ArcadeHub is a fast-growing online gaming platform where players compete in tournaments, send invite codes to friends, and enter daily 'lucky draw' prizes. The backend team recently shipped account recovery so players can reset forgotten passwords by email. Many parts of the platform generate short codes and numbers that show up in the UI. Somewhere in the recovery flow, the way a sensitive value is generated lets an attacker get ahead of the system. Review the code and find the flaw.

WidgetDock is an Electron desktop dashboard where users install community widgets for calendars, weather, streaming stats, and smart-home controls. Widgets run sandboxed and use a preload bridge to read images and configuration files from their own install directory. Review the IPC path for local asset reads, especially how a widget-supplied asset name becomes a main-process file read.

Roamly is a travel marketplace that emails local offers to customers based on their preferred city. Customers can edit this preference through their profile, and a nightly job builds subscriber reports for recently changed city preferences. The job uses a legacy reporting account with broad read access to operational datasets. Review how the city value moves from the profile request into the delayed reporting workflow.

PetPal Prints lets pet owners upload photos and captions for custom mugs. The team added rich captions so customers can link to rescue shelters, and flagged orders now appear in a staff moderation queue before printing. Review how saved captions move from the public order form into the moderation dashboard, especially where the Leaf template decides whether to escape or trust the caption.