PaceMate is an iOS running tracker that lets users sign in with their social account through a third-party OAuth provider. To receive the authorization response, the app registers a custom URL scheme (pacemate://oauth-callback) in Info.plist and completes login when iOS hands it the redirect. Review how the app starts the sign-in flow and consumes the returned authorization code.

CareLink is a telehealth portal where patients book video consults and view lab results. The team recently shipped a new account system with registration and login. During a security review of the authentication module, take a close look at how patient passwords are stored and verified before this goes live for a regulated health platform.

PiggyVault is a personal ETH savings contract for a small DeFi savings dApp. Users deposit funds and only the vault owner should be able to withdraw. To make the contract work smoothly with the companion mobile dApp — which routes calls through a relayer helper contract — the team rewrote the withdrawal guard. Review the contracts and find out whether the owner's funds are really safe.

ShiftPay is a Spring Boot payroll portal where hourly workers sign in to view payslips and update their bank deposit details. To keep people signed in across visits, the team added a 'Keep me logged in' option that drops a long-lived remember-me cookie, and a filter reads that cookie to auto-authenticate returning users. Review how the remember-me token is generated and trusted before a forged cookie hands someone else's paychecks to an attacker.

AuthGate is an enterprise SSO gateway that lets corporate customers sign in through their own SAML identity provider. The IdP posts a signed XML assertion stating which employee is logging in, and AuthGate trusts it to create a session across all of that tenant's apps. The response handler verifies a signature and then pulls out the user identity. Review how the signed XML is consumed and decide whether the identity AuthGate trusts is really the one that was signed.

TeamSync is a team-collaboration SaaS (think shared boards, tasks, and chat for distributed teams). Like every app, it ships a "forgot password" flow: a user submits their email and TeamSync sends them a link to choose a new password. The backend is Django. During a security review of the account-recovery code, take a close look at how the reset link is assembled before it goes out in the email.

PorchPulse is a smart-home platform where residents watch doorbell cameras and control connected locks through an Apollo GraphQL API. The mobile app uses graphql-ws so real-time camera subscriptions and lock mutations can run over the same WebSocket connection. Review how WebSocket connection data becomes the authenticated user in the GraphQL context.

InboxZero is a privacy-focused webmail service. Users sign in to read encrypted mail, and sessions are tracked via a cookie. The auth team recently refactored the login flow to support a 'remember me' option and to preserve the user's draft autosave across the login boundary. Review the authentication code and find the high-severity flaw in how sessions are handled around privilege changes.

BankGo is a mobile banking app that lets customers check balances, move money, and pay bills. The team recently reworked the launcher and login flow to make sure tapping the app icon always returns the user straight to the sign-in screen. During a pre-release review, focus on how the login screen is registered and how it behaves inside the Android task stack when other apps are installed on the device.

GovToken is the governance token behind a popular DeFi lending protocol. To save users gas, the team built VoteDelegate — a contract that lets holders sign an off-chain EIP-712 'delegation permit' so a relayer can register their chosen delegate on-chain. The signature is verified with ecrecover and the recovered signer is trusted as the token holder. A guardian role exists to fast-track emergency delegations. Review the signature handling and the role setup.

FitLog is a fitness tracker that syncs your runs and workouts to the cloud. To make sign-in painless, the team integrated a third-party OAuth provider and handles the redirect back into the Android app through a custom URL scheme. Take a close look at how the app receives the authorization response and ties it back to the login request. Is the round trip actually safe from other apps on the device?

Review the authentication code for InsightLoop, an online survey and research platform used by Fortune 500 companies to gather confidential market research data. After a recent database breach, attackers were able to quickly compromise respondent accounts and access private survey responses containing unpublished business strategies and competitive intelligence. Investigate how user credentials are being stored and processed.