BackstagePass is a Spring Boot festival operations portal that emails encrypted, single-use invitations to artists and crew. The team recently introduced friendly error responses for damaged invitation links. Review how token decryption failures become HTTP responses at `GET /crew/accept`. A forged organizer invitation could let an attacker take over festival operations and replace ticket-sale payout details.

SoleVault is a marketplace for limited-edition sneakers where buyers can return items for store credit that is withdrawable to a bank account. The refund API recalculates amounts server-side from the order so buyers cannot tamper with prices. Review the checkout and refund flow and decide whether the credit logic can be abused.

StreamPay is a payroll dApp that lets companies fund a vault and run batch salary payouts to their employees in a single transaction. Each pay cycle, an admin calls the batch payout function which iterates over all registered employees, sends them their accrued ETH, and updates the internal ledger. Review the payout logic and determine whether funds are always accounted for correctly.

Backstage Beacon is a Spring Boot festival operations app that gives artists and crew rotating QR passes. Replacements are pushed through a Spring for GraphQL subscription so staff devices update at the gate. The schema exposes a secured `backstagePass(eventId)` query and a comparable `backstagePassUpdates(eventId)` subscription. Review how authorization is applied when a signed-in user supplies a public festival ID over the GraphQL WebSocket connection.

InboxCanvas is an Electron desktop email client used by small businesses to review invoices, receipts, and newsletters. It preserves rich email formatting by opening the selected message in a dedicated preview window. Review how that preview window is configured when it renders message HTML that originated outside the company.

DevDen is a developer community forum where members share links to repos, blogs, and live demos. To keep readers on the site, posted links open in a new browser tab. A security reviewer flagged something about how those outbound links are rendered. Can you spot what makes a friendly shared link dangerous?

WageNest is a Spring Boot payroll API used by a React employee dashboard to show payslips, tax forms, and direct-deposit details. The dashboard runs on https://app.wagenest.com and the API runs on https://api.wagenest.com, so the team added custom CORS handling during an SSO migration. Review the /api/** security configuration for credentialed browser requests. Assume an attacker can lure a logged-in employee to https://evil.example, and that the employee's API session cookie is included when the malicious page sends fetch calls with credentials: 'include' and a browser-supplied Origin header.