Cache Session Harvest | - | web | hard | 0 | failed | pending | Sep 23, 2026 | |
| Feature Flag Prototype Drift | - | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Freight Manifest XXE Relay | - | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Flask Realworld Render Chain | flask-realworld-example-app | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Petclinic Boarding Ledger Dirty Write | spring-petclinic | web | hard | 0 | failed | pending | Sep 23, 2026 | |
| Gin Article Pipeline Injection | golang-gin-realworld-example-app | web | hard | 0 | failed | pending | Sep 23, 2026 | |
| FastAPI Tenant Escape | full-stack-fastapi-template | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Graveyard Registry Takeover | openCimetière | web | hard | 0 | failed | pending | Sep 23, 2026 | |
| Payments Ledger Double Spend | - | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Headless CMS Preview Renderer | - | web | hard | 0 | failed | pending | Sep 23, 2026 | |
| Feature Flag GraphQL Takeover | - | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Artifact Registry Cache Heist | - | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Cemetery Records Blind Chain | openCimetière | web | hard | 0 | failed | pending | Sep 23, 2026 | |
| Petclinic XML Intake Pivot | spring-petclinic | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Tenant Escape Ledger API | full-stack-fastapi-template | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Flask Realworld Template Breakout | flask-realworld-example-app | web | critical | 0 | failed | pending | Sep 23, 2026 | |
| Generic Web #1 | Smoke Test Target | web | medium | 1 | generated | accepted | Aug 29, 2026 | |
| Smoke Test Challenge | Smoke Test Target | web | easy | 2 | generated | accepted | Aug 27, 2026 |