InboxCanvas is an Electron desktop email client used by small businesses to review invoices, receipts, and newsletters. It preserves rich email formatting by opening the selected message in a dedicated preview window. Review how that preview window is configured when it renders message HTML that originated outside the company.

DevDen is a developer community forum where members share links to repos, blogs, and live demos. To keep readers on the site, posted links open in a new browser tab. A security reviewer flagged something about how those outbound links are rendered. Can you spot what makes a friendly shared link dangerous?

WageNest is a Spring Boot payroll API used by a React employee dashboard to show payslips, tax forms, and direct-deposit details. The dashboard runs on https://app.wagenest.com and the API runs on https://api.wagenest.com, so the team added custom CORS handling during an SSO migration. Review the /api/** security configuration for credentialed browser requests. Assume an attacker can lure a logged-in employee to https://evil.example, and that the employee's API session cookie is included when the malicious page sends fetch calls with credentials: 'include' and a browser-supplied Origin header.