TuneCrate is a music-library backend built in Go using gqlgen on top of PostgreSQL. Users browse and filter a catalog of tracks through the discovery page, which calls the searchTracks(genre, sort) GraphQL query. The filtering resolver was written quickly to support flexible genre and sort options. Review the resolvers backing the catalog and see whether any client-supplied input reaches the database in a way it shouldn't.

PaperTrail is a collaborative documents app where users create short 'share' links to send docs to teammates. After a link is created, the server bounces the visitor to the right document and drops a small tracking cookie so analytics can attribute the visit. The redirect target and the tracking value both come from the request. Review the share-link flow and decide whether the way these values reach the HTTP response is safe.

Review code for UserCore, an enterprise identity management system handling authentication for a SaaS platform with over 50,000 users. The password reset flow was recently refactored to improve performance by replacing an ORM with direct SQL queries. Examine how password reset tokens are validated to ensure the implementation is secure against common attack vectors.

Review the backend code for EventSphere, a popular online ticketing platform built in Go. The platform handles thousands of ticket reservations daily for concerts, sports events, and theater shows. A recent penetration test flagged potential issues in the reservation system. Examine how user inputs are processed when booking seats to ensure database operations are secure.

DungeonDesk is an online tabletop RPG platform where game masters can host virtual sessions. The PHP admin panel allows GMs to configure session settings like dice modes, player limits, and logging preferences. A recent security audit flagged the session configuration module for review. Examine how user input is processed and how configuration variables are initialized.

Review the AWS Lambda backend for UrCar, a ride-sharing platform that handles millions of trips daily. The admin analytics team recently deployed a serverless endpoint to query trips by city for business intelligence dashboards. This Lambda function connects to a legacy PostgreSQL database that stores trip history. Focus on how user input is processed in the admin endpoints and database interactions.

GridWatch is a national power grid maintenance platform used by engineers across multiple regions to manage substation configurations. The Laravel-based API allows authorized personnel to update substation identifiers, which must remain unique across all regions to prevent routing conflicts. Review the station update functionality and examine how the validation rules handle uniqueness constraints during updates.

GateSure is a border control biometric verification system deployed at international checkpoints. The system receives XML payloads containing fingerprint metadata from scanning kiosks distributed across entry points. Your task is to review the XML processing pipeline that handles incoming biometric data submissions. Pay close attention to how external data is parsed and processed by the verification backend.

Review code for StayNest, a property rental platform that recently migrated its admin panel to serverless architecture on AWS Lambda. The admin booking search endpoint allows filtering and cleanup of old bookings. The team used fmt.Fprintf for dynamic SQL query construction to optimize memory usage. Examine how user input from request headers is processed in the database operations.

Review code for an appointment booking web application used by a healthcare clinic chain. The platform allows patients to search for available doctors and book appointments via a REST API. The backend uses Express.js with MongoDB. Recent penetration testing flagged potential issues with how user input is processed in database queries. Examine how appointment data flows through the API endpoints.

Review code for LearnFast, an online learning platform that generates course completion certificates. This AWS Lambda function processes course completion reports and certificate issuance. The service has been recently migrated to serverless architecture. Examine how course identifiers are handled when updating certificate records in the database.

CellBlockOne is a prison management system used by correctional facilities to track inmates, manage cell assignments, and log disciplinary incidents. The system exposes a Laravel API used by guards on mobile tablets to quickly search for inmates by cell block and risk classification. Recent audit logs show unusual query patterns from the search endpoint. Review the codebase to identify potential security issues that could compromise inmate records or facility operations.

SpeedRunHub is a community-driven speedrunning platform where gamers compete for world records across thousands of games. The site recently added a quick verification feature allowing users to submit run metadata via GET requests for faster processing. Moderators have reported suspicious 'verified' runs appearing without their approval. Review the PHP codebase to identify how unauthorized records might be getting marked as legitimate.

Review code for PeopleFlow, an internal HR management system deployed on AWS Lambda. The application allows HR managers to search for employees by department to generate reports. The system uses PostgreSQL RDS for data storage and handles sensitive employee information including salaries and personal details. Examine the department search functionality for potential security issues.

QuickBite is a popular food delivery application that recently migrated their order management system to AWS Lambda functions. The platform allows users to search and filter their past orders by status. Review the serverless API code handling order searches to ensure customer data remains protected from unauthorized access.

Review the backend code for SecureBank, a digital banking platform that recently implemented two-factor authentication for high-value transactions. The security team wants to ensure the new OTP verification system is properly secured before the next compliance audit. Focus on how the 2FA verification endpoint processes user input during the authentication flow.

Review code for RiskGuard, an internal fraud detection backend service running on AWS Lambda. The system analyzes transaction patterns to detect anomalies and flag potentially fraudulent activity across multiple merchant accounts. Recently, the security team noticed some suspicious transactions passing through without being flagged. Examine how the fraud detection queries are constructed and executed.

Review code for a news website's rating and comment system built with Go and MongoDB. The platform allows users to rate published articles and leave comments. Management recently reported that some users are accessing unreleased news articles and internal documents through the API. Investigate how the article rating and retrieval endpoints handle user input to identify potential security gaps.

Review code for a popular movie streaming platform built with Ruby and Sinatra. The platform allows users to browse movies and rate them. The development team recently added a new rating feature that stores user ratings in a PostgreSQL database. Examine the rating endpoint implementation to ensure user input is properly handled.

Review code for a food delivery application that allows customers to rate and review their orders. The development team recently migrated from a SQL database to MongoDB for better scalability. Examine the review submission endpoint to identify potential security issues in how user input is processed.

Review the code for a document conversion web service that allows users to upload XML files and convert them to PDF format. The application is used by hundreds of companies to process their documentation. The service was recently updated to handle more document formats, and security testing is required before the next release.

Review the code for a small online shop built on Ruby on Rails using MongoDB (Mongoid ORM). Users can check the status of their orders by providing an order number through a search feature. Consider how untrusted input reaches the database and whether a malicious user could impact more records than intended.

Review code for an enterprise task management application that uses Express.js with EJS templating. The app includes custom error handling to provide user-friendly error pages. Management wants you to audit the error handling mechanism before the upcoming production deployment scheduled in 48 hours.

An e-commerce platform allows vendors to upload their product catalogs in XML format. Your team has implemented a Node.js service to parse these catalogs and import them into the database. Review the code to ensure the XML parsing is implemented securely.

Review code for a medical portal application built with Node.js and MongoDB. The application allows doctors to access patient records through a secure login. Security is critical as this system handles sensitive medical data. Focus on authentication mechanisms to ensure patient data remains protected.

Review code for an e-commerce platform that imports product catalogs via XML feeds from multiple suppliers. The application processes these XML files regularly through a scheduled task. Focus on how the XML is processed and validated before being inserted into the inventory database.

Review code for a financial data portal built with Node.js, Express, GraphQL, and PostgreSQL. The portal provides investment data to premium users. Recently, customers reported occasional system slowdowns. The engineering team has asked for a security review of the GraphQL implementation that handles financial data queries.

Review a Flask application that serves as an analytics portal for an e-commerce business. The portal allows administrators to search through customer data and transactions to generate reports. The application uses MongoDB to store user and transaction data, and includes search functionality that might not properly sanitize user input.

Review code for an e-commerce application that allows users to search for products. The application uses React on the frontend and Node.js with Express on the backend. The database is MySQL and stores product information. The search functionality was recently updated to improve performance for large product catalogs.