Hands-on secure code review
Code review is a skill.
Practice it.
Build the instinct that catches vulnerabilities in review.
Loading the weekly featured challenge…
Build the instinct that catches vulnerabilities in review.
Build the instinct that catches vulnerabilities before they ship. Review realistic production code, choose the vulnerable line, and learn from the explanation.
TipJar Studio is a Laravel creator marketplace where finance staff approve payout bank-account changes for creators with large balances. A compact approval widget was added so reviewers can process requests quickly. An attacker can host a hostile page, for example on a creator-controlled same-site promo subdomain, that embeds `/finance/payout-changes/{id}/approve` in an iframe and aligns its own button over the real approval control. Review the finance settings and payout approval paths for a browser-side framing protection gap.
“We dropped Code Review Lab into our security training rotation. Two weeks later our engineers were catching things in PR review we'd historically missed.”
This week's featured challenge takes about 15 minutes.