Secure Coding Labs

Practice real-world secure coding scenarios through hands-on challenges and labs.

Valid Accounts: Cloud Accounts

medium incident-response python cloudwatch

The attacker uses valid credentials obtained through the reset token to access user accounts.

Compromise Software Dependencies and Development Tools

critical incident-response javascript github

Malicious npm packages (e.g. compromised versions of common dependencies) are published and pulled into developer and CI environments, providing the...

critical

Exploit Public-Facing Application

critical incident-response javascript react

Attackers send crafted React Server Components Flight requests to public-facing endpoints (for example /_rsc) on vulnerable React/Next.js servers, gaining unauthenticated...

medium

MCP Rug Pull

medium CWE-494 CWE-829 artificial-inteligence-ai

An MCP rug pull happens when a once-trusted tool or provider changes behaviour after being installed or approved — typically...

medium

MCP Tool Collision

medium CWE-706 artificial-inteligence

Tool collision occurs when two MCP tools with the same or confusingly similar name, namespace, or capability are loaded into...

high

MCP Line Jumping

high CWE-20 CWE-829 artificial-inteligence

Line-jumping is a prompt-injection variant where an attacker injects control characters, unexpected newlines, or specially crafted tokens into an MCP...